Reverse-engineering a Yamaha THR10c guitar amp via JTAG and UART headers

A hobbyist hardware hacker documents the process of accessing the firmware on a Yamaha THR10c guitar amp after spotting UART and JTAG headers in the service manual schematic. The goals were practical: add a persistent toggle for speaker simulation (currently only available through a transient MIDI SysEx command) and enable the internal speaker to keep playing when headphones are plugged in. The work required identifying obscure JST and Molex FFC-style connectors, clearing through-holes, and soldering SMD pads onto the main PCB to expose the debug interfaces externally.

The UART header turned out to be dead — no activity on TX at any baud rate — so attention shifted to JTAG. Using an FT2232H mini module as the adapter, the author wired up TCK, TMS, TDI, TDO plus GPIOs for TRST and SRST (TRST being active-low and pulled to ground, it needed software control rather than being tied high). OpenOCD detected a TAP controller with ID 0x4F1F0F0F, matching NXP LPC 2xxx parts based on an ARM7TDMI-S core, which led to a working GDB session over remote debugging. A final wrinkle: the SSP2 chip runs big-endian, confirmed by comparing byte- and word-aligned memory reads, requiring a config update.

The writeup is a useful walkthrough of practical embedded reverse engineering — connector identification, FT2232H wiring quirks, OpenOCD/UrJTAG tradeoffs, and the iterative process of inferring a target’s CPU core from a JTAG ID alone. It illustrates how consumer audio gear with exposed debug headers remains an accessible playground for firmware modification.