search

CTXz / stm32f1-picopwner

Dump read-out protected STM32F1's with a Pi Pico - A Pi Pico implementation of @JohannesObermaier's, Marc Schink's and Kosma Moczek's Glitch and FPB attack to bypass RDP (read-out protection) level 1 on STM32F1 chips
166 stars 23 forks source link

Strange SRAM entry point #14

Closed SundaresanN closed 5 months ago

SundaresanN commented 6 months ago

Hi, i'm using stm32F103C8T6 blue pill.

I'm getting the following error, 

raise Exception("Could not determine SRAM entry point\nopenocd output: " + line)

Exception: Could not determine SRAM entry point openocd output: xPSR: 0x01000000 pc: 0x08000150 msp: 00000000

I find it strange pc: 0x08000150. Its supposed to be 0x20000150.

Capture

Additional info, I'm running bare metal led blink example with RDP enabled. Is it necessary to run any specific application to make the exploit work?

Thanks!

CTXz commented 6 months ago

Based on the value of the PC, the device simply starts into flash instead of SRAM. This most likely implies that your boot pins are not being properly configured. I suspect BOOT0 is the culprit in your case. Can you confirm it is correctly connected to the Pi's GPIO (GPIO5)? If you're confident, try pulling up the BOOT0 pin via the jumper and see if the PC at least jumps into the SRAM. The exploit will obviously not work like this but it would confirm the Pi's not doing its duty of pulling the pin high. If necessary, check out if the pin is being set by the pi using an oscilloscope.

CTXz commented 5 months ago

Since this issue has been inactive for a prolonged period of time now, I'll be closing it. I'll gladly reopen it if necessary

Alex-com2 commented 1 month ago

Hello! When I try to read STM32F103RCT6 get an error the moment st-link v2 is connected. BOOT1 (Pin 28) pulled directly to the power supply, without a resistor, BOOT0 (Pin 60) also without a resistor. Voltage at BOOT0 +3,23 V. In CubeProgrammer, the connection occurs (photo of registers attached). All Pins are connected correctly. The device provides a remote firmware update. On the other STM32F103RCT6 purchased in the store, everything works. Screen_Terminal ScreenCuberPro