Restructured repo

Signed-off-by: CTXz <ctx.xda@gmail.com>

.gitignore

@@ -0,0 +1,4 @@
+.elf
+.o
+attack/build
+.vscode/

.vscode/settings.json

@@ -1,7 +1,10 @@
 {
-    "cmake.environment":
-    {
-        "PICO_SDK_PATH": "/home/patrick/pico-sdk"
-    },
-    "C_Cpp.default.configurationProvider": "ms-vscode.cmake-tools"
-}
+  "cmake.environment": {
+    "PICO_SDK_PATH": "/home/patrick/pico-sdk"
+  },
+  "C_Cpp.default.configurationProvider": "ms-vscode.cmake-tools",
+  "[python]": {
+    "editor.defaultFormatter": "ms-python.black-formatter"
+  },
+  "python.formatting.provider": "none"
+}

README.md

@@ -107,7 +107,7 @@ This is discussed in more detail in the [How does the attack work?](#how-does-th
 
 Bellow is a picture that shows the hardware setup using a Blue Pill board:
 
-![Blue Pill Example](docs/BPExample.png)
+![Blue Pill Example](img/BPExample.png)
 
 ## Executing the attack
 

attack/CMakeLists.txt

@@ -11,6 +11,17 @@ project(attack C CXX ASM)
 # initialize the Raspberry Pi Pico SDK
 pico_sdk_init()
 
-add_subdirectory(
-    src
-)
+add_executable(attack
+    attack.c
+)
+
+# Add pico_stdlib library which aggregates commonly used features
+target_link_libraries(attack pico_stdlib 
+    hardware_uart 
+    hardware_pwm
+)
+
+pico_enable_stdio_usb(attack 1)
+pico_enable_stdio_uart(attack 0)
+
+pico_add_extra_outputs(attack)

dump.py

@@ -40,7 +40,7 @@ REQ_ATTACK_BOARD_VERSION = "1.x"
 SERIAL_TIMEOUT_S = 0.5
 
 script_path = Path(__file__).resolve()
-default_targetfw_bin = str(script_path.parent / "targetfw" / "targetfw.bin")
+default_targetfw_bin = str(script_path.parent / "target" / "target.bin")
 
 parser = argparse.ArgumentParser(description="")
 parser.add_argument("-o", "--output", help="Output file")
@@ -57,7 +57,7 @@ parser.add_argument(
 parser.add_argument(
     "-t",
     "--targetfw",
-    help="Path to target exploit firmware binary",
+    help="Path to target exploit firmware",
     required=False,
     default=default_targetfw_bin,
 )
@@ -197,7 +197,7 @@ while True:
                 break
             elif "Error: expected 1 of 1" in line:
                 print(
-                    "Error: Connecteed device does not be appear to be an STM32F1 device"
+                    "Error: Connected device does not be appear to be an STM32F1 device"
                 )
                 ser.close()
                 exit(1)
@@ -212,12 +212,64 @@ while True:
 
     time.sleep(1)  # Wait for 1 second before retrying
 
+try:
+    result = subprocess.run(
+        [
+            "openocd",
+            "-f",
+            "interface/stlink.cfg",
+            "-f",
+            "target/stm32f1x.cfg",
+            "-c",
+            "init",
+            "-c",
+            "stm32f1x options_read 0",
+            "-c",
+            "exit",
+        ],
+        capture_output=True,
+        text=True,
+    )
+
+    read_protection_status = None
+    lines = result.stderr.splitlines()
+    for line in lines:
+        if "read protection: on" in line:
+            read_protection_status = True
+            print("STM32F1 target is indeed read protected")
+            break
+        elif "read protection: off" in line:
+            read_protection_status = False
+            print(
+                "STM32F1 target is not read protected, the attack may not be necessary"
+            )
+            print("Do you wish to continue anyway? (y/n): ", end="")
+            while True:
+                choice = input().lower()
+                if choice == "y":
+                    break
+                elif choice == "n":
+                    ser.close()
+                    exit(0)
+                else:
+                    print("Please respond with 'y' or 'n'")
+            break
+except FileNotFoundError:
+    print("openocd command not found. Make sure it is installed.")
+    ser.close()
+    exit(1)
+
+if read_protection_status is None:
+    print("Error: Could not determine read protection status")
+    print("Is your debug probe properl connected to the STM32F1 target?")
+    ser.close()
+    exit(1)
+
 print("Press any key to load the target exploit firmware to SRAM")
 input()
 
 try:
     result = subprocess.run(
-        # openocd -f interface/stlink.cfg -f target/stm32f1x.cfg -c init -c "load_image targetfw/targetfw.bin 0x20000000" -c exit
         [
             "openocd",
             "-f",

src/CMakeLists.txt

@@ -1,18 +0,0 @@
-add_executable(attack
-    attack.c
-)
-
-# Add pico_stdlib library which aggregates commonly used features
-target_link_libraries(attack pico_stdlib 
-    hardware_uart 
-    hardware_pwm
-)
-
-pico_enable_stdio_usb(attack 1)
-pico_enable_stdio_uart(attack 0)
-
-# Set the output directory for the UF2 file
-set(OUTPUT_PATH "${CMAKE_CURRENT_BINARY_DIR}/..")
-set_target_properties(attack PROPERTIES ARCHIVE_OUTPUT_DIRECTORY ${OUTPUT_PATH})
-
-pico_add_extra_outputs(attack)

target/Makefile

@@ -2,7 +2,7 @@ all:
 	arm-none-eabi-gcc -o test.o -c test.S -mthumb -mcpu=cortex-m3 -g3
 	arm-none-eabi-gcc -o main.o -c main.c -mthumb -mcpu=cortex-m3 -Os -g3
 	arm-none-eabi-gcc -o sram.elf ./test.o ./main.o -nostartfiles -Tram.ld -mcpu=cortex-m3 -mthumb -g3
-	arm-none-eabi-objcopy -O binary sram.elf targetfw.bin
+	arm-none-eabi-objcopy -O binary sram.elf target.bin
 
 clean:
 	rm -f *.o *.elf *.bin