Rule zero: buy the $3 cable first. Your first probe on an unknown board should be a sacrificial CH340, not a $60 Tigard. Once the pins are confirmed safe, then reach for one of the three adapters below: each earns its higher price by doing more than UART (SPI flash dumps, JTAG/SWD, or standalone field work).
When hunting for TX with a multimeter, the touched pad may sit above 3.3 V or spike transiently under load. A 3.3 V CH340's clamp diode gives up before you can pull the probe. The cheap cable is the intended sacrifice. The Tigard goes on only after the pad is confirmed RX-safe at the expected voltage.
| Tigard | Flipper Zero | Bus Pirate 5 | |
|---|---|---|---|
| Approx. price | ~$60 (Crowd Supply) | $169 | ~$70 to $95 |
| Core silicon | FT2232H | STM32WB55 (Cortex-M4 + M0+) | RP2040 (BP5) / RP2350 (BP5XL, BP6) |
| Protocols | UART, SPI, I2C, JTAG, SWD | UART, SPI, I2C, GPIO, plus sub-GHz / NFC / RFID / IR / BLE | UART, SPI, I2C, 1-Wire, HD44780, JTAG (basic) |
| I/O voltage | 1.8 / 3.3 / 5 V switchable | 3.3 V | 1.65 to 5 V |
| Standalone | No, needs host | Yes, screen + battery | Yes, screen + USB-C |
| Open hardware | Yes | Yes | Yes |
| Pick when | Bench work, full multi-protocol | Field work, one all-in-one tool | Poking unknown chips at a prompt, scripting |
None of these three is your first-probe tool. Use the sacrifice-probe CH340 for that (see rule zero above); reach for the Tigard / Flipper / BP5 only after the pad is confirmed RX-safe.
Tigard
Tigard
~$60 USDFT2232H-based open-hardware multi-protocol board. Project lead is Joe FitzPatrick (@securelyfitz on GitHub, top contributor on the upstream tigard-tools/tigard repo). Design lineage acknowledged in the README is Matir's TIMEP.
- FT2232H is first-class in OpenOCD, flashrom, pyftdi, libftdi.
- Switchable 1.8 V / 3.3 V / 5 V I/O. Catches the inevitable 1.8 V vs 3.3 V mistake.
- Dedicated header per protocol. No jumper juggling between modes.
- Open hardware with an active upstream.
- Needs a host computer. Does nothing standalone.
- Not portable. Pure bench tool.
- Crowd Supply stock is intermittent.
Flipper Zero
Flipper Zero
$169 USDSelf-contained portable hardware tool. STM32WB55, screen, battery, sub-GHz radio, NFC, RFID, IR, Bluetooth, plus an 18-pin GPIO header that exposes UART, SPI, I2C, and general GPIO. Official docs at docs.flipper.net/gpio-and-modules.
- One device covers UART, SPI, I2C, sub-GHz, NFC, and BLE.
- Screen shows the boot log in real time. No host required.
- Battery powered. Actually fits in a pocket.
- Open firmware with an active community and third-party apps.
- JTAG / SWD via expansion modules. Fiddlier than Tigard.
- Logic-analyzer mode is token; not competitive with a Saleae.
- $169, the most expensive of the three.
- Some corporate BYOD policies flag it as a prohibited device on-site (the sub-GHz and BLE radios trigger it, not the UART header): check before you travel.
Bus Pirate 5 / 5XL / 6
Bus Pirate 5 / 5XL / 6
~$70 to $95 USDOriginally shipped by Ian Lesnet at Dangerous Prototypes in 2008 (Wikipedia). Stayed mostly static for years. Current generation is Bus Pirate 5 (RP2040) and 5XL / 6 (RP2350) with a screen, USB-C, and actively maintained firmware. Mainline revision as of mid-2026 is REV10.
- Scriptable interactive console. Fast for one-off poking.
- RP-series MCU (RP2040 on BP5, RP2350 on 5XL/6). Big jump from the PIC24 generations that sat unchanged for a decade.
- Wide voltage range (1.65 to 5 V).
- Cheapest of the three.
- Outside the FT2232H ecosystem. OpenOCD with vendor JTAG configs and flashrom won't target it natively.
- JTAG support is functional, not first-class.
- Older Bus Pirate tutorials online often don't apply to the v5/v6 firmware.
Capturing a boot log
Once the adapter is wired (GND to GND, adapter TX to device RX, adapter RX to device TX: never Vcc), you need a serial terminal on the host to record what streams in. The three practical picks:
picocom and tio both let you save the session to a file directly. Almost every embedded UART is 115200 8N1.
# picocom (log to a file with --logfile)
picocom --baud 115200 --logfile bootlog.txt /dev/ttyUSB0
# tio (writes to ${TIO_LOG_FILE} when --log is set)
tio --log --log-file bootlog.txt --baudrate 115200 /dev/ttyUSB0
# screen: no built-in logging, use tee if you need it
screen /dev/ttyUSB0 115200Substitute your adapter's device node (/dev/ttyUSB0, /dev/ttyACM0, /dev/cu.usbserial-* on macOS). Your user may need to be in the dialout group on Linux.
bootintel.com/terminal is a Web Serial terminal: plug in the adapter, click Connect, pick the port from the browser prompt. Chromium-based browsers only (Chrome, Edge, Opera, Brave; not Firefox or Safari). Zero drivers on modern Linux; on Windows the FTDI/CH340 vendor driver still needs to be installed once system-wide. Saved captures are stored in the browser tab until you copy them out: never uploaded.
Buying guide
| If | Buy |
|---|---|
| Only buying one tool | Tigard. Most capability per dollar for any work that goes past pure UART. |
| Traveling with tools | Flipper Zero. Worth the premium for the self-contained form factor alone. |
| Scripting and exploring chips often | Bus Pirate 5. Interactive console workflow is genuinely faster than scripting against libftdi. |
One thing to skip regardless: counterfeit FTDI cables. In January 2016 FTDI shipped a Windows driver that injected "NON GENUINE DEVICE FOUND" into the byte stream on clones: corrupting boot logs in ways that wasted hours. FTDI backed off after the outcry, and the behaviour never affected Linux or macOS drivers, but the clone market is still full of chips that identify weirdly under various OSes. Buy from a Crowd Supply / Adafruit / SparkFun tier of distributor, or a $3 CH340 knowing you got a CH340.
Related
- Interruptable autoboot: the 3-second window that gives an attacker root : why boot log capture matters. Two thirds of the shipping devices in our sample corpus have this exposure.
- U-Boot 1.1.x from 2005 is still shipping on consumer routers in 2026 : once you have a capture, this is the first version string to grep for.
- Device Fingerprinter, paste a captured boot log, get bootloader / kernel / SoC identification immediately. Client-side, no upload.
- Web Serial terminal: capture straight into the browser (Chromium-based only), no picocom/screen install.
- Device coverage: what BootIntel detects per device family.
- Adapter budget approved but the fleet-scale one wasn't? BootIntel's paid tiers are what happens when the boot log workflow above needs to scale past one bench.