Using a Bus Pirate for Quick Hardware Triage
The Bus Pirate is a small, inexpensive tool that speaks many low-level protocols, which makes it ideal for the messy early phase of a hardware assessment when you are not yet sure what a bus is. It will not dump a large flash quickly, but it answers the first questions faster than anything else on the bench.
A Pocket Multi-Tool for Unknown Buses
Early in a hardware assessment you are usually staring at a few unlabeled pads and a hunch about what they carry. You could wire up a dedicated UART adapter, then swap to an SPI programmer, then reach for an I2C tool, but that is three setups to test three theories. The Bus Pirate collapses that into one device that switches modes from a serial menu, cheap enough to keep in a drawer and flexible enough to be the first thing you reach for.
The point of the tool is speed of iteration, not raw performance. When you do not yet know whether a four-pad header is UART, SPI, or something else, the ability to try each interpretation in seconds, without rewiring, is worth more than throughput. That is the job the Bus Pirate is built for, and it does it better than almost anything at its price.
One Tool, Many Modes
A single Bus Pirate acts as a UART bridge, an SPI master, an I2C master, a 1-Wire host, or a raw bit-banger, switching with a number from its menu. A handful of moves cover almost all of the early triage:
| Move | What it answers | Probe |
|---|---|---|
| I2C address scan | Which devices sit on the bus | (1) macro |
| SPI JEDEC ID | Is this flash, and which part | [ 0x9f r r r ] |
| UART bridge | Is this a serial console | (1) at 115200 |
| Pull-ups + power | Is the bus pulled up and powered | P then W |
| Active read | What a device actually holds | addressed read |
You connect once, then change what the pins mean in software rather than at the breadboard. Switching into I2C mode, for example, is a few keystrokes from the tool’s own console:
# connect to the Bus Pirate's own console and pick a mode
screen /dev/ttyUSB0 115200
HiZ> m
1. HiZ 2. 1-WIRE 3. UART 4. I2C 5. SPI 6. 2WIRE ...
(1)> 4 # select I2CSet speed: 1.(5KHz) 2.(50KHz) 3.(100KHz) 4.(400KHz) (1)> 3 Ready I2C>
A few keystrokes put the tool into I2C mode at 100 kHz, ready to talk, and the same tool a moment later is an SPI master or a serial bridge. That mode-switching is what makes it a triage instrument rather than a single-purpose adapter.
Scan an I2C Bus
The fastest high-value move on an unknown board is an I2C address scan. It probes every address and reports which ones answer, inventorying the sensors, EEPROMs, and controllers on the bus in seconds, and an EEPROM that answers is often where configuration or keys are stored.
# I2C macro (1) runs a full 7-bit address scan
I2C> (1)Searching I2C address space. Found devices at: 0x50(0x A0 W) 0x51(0x A2 W) # two EEPROMs 0x68(0xD0 W) # RTC or IMU
Three devices on the bus, two of them EEPROMs at 0x50 and 0x51. Configuration EEPROMs are a frequent home for stored settings and occasionally secrets, so those two addresses immediately become targets for a read. The scan turned a silent bus into a short list of things to look at.
Read an SPI Flash ID
When you suspect an eight-pin chip is SPI flash, the Bus Pirate confirms it by reading the JEDEC ID, a standard command every 25-series part answers. The ID names the manufacturer and capacity, which tells you what you are dealing with before you commit a programmer to a full read.
# in SPI mode, issue the JEDEC ID command 0x9F and read three bytes
SPI> [ 0x9f r r r ]WRITE: 0x9F READ: 0xEF 0x40 0x18 # 0xEF=Winbond, 0x4018 = W25Q128, 16 MB
Three bytes identify the chip as a 16 MB Winbond W25Q128. Now you know its size and command set, which means a programmer can read it cleanly and you know roughly how much firmware to expect. The Bus Pirate did the identification; a faster tool will do the bulk read.
Confirm a UART Console
A row of pads that flickers at boot is probably a serial console, and the Bus Pirate’s UART mode with its transparent bridge confirms it. Set a common rate, watch for readable text, and you have found the console without dedicating a separate adapter to the guess.
# UART mode, transparent bridge at 115200 to watch the boot log
UART> (1) # macro 1: transparent UART bridgeU-Boot 2019.07 (Mar 02 2022) Hit any key to stop autoboot: Booting Linux... [ 0.00] Linux version 4.14.0
Readable boot text at 115200 confirms the console and hands you the bootloader version and the kernel in one shot. If a prompt appears, you may even have an interactive way in. That is a major finding produced by a thirty-second probe.
Power and Pull-Ups Built In
I2C will not work without pull-up resistors on its two lines, and many quick tests fail simply because the bus is not pulled up. The Bus Pirate can enable its own pull-ups and supply 3.3V or 5V power from the same connector, so you can energize a small target and talk to it without assembling a breadboard of support parts.
# enable on-board pull-ups and the power supplies
I2C> P # pull-ups on
I2C> W # power supplies on (3.3V and 5V)Pull-up resistors ON Power supplies ON # the I2C bus now idles high and the target is powered for a quick read
Turning on pull-ups and power from the tool itself removes the most common reason a quick I2C test fails. For triage, that built-in support is the difference between a clean answer in a minute and twenty minutes of wondering why the bus is dead.
Talk Back, Not Just Listen
The Bus Pirate is not only a sniffer, it is an active master that can issue commands and read responses. You can dump the first bytes of an I2C EEPROM, send a read command to an SPI part, or poke a peripheral to see how it answers. Active probing is what turns “there is a device here” into “here is what it holds.”
# read the first 16 bytes of the EEPROM at 0x50
I2C> [ 0xA0 0x00 [ 0xA1 r:16 ]READ: 0x53 0x4E 0x31 0x32 0x33 0x00 0x00 0x01 ... # ASCII "SN123" -> a serial number stored in the config EEPROM
Reading the EEPROM turns up a serial number in the first bytes, which hints the rest of the device holds configuration worth dumping in full. That is the triage payoff: a quick active read told you the part is interesting and worth a complete extraction later.
Scripting Repetitive Probes
Once you know what you want, the Bus Pirate’s commands can be driven from a script rather than typed, which makes repeated reads across several units consistent. Piping a sequence of bus commands into the serial port automates an EEPROM dump or an ID check across a batch of boards, which matters when you are comparing units, checking whether a key or serial number is shared, or re-running the same probe after a change. Scripting the interaction removes the transcription errors that creep into manual sessions and turns a one-off poke into a repeatable test you can hand to someone else.
Where the Bus Pirate Stops, and What Replaces It
It is a triage tool, not a workhorse, and pretending otherwise wastes time. It is too slow to dump a 16 MB flash in a reasonable time and not fast enough to sniff a high-speed bus without missing transitions, so when the job moves from “what is this bus” to “capture all of it” or “dump the whole chip,” you switch instruments: a CH341A or a dedicated programmer for bulk flash reads, a proper logic analyzer for fast or wide buses.
It is not the only option in this niche either. An FT2232-based adapter is faster for SPI and JTAG, and newer tools like the Glasgow Interface Explorer bring more channels and a Python-driven workflow. The Bus Pirate keeps its place mostly on price, ubiquity, and the simplicity of its menu, forgiving and well documented for someone learning hardware reconnaissance, and often already in the drawer when you just need a quick answer. The faster tools earn their keep once you know what you are doing and need throughput.
Where It Fits in a Workflow
The Bus Pirate earns its place in the messy first hour, when you are still figuring out what a bus is and whether it deserves deeper attention: an I2C scan inventories devices, an SPI ID read names a flash chip, and a UART probe confirms a console, and those fast answers tell you where to point the heavier gear. Thinking of it as triage rather than a primary instrument keeps the workflow clean, poke quickly with the cheap, flexible tool, then commit the expensive setup only to the buses that turned out to matter, which is what saves an assessment from spending a day wiring up a logic analyzer on a bus that a thirty-second scan would have shown was uninteresting.
Where This Fits
Fast, accurate hardware triage is the front end of any hardware penetration test, and doing it well makes the rest of the work focused instead of scattered. If you want a hands-on assessment of your product that starts by mapping every bus and interface, that is the kind of work we do at Berkner Tech.
