[ofjcihen]

The look into these is neat but…why immediately open it up and trigger the tamper state? Did they not know most readers would have one?

Any real testing happening in the tamper state might be meaningless. Perhaps the shell is available after the tamper state triggers for resetting purposes.

It just seems like opening it would be the last thing you would try.

[stgl]

Well, I felt like I first had to get a feeling for what I am working with. Hardware, what SoC, interfaces, flash etc... Otherwise I am too much in the dark. But sure, in hindsight I could've just tapped the debug connector and could have been done with it.

No, I got a shell on second, untampered one, as well.

[allenrb]

Specifics of this hack aside, I wish I could solder like that!