CTXz / stm32f1-picopwner

Dump read-out protected STM32F1's with a Pi Pico - A Pi Pico implementation of @JohannesObermaier's, Marc Schink's and Kosma Moczek's Glitch and FPB attack to bypass RDP (read-out protection) level 1 on STM32F1 chips
166 stars 23 forks source link

Failure to load target firmware to SRAM #11

Closed sohail330x closed 8 months ago

sohail330x commented 9 months ago

Hi, I'm not sure where I'm going wrong, was testing this on a Blue pill board- followed all directions and it goes smoothly until after choosing USART 1,2 or 3, I choose USART 1 as this is how I've wired it, but when loading target firmware to SRAM, I get -

Exception: Failed to load target firmware to SRAM
openocd output: Error: couldn't open /c/Users/ME/Desktop/stm32f1hack/target/target_108_usart1.bin

Anyone able to help me with this?

CTXz commented 9 months ago

Did you actually build or download the target firmware binaries? Does /c/Users/ME/Desktop/stm32f1hack/target/target_108_usart1.bin exist?

sohail330x commented 9 months ago

Hi , I used the ready made target firmware and the file path did exist- I found it was a software problem! I was running on Windows with all the prerequisites installed (openocd etc)

I am now attempting on Linux and I managed to get further- I can successfully load target firmware but I get the result at the end: time-out: no data received from target

All wiring has been checked and double checked and it's stumping me- tested for bluepill (target) power using st link without 3.3v and gnd and it connects so board is powered by Pico can't work out why it won't work

CTXz commented 9 months ago

I've just published a new release that fixes some reset line related voltage issues (See https://github.com/CTXz/stm32f1-picopwner/releases/tag/a1.2_t1.2 for more details). Try to download the new attack and target firmware and report if that has perhaps helped.

sohail330x commented 9 months ago

Hi thank you very much, I have tried the new releases- same issue : timeout: No data received from target

One thing I have noticed- on the blue pill the red light for power is illuminated during the entire process, even after I remove debug probe (st link) from target. Once I click enter to start dumping firmware, this red power indicator turns off? Could this help to narrow down what I'm doing wrong?

Only power cycling the pico restarts the red power indicator on the bluepill so I think the issue I am getting is possible from the pico/ attack firmware?

JimKnopfIoT commented 9 months ago

Use wires as short as possible. I had timeouts with 30 cm Dupont wires (i called it antennas). When using 7 cm wires directly soldered to pinheaders, i had 100 % success rate. If available, check signals on oscilloscope. Check Boot0 pin, NRST, TX from bluepill board. The first image show start of reading with 30 cm wires. 1_B0_y+NRST_v+TX_b_4

The second image show the start of reading with 7 cm wires (used different colors for signals). 2_B0_v+NRST_y+TX_b+RX_g

CTXz commented 9 months ago

Hi thank you very much, I have tried the new releases- same issue : timeout: No data received from target

One thing I have noticed- on the blue pill the red light for power is illuminated during the entire process, even after I remove debug probe (st link) from target. Once I click enter to start dumping firmware, this red power indicator turns off? Could this help to narrow down what I'm doing wrong?

Only power cycling the pico restarts the red power indicator on the bluepill so I think the issue I am getting is possible from the pico/ attack firmware?

This likely implies that the attack firmware is strugging to get past the following loop:

    // Drop the power
    gpio_put(LED_PIN, 1);
    gpio_put(POWER_PIN, 0);

    // Wait for reset to go low
    while (gpio_get(RESET_PIN)) {
        tight_loop_contents();
    }

    // Immediately re-enable power
    gpio_put(POWER_PIN, 1);

The pico will shut down power to the STM32F1 and re-enable it as soon as the reset pin has been read low. Ensure that the reset pin is really connected to GPIO4 (Pin 6, see below).

image

If you're confident the wiring is correct, try to capture an oscilloscope reading of GPIO4 and the nRST line.

sohail330x commented 9 months ago

Hi thanks for your reply,

Weirdly I went back to the previous 'dump.py' script and it is no longer doing the 2-3 second pause between powering off and on after clicking enter to start firmware extraction. So it seems to be power cycling properly now but still 'no data'

CTXz commented 9 months ago

I'm afraid without oscilloscope readings or at least an overview of your set-up I can't really help out any further here

CTXz commented 8 months ago

Since this issue has been inactive for longer than a month now, I will close it. I will gladly re-open it if necessary.