Atten ST-862D Firmware (STM32F0 and AT32F421 version) - Page 1
Forum section: electronics / general

author: JimKnopf
author_rank: Frequent Contributor
timestamp: March 31, 2025, 07:41:33 pm
content: Anyone here extracted the Firmware from Atten ST-862D Hotair station?The ST-862D was initially shipped with a STM32F0 MCU. Later they switched over to a Artery AT32f421.Seems they are pin compatible.The good thing is, the board has holes exposed for JTAG/SWD.I soldered some pins and gave it a try. The STM32F0 has RDP enabled.Quote@DavidAlfa will the CTX/picopwner attack work on this MCU or are some tweaks needed?

author: DavidAlfa
author_rank: Super Contributor
timestamp: March 31, 2025, 09:43:53 pm
content: As far as I know it only works for F1 series.

author: JimKnopf
author_rank: Frequent Contributor
timestamp: April 06, 2025, 07:27:53 pm
content: @DavidAlfa I got the firmware, or part of it. I have to repeat the task. I did it using this scripthttps://github.com/racerxdl/stm32f0-pico-dump. I missed a detail. The script has default settings that matches the K6 or C6 MCU flash memory size of 32kb. I got the C8 one which has 64kb flash memory.The 32kb i already dumped has FF's at the end. So it's possible that the whole firmware is already dumped. The device is not that complicated, so only few code is needed i guess.But i will dump the whole 64kb.It starts with 88 0A and ends at 70ff with zeros.I had to try it several times until the dump started due to low pin voltage on the Pi pico.In the attached images from scope yellow is pwr-, green is reset-, blue is data-, violett is clock-signal.There is one tricky thing in the script. The mentioned pins are not the follow up pin numbers on the pico. The mentioned pins are the GPIO pins of the pico. The mentioned pin 26 is GPIO26, pin number 31 on the pico. The script needs only the pico, no STM-V2 SWD programmer is needed.

author: JimKnopf
author_rank: Frequent Contributor
timestamp: April 07, 2025, 07:06:27 pm
content: Today i changed main.cpp, recompiled the firmware and restarted the dump. I have to mention that i had to remove two AMS1117 LDO yesterday. They draw too much current from pico pin. Today i gave it a try with the two parts in place and an external 3.3v PSU using a BSS205N N-Channel Mosfet on pico pwr pin. I couldn't get it to work. Something with the timing is wrong i guess. Removing the two parts again, it worked again for the 64kb flashmemory. So i got the full firmware dump.After the first data section there is a large ff area. At the end there is again some data.

author: JimKnopf
author_rank: Frequent Contributor
timestamp: April 21, 2025, 07:17:38 pm
content: I did some more tests. Dumping the memory works with the two AMS1117 LDO in place. I used an IRLML2502 Mosfet. The board works on 3,3 V. But dumping the memory using the mentioned scripts doessn't work. The external voltage from PSU has to be 1,975 up to 2,060 V. Works at best with 2,0 V. Every voltage below or above this range leads to Error 128 in the script.At 3,3 V supply voltage, i measure 0,66V at the Drain pin of the mosfet when connecting the pico.At 2,0 V supply voltage, the Drain pin has around 0,3 V.

author: DavidAlfa
author_rank: Super Contributor
timestamp: April 21, 2025, 08:47:07 pm
content: That won't work, you're floating gnd, it'll find its way through the other pins.You must switch VCC. You can use a p-fet or a pnp bjt.You should know already that a voltage glitch need to be precise and fast, neither can be achieved with large capacitors in place.Remove any electrolytic cap connected to VDD/3.3V and try again, powering directly from the pico pin, no mosfet etc.Anyway, if you already got the dump, who cares? Just go on with whatever you're trying do:)

author: JimKnopf
author_rank: Frequent Contributor
timestamp: April 21, 2025, 09:13:01 pm
content: @DavidAlfa it did work using the IRLML2502 and 2V external supply voltage. And a N-Channel Mosfet is what the Pico Glitcher uses (https://github.com/MKesenheimer/fault-injection-library(BTW i own one, it's my next project to get it to work with the pico glitcher and maybe the husky). This Mosfet matches perfectly.I used the Pico earlier without external PSU. The downside is, one has to remove the two ADS1117 LDO to get it to work with the pico pin voltage/amperage. It works but removing parts from a PCB might be a problem for some members. To dump the firmware, it is not necessary to remove the parts when using the IRML2502 Mosfet.

author: JimKnopf
author_rank: Frequent Contributor
timestamp: May 01, 2025, 10:12:01 am
content: Finally i got it to work with all components in place, no internal wire disconnected.Switching low side has some downsides. So i added a P-Channel Mosfet over the N-Channel Mosfet to switch the high side.Works pretty. Some resistors are needed.The max. high and max. low signal can be controlled by R1 and R2.Works pretty well if both resistors have 400 Ohm.

author: DavidAlfa
author_rank: Super Contributor
timestamp: May 01, 2025, 12:42:27 pm
content: Swap the power function logic here to omit Q1 completely:https://github.com/racerxdl/stm32f0-pico-dump/blob/b0b5c2437da3fa428aeff27b49aa473a038013a5/src/hal.c#L25-L31

author: JimKnopf
author_rank: Frequent Contributor
timestamp: May 01, 2025, 01:12:17 pm
content: @DavidAlfa Yeah swapping the signals is an option. But my intention was to solve it with hardware, to prevent having different versions of the script or messing up with dependencies in the script. It's for educational purpose and to have some fun with the tools i have.