From bb6de53ddb7aaa82275bed10ad16990bff765fa7 Mon Sep 17 00:00:00 2001 From: CTXz Date: Sat, 17 Jun 2023 18:19:08 +0200 Subject: [PATCH] Restructured repo Signed-off-by: CTXz --- .gitignore | 4 ++ .vscode/settings.json | 15 +++-- README.md | 2 +- CMakeLists.txt => attack/CMakeLists.txt | 17 ++++- {src => attack}/attack.c | 0 .../pico_sdk_import.cmake | 0 dump.py | 60 ++++++++++++++++-- {docs => img}/BPExample.png | Bin {docs => img}/BPExample.svg | 0 {docs => img}/banner.gif | Bin src/CMakeLists.txt | 18 ------ {targetfw => target}/Makefile | 2 +- {targetfw => target}/main.c | 0 {targetfw => target}/ram.ld | 0 {targetfw => target}/test.S | 0 15 files changed, 85 insertions(+), 33 deletions(-) create mode 100644 .gitignore rename CMakeLists.txt => attack/CMakeLists.txt (50%) rename {src => attack}/attack.c (100%) rename pico_sdk_import.cmake => attack/pico_sdk_import.cmake (100%) rename {docs => img}/BPExample.png (100%) rename {docs => img}/BPExample.svg (100%) rename {docs => img}/banner.gif (100%) delete mode 100644 src/CMakeLists.txt rename {targetfw => target}/Makefile (76%) rename {targetfw => target}/main.c (100%) rename {targetfw => target}/ram.ld (100%) rename {targetfw => target}/test.S (100%) diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..a344b1a --- /dev/null +++ b/.gitignore @@ -0,0 +1,4 @@ +.elf +.o +attack/build +.vscode/ diff --git a/.vscode/settings.json b/.vscode/settings.json index ca4029c..b858ccd 100644 --- a/.vscode/settings.json +++ b/.vscode/settings.json @@ -1,7 +1,10 @@ { - "cmake.environment": - { - "PICO_SDK_PATH": "/home/patrick/pico-sdk" - }, - "C_Cpp.default.configurationProvider": "ms-vscode.cmake-tools" -} \ No newline at end of file + "cmake.environment": { + "PICO_SDK_PATH": "/home/patrick/pico-sdk" + }, + "C_Cpp.default.configurationProvider": "ms-vscode.cmake-tools", + "[python]": { + "editor.defaultFormatter": "ms-python.black-formatter" + }, + "python.formatting.provider": "none" +} diff --git a/README.md b/README.md index 998fd44..218564a 100644 --- a/README.md +++ b/README.md @@ -107,7 +107,7 @@ This is discussed in more detail in the [How does the attack work?](#how-does-th Bellow is a picture that shows the hardware setup using a Blue Pill board: -![Blue Pill Example](docs/BPExample.png) +![Blue Pill Example](img/BPExample.png) ## Executing the attack diff --git a/CMakeLists.txt b/attack/CMakeLists.txt similarity index 50% rename from CMakeLists.txt rename to attack/CMakeLists.txt index cd270f6..b0f0251 100644 --- a/CMakeLists.txt +++ b/attack/CMakeLists.txt @@ -11,6 +11,17 @@ project(attack C CXX ASM) # initialize the Raspberry Pi Pico SDK pico_sdk_init() -add_subdirectory( - src -) \ No newline at end of file +add_executable(attack + attack.c +) + +# Add pico_stdlib library which aggregates commonly used features +target_link_libraries(attack pico_stdlib + hardware_uart + hardware_pwm +) + +pico_enable_stdio_usb(attack 1) +pico_enable_stdio_uart(attack 0) + +pico_add_extra_outputs(attack) \ No newline at end of file diff --git a/src/attack.c b/attack/attack.c similarity index 100% rename from src/attack.c rename to attack/attack.c diff --git a/pico_sdk_import.cmake b/attack/pico_sdk_import.cmake similarity index 100% rename from pico_sdk_import.cmake rename to attack/pico_sdk_import.cmake diff --git a/dump.py b/dump.py index 8ff53d7..45e7584 100644 --- a/dump.py +++ b/dump.py @@ -40,7 +40,7 @@ REQ_ATTACK_BOARD_VERSION = "1.x" SERIAL_TIMEOUT_S = 0.5 script_path = Path(__file__).resolve() -default_targetfw_bin = str(script_path.parent / "targetfw" / "targetfw.bin") +default_targetfw_bin = str(script_path.parent / "target" / "target.bin") parser = argparse.ArgumentParser(description="") parser.add_argument("-o", "--output", help="Output file") @@ -57,7 +57,7 @@ parser.add_argument( parser.add_argument( "-t", "--targetfw", - help="Path to target exploit firmware binary", + help="Path to target exploit firmware", required=False, default=default_targetfw_bin, ) @@ -197,7 +197,7 @@ while True: break elif "Error: expected 1 of 1" in line: print( - "Error: Connecteed device does not be appear to be an STM32F1 device" + "Error: Connected device does not be appear to be an STM32F1 device" ) ser.close() exit(1) @@ -212,12 +212,64 @@ while True: time.sleep(1) # Wait for 1 second before retrying +try: + result = subprocess.run( + [ + "openocd", + "-f", + "interface/stlink.cfg", + "-f", + "target/stm32f1x.cfg", + "-c", + "init", + "-c", + "stm32f1x options_read 0", + "-c", + "exit", + ], + capture_output=True, + text=True, + ) + + read_protection_status = None + lines = result.stderr.splitlines() + for line in lines: + if "read protection: on" in line: + read_protection_status = True + print("STM32F1 target is indeed read protected") + break + elif "read protection: off" in line: + read_protection_status = False + print( + "STM32F1 target is not read protected, the attack may not be necessary" + ) + print("Do you wish to continue anyway? (y/n): ", end="") + while True: + choice = input().lower() + if choice == "y": + break + elif choice == "n": + ser.close() + exit(0) + else: + print("Please respond with 'y' or 'n'") + break +except FileNotFoundError: + print("openocd command not found. Make sure it is installed.") + ser.close() + exit(1) + +if read_protection_status is None: + print("Error: Could not determine read protection status") + print("Is your debug probe properl connected to the STM32F1 target?") + ser.close() + exit(1) + print("Press any key to load the target exploit firmware to SRAM") input() try: result = subprocess.run( - # openocd -f interface/stlink.cfg -f target/stm32f1x.cfg -c init -c "load_image targetfw/targetfw.bin 0x20000000" -c exit [ "openocd", "-f", diff --git a/docs/BPExample.png b/img/BPExample.png similarity index 100% rename from docs/BPExample.png rename to img/BPExample.png diff --git a/docs/BPExample.svg b/img/BPExample.svg similarity index 100% rename from docs/BPExample.svg rename to img/BPExample.svg diff --git a/docs/banner.gif b/img/banner.gif similarity index 100% rename from docs/banner.gif rename to img/banner.gif diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt deleted file mode 100644 index 0594bc2..0000000 --- a/src/CMakeLists.txt +++ /dev/null @@ -1,18 +0,0 @@ -add_executable(attack - attack.c -) - -# Add pico_stdlib library which aggregates commonly used features -target_link_libraries(attack pico_stdlib - hardware_uart - hardware_pwm -) - -pico_enable_stdio_usb(attack 1) -pico_enable_stdio_uart(attack 0) - -# Set the output directory for the UF2 file -set(OUTPUT_PATH "${CMAKE_CURRENT_BINARY_DIR}/..") -set_target_properties(attack PROPERTIES ARCHIVE_OUTPUT_DIRECTORY ${OUTPUT_PATH}) - -pico_add_extra_outputs(attack) \ No newline at end of file diff --git a/targetfw/Makefile b/target/Makefile similarity index 76% rename from targetfw/Makefile rename to target/Makefile index 1ea2c82..18350ca 100644 --- a/targetfw/Makefile +++ b/target/Makefile @@ -2,7 +2,7 @@ all: arm-none-eabi-gcc -o test.o -c test.S -mthumb -mcpu=cortex-m3 -g3 arm-none-eabi-gcc -o main.o -c main.c -mthumb -mcpu=cortex-m3 -Os -g3 arm-none-eabi-gcc -o sram.elf ./test.o ./main.o -nostartfiles -Tram.ld -mcpu=cortex-m3 -mthumb -g3 - arm-none-eabi-objcopy -O binary sram.elf targetfw.bin + arm-none-eabi-objcopy -O binary sram.elf target.bin clean: rm -f *.o *.elf *.bin \ No newline at end of file diff --git a/targetfw/main.c b/target/main.c similarity index 100% rename from targetfw/main.c rename to target/main.c diff --git a/targetfw/ram.ld b/target/ram.ld similarity index 100% rename from targetfw/ram.ld rename to target/ram.ld diff --git a/targetfw/test.S b/target/test.S similarity index 100% rename from targetfw/test.S rename to target/test.S