maq/stm32f1-picopwner
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
88 Commits 7 Branches 6 Tags
main
Commit Graph

88 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
CTXz
76f17499ab Dump.py + Target Fw: Updated version numbers for next release 
Signed-off-by: CTXz <ctx.xda@gmail.com>
a1.2_t1.4 		2024-04-01 12:35:49 +02:00
Patrick Pedersen
cfc4c29167 Merge pull request #25 from deividAlfa/patch-1 
Implement IWDG. Ignore flash size, dump until hard fault. Show hex address.
 2024-03-31 06:13:58 +02:00
deividAlfa
6986f180f1 Show flash address in terminal 
Instead plain data, show:

Press enter to start dumping firmware

0x8000000:  00 50 00 20 e1 02 00 08 c9 02 00 08 cb 02 00 08
...
0x801fff0:  ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
Target has stopped sending data, assuming dump is complete
Dumped 131072 bytes
 2024-03-25 19:32:09 +01:00
deividAlfa
8c1925f860 Implement IWDG. Ignore flash size reg, dump flash until hard fault. 
Check WDG_SW in Option Bytes, IWDG might be enabled by hardware, triggering a reset while dumping the firmware and causing an endless loop.

Ignore flash size register as not all stm32 clones implement it.
Instead, dump up to 1MB, when the flash is over it'll trigger a hard fault and stop.
 2024-03-25 18:01:04 +01:00
CTXz
8d963ae496 Target: Do not reset upon faults 
Signed-off-by: CTXz <ctx.xda@gmail.com>
 2024-03-03 18:08:01 +01:00
CTXz
2bf4ad7ab1 Target: Entry: Fixed comment typo 
Signed-off-by: CTXz <ctx.xda@gmail.com>
 2024-03-03 18:05:45 +01:00
Patrick Pedersen
624f88ff90 Target: Minor comment improvement 2024-02-27 13:28:35 +01:00
Patrick Pedersen
7abce06940 README: Fixed typo 2024-02-27 13:27:33 +01:00
Patrick Pedersen
06ea0605e5 Target: Added define for USART_SR_TXE 
Signed-off-by: Patrick Pedersen <ctx.xda@gmail.com>
a1.2_t1.3 		2024-02-24 01:15:16 +01:00
Patrick Pedersen
0273a9321a Target: Updated RELEASE_VERSION to 1.3 in target fw makefile 
Signed-off-by: Patrick Pedersen <ctx.xda@gmail.com>
 2024-02-24 00:32:14 +01:00
Patrick Pedersen
d57813e4bf GPLv3: Updated copyright year to 2024 
Signed-off-by: Patrick Pedersen <ctx.xda@gmail.com>
 2024-02-24 00:31:01 +01:00
Patrick Pedersen
a02d9dec6e README: Minor improvements 
Signed-off-by: Patrick Pedersen <ctx.xda@gmail.com>
 2024-02-24 00:27:02 +01:00
CTXz
d0e097eeec Target: Do not attempt to clear BSS if there is no BSS section 
Signed-off-by: CTXz <ctx.xda@gmail.com>
 2024-02-22 18:18:09 +01:00
CTXz
704d8410be Target: Only build single .elf per USART now that entry points are dealt with in runtime 
Signed-off-by: CTXz <ctx.xda@gmail.com>
 2024-02-22 17:37:57 +01:00
CTXz
b20b3d599c Target: Do not compile USART init code for unused USARTS 
Signed-off-by: CTXz <ctx.xda@gmail.com>
 2024-02-22 17:35:22 +01:00
CTXz
70675d2b21 Target: Declared perhipheral struct fields as __IO/volatile 
Fixes quirky compiler optimization related issues when adressing peripherals

Signed-off-by: CTXz <ctx.xda@gmail.com>
 2024-02-22 17:32:04 +01:00
Patrick Pedersen
bb54ca0f1f Target: Tidied up assembly code 
- Renamed test.S to entry.S
- Added comments to explain assembly section
- Dropped unecessary duplicate configuring of FPB in stage 2
- Removed unused assembly code
- Renamed labels to more appropriate names

Signed-off-by: Patrick Pedersen <ctx.xda@gmail.com>
 2024-02-20 23:56:31 +01:00
Patrick Pedersen
c3fa8bada4 Target: Only use USART TX 
RX is not required for our implementation since we've completely dropped the rootshell in
favour of straight up UART vomiting.

Signed-off-by: Patrick Pedersen <ctx.xda@gmail.com>
 2024-02-20 20:21:18 +01:00
Patrick Pedersen
43ee0564c4 Target: Vastly stripped and refactored target firmware 
3bdbdd64eb seems to have
gotten rid of the quirky hardfaults that could occur if the target code was changed. With this fixed, lots
of old unused code from the original project could be removed. The code has also been significanly refactored
to be a more readable.

Signed-off-by: Patrick Pedersen <ctx.xda@gmail.com>
 2024-02-20 19:37:20 +01:00
Patrick Pedersen
ce7d9b68e7 Attack: Formatting 
Signed-off-by: Patrick Pedersen <ctx.xda@gmail.com>
 2024-02-20 19:36:59 +01:00
Patrick Pedersen
019799ba2e Target: Formatting 
Signed-off-by: Patrick Pedersen <ctx.xda@gmail.com>
 2024-02-20 17:59:27 +01:00
Patrick Pedersen
3bdbdd64eb Target: Implemented https://github.com/CTXz/stm32f1-picopwner/issues/18 
Special thanks to @deividAlfa for the suggestion/contribution

- The target firmware no longer needs to be compiled for every possible SRAM entry point.
  Instead, the address range 0x100 - 0x300 serves as a trampoline, filled with branch instructions,
  that direct to the entry point of stage 1 (_start). Some of these jump instructions will reside in
  the IVT (starting at TIM5); however, this is acceptable since the affected interrupts aren't being used.

- The stack size has been reduced to 4KB. This is more that sufficient for the exploit
  and prevents hard faults from occuring on models with less RAM (00, 01, 02).

Signed-off-by: Patrick Pedersen <ctx.xda@gmail.com>
 2024-02-20 17:48:05 +01:00
CTXz
62fbfd990e dump: Updated "Waiting for debug probe" message to provide an example of a probe 
Signed-off-by: CTXz <ctx.xda@gmail.com>
 2024-02-11 19:06:41 +01:00
CTXz
3d1a5950bb README: Corrected min. OpenOCD version 
Signed-off-by: CTXz <ctx.xda@gmail.com>
 2023-10-03 03:51:21 +02:00
CTXz
5a1ea2b67d dump.py: Fixed typo in uart selection menu 
Signed-off-by: CTXz <ctx.xda@gmail.com>
 2023-10-02 01:33:59 +02:00
CTXz
87f0f76166 Target: Updated version number in makefile 
Signed-off-by: CTXz <ctx.xda@gmail.com>
a1.2_t1.2 		2023-10-01 23:00:58 +02:00
CTXz
56422695ee Meta: Versioning and code formatting... 
Signed-off-by: CTXz <ctx.xda@gmail.com>
 2023-10-01 22:55:55 +02:00
CTXz
208c119edb dump.py: Require min OpenOCD 0.11.0 until backwards compatibility has been added 
Signed-off-by: CTXz <ctx.xda@gmail.com>
 2023-10-01 22:54:36 +02:00
CTXz
ecce85b5fe Merge branch 'patch-3' 2023-10-01 22:33:35 +02:00
CTXz
a3086ef37a Merge branch 'patch-5' 2023-10-01 22:29:09 +02:00
CTXz
3bf5be75d5 Merge branch 'patch-1' 2023-10-01 22:26:13 +02:00
CTXz
d434d7b8ba dump.py: OpenOCD: Fixed targetfw paths with spaces not working 
Signed-off-by: CTXz <ctx.xda@gmail.com>
 2023-10-01 18:44:02 +02:00
CTXz
e779950ad4 README: Fixed pin description of fritzing sketch 
Signed-off-by: CTXz <ctx.xda@gmail.com>
 2023-09-22 11:27:44 +02:00
deividAlfa
0d8bfa0231 Wait after detecting debugger to ensure stable connections 2023-09-21 21:55:39 +02:00
deividAlfa
324ba0ed86 Detect flash size 2023-09-21 21:32:27 +02:00
deividAlfa
8f41647992 Update attack.c 2023-09-18 23:09:24 +02:00
deividAlfa
a86803dda1 Update attack.c 2023-09-18 23:08:29 +02:00
deividAlfa
1b4b7658cf Enable nRST pullup (Instead default pulldown!), causing issues. 
Pico's input default setting is pulldown!
This makes a voltage divider against the nRST pullup in the STM32-
I was getting 2.7V, others got 1.2V... this will cause random behaviour, might work for some and not for others.

Fix this by enabling the RESET pin pullup so it sits at 3.3V.
 2023-09-18 22:31:37 +02:00
CTXz
ced0b34aee Minor README and printed output improvements 
Signed-off-by: CTXz <ctx.xda@gmail.com>
a1.1_t1.1 		2023-06-29 13:42:58 +02:00
CTXz
8d59e545b7 target: Fixed dump.py not being able to find binaries due to case difference 
Signed-off-by: CTXz <ctx.xda@gmail.com>
 2023-06-29 08:27:18 +02:00
CTXz
219cdd470f README: Minor changes 
Signed-off-by: CTXz <ctx.xda@gmail.com>
 2023-06-28 20:00:15 +02:00
CTXz
cada1336ae attack: Set power pin HIGH before configuring it as OUTPUT 
Signed-off-by: CTXz <ctx.xda@gmail.com>
 2023-06-28 17:58:58 +02:00
CTXz
7d8c649f11 dump.py: Added support for different SRAM entrypoint offsets + Added prompt to select USART 
Signed-off-by: CTXz <ctx.xda@gmail.com>
 2023-06-28 17:56:30 +02:00
CTXz
42f1328636 Git: Ignore .bin's 
Signed-off-by: CTXz <ctx.xda@gmail.com>
 2023-06-28 17:55:30 +02:00
CTXz
485da18175 README: Troubleshooting: Correction regarding BOOT1 pin 
Signed-off-by: CTXz <ctx.xda@gmail.com>
 2023-06-27 13:50:20 +02:00
CTXz
3d36ae8c48 README: Spelling + Notes about upcoming fixes 
Signed-off-by: CTXz <ctx.xda@gmail.com>
 2023-06-27 11:41:02 +02:00
Patrick Pedersen
ccc8d1bc9d README: Minor changes 
Signed-off-by: Patrick Pedersen <ctx.xda@gmail.com>
 2023-06-19 19:14:37 +02:00
CTXz
0081ebab8b Target: Updated makefile with usart targets 
Signed-off-by: CTXz <ctx.xda@gmail.com>
a1.0_t1.1 		2023-06-19 14:15:37 +02:00
CTXz
ae3857b939 README: Added instructions on how to build target fw for different USARTs 
Signed-off-by: CTXz <ctx.xda@gmail.com>
 2023-06-19 14:11:15 +02:00
CTXz
3a6eb4a78c Target: Added support for different USARTs 
Signed-off-by: CTXz <ctx.xda@gmail.com>
 2023-06-19 13:48:19 +02:00