STM32F4xx RDP 2 - Githubissues

CTXz / stm32f1-picopwner

Dump read-out protected STM32F1's with a Pi Pico - A Pi Pico implementation of @JohannesObermaier's, Marc Schink's and Kosma Moczek's Glitch and FPB attack to bypass RDP (read-out protection) level 1 on STM32F1 chips

166 stars 23 forks source link

STM32F4xx RDP 2 #23

Closed Mesteery closed 3 months ago

Mesteery commented 4 months ago

I came across this project which looks promising and I was wondering if it was able to remove the write protection RDP 2 so stm32 can be flashed. Thanks

CTXz commented 3 months ago

Hi, this exploit does not work on the STM32F4, let alone one with RDP2. If you wish to be updated about potential progress regarding the f4, keep an eye on this thread:

https://github.com/CTXz/stm32f1-picopwner/issues/13

deividAlfa commented 3 months ago

RDP 2 is irreversible

Angelic47 commented 3 months ago

Hi, the RDP2 can't be removed, even we hacked into the CPU and get arbitrary code execution - it's readonly, designed by ST for a security defense. In theory, the RDP2 can be temporary downgrade to RDP1, and for some combo glitches it could write the flash, implement a bootloader and makes it flashable again. But it's a quite challenging, due to the numerous security defenses filled by ST, makes it very hard to achieve. So downgrade the RDP 2 and reprogram the firmware will be worthless.