Read code from SMT32F103 microcontroller - Page 1
Forum section: electronics / general

author: bitcom
author_rank: Newbie
timestamp: October 07, 2018, 10:56:51 pm
content: while trying to add a cooling fan to my brand new APC SMT750, I've managed to short out the SMT32F103 microcontroller on it. It was a stupid mistake I left a piece of soldering wire on top of the circuit and bang next thing I know it wont start, anyway I found the problem to be a NCV5500 regulator that supplies vcc to the microcontroller but even after removing the 5500, the contrller seems to be shorted. So here is my question:Is it possible to read the code from a good working chip and load that code on to a new mcu as this chip is very common and cheap, as for the code, I've ordered another exact model of ups which is on its way also this code might be present in the firmware update files I've downloaded from APC they are .enc extension files and are 260kb in size.it would be a shame to throw away such nice piece of hardware.I've now removed the bad mcu and I'm sure there is no longer a short so in fact this is the culprit.I really hope some of you guys help me bring this ups back from the dead.If anybody wants to look at this file here it is:https://files.fm/u/n2gpahwrThank alot

author: lucazader
author_rank: Regular Contributor
timestamp: October 07, 2018, 11:06:02 pm
content: If readout protection hasn't been enabled, then this is pretty trivial.Just get an ST-Link V2 programmer (either digikey or similar if you need it quick, or get a cheap aliexpress clone if it can take a while).Connect the ST_Link to the SWDIO, SWCLK and reset pins of the micro, along with a GND.Open either ST-Link utility or the STMCubeProgrammer, connect to the chip and read out the data.If read out protection has been enabled, then it becomes a bit more difficult. I am not sure the process, but i do know that the readout protection has been broken/bypassed on most if not all STM32 chips.Also be very careful if read out protection has been enabled. If you accidentally turn this off while connected with the programmer, then it will wipe the flash of the chip.

author: bitcom
author_rank: Newbie
timestamp: October 08, 2018, 03:43:14 am
content: Thank you so much for your reply.Just so you know I'm not at all familiar with this or any other microcontroller, I'm only an electronics technician with only limited experience with arduino's various boards.How would I know if it is read protect or not, I would need to be real careful here as I don't wanna blow yet another UPS.What about the other route digging for the firmware from the file I uploaded on my previous post and burning it to one of this cheap ebay arduino like board with SMT32F103 chip on it like this one.[urlhttps://www.ebay.com/itm/STM32F103C8T6-ARM-STM32-Minimum-System-Development-Board-Module-For-Arduino/311156408508?epid=8023398214&hash=item48725e00bc:g:onsAAOSwETJaNPe2]I would prefer this option the only problem is I don't know how too open unpack or decrypt this .enc file.Thanks again

author: ataradov
author_rank: Super Contributor
timestamp: October 08, 2018, 03:58:15 am
content: If they have bothered to encrypt it, then it is likely that MCU is locked. And it is also likely that any effort to unlock it will cost more than the price of the new UPS.

author: bitcom
author_rank: Newbie
timestamp: October 08, 2018, 04:30:06 am
content: Thanks for your input Alex:Well I do't know that it is encrypted or not it may be that it is compressed like so many other firmwares for consumer electronics, but but this being a commercial product it could well be enc.This UPS costs close to $400.00 @ the store, I was lucky to get it for 100.00 off ebay but it was like new condition so I think it would be worth for me to try to fix it specially since the bad part is so cheap and readily available just so it happens to be a mcu.Luis

author: ataradov
author_rank: Super Contributor
timestamp: October 08, 2018, 04:33:08 am
content: You can try of course.The file does not look compressed. It has huge chunks of repeated data in it. It also does not look like ARM code, so it is firmware that is manipulated somehow. Probably encrypted.If you don't have experience doing this sort of thing, you will have to learn, and learning can be expensive, much more expensive than $400.

author: bitcom
author_rank: Newbie
timestamp: October 08, 2018, 05:33:37 pm
content: Well that is not very encouraging, I'll have to try reading the flash from the good UPS once I get it.In the mean time I'm gonna have to order the ST-LINK programmer as well.I'll comment later on my findingsthanks to everyone for commenting.Luis

author: Totoxa
author_rank: Newbie
timestamp: October 08, 2018, 11:06:12 pm
content: This looks suspicious to me, may be some key hidden there?

author: ataradov
author_rank: Super Contributor
timestamp: October 08, 2018, 11:13:07 pm
content: I doubt it. That would be a super weak encryption. Later on there is another segment with different fill values. So it may be constant padding that was "encrypted", and the key is different for both parts.

author: Totoxa
author_rank: Newbie
timestamp: October 08, 2018, 11:19:32 pm
content: I've seen weak "encryption" on firmware updates of commercial products but they can be easily spot by the entropy graph of binwalk.Al least with this file it is almost flat.

author: ataradov
author_rank: Super Contributor
timestamp: October 08, 2018, 11:24:38 pm
content: The problem is that even you decrypt this file, it still does not have the bootloader.It does look like big fill blocks are located at the end of a section, since they are always followed by what appears to be a header for the next section.So the file is clearly not a single binary image, but a number of combined sections. Probably, represents the code and resources separately.It may be worth looking at those headers to see if some reasonable structure appears.

author: ataradov
author_rank: Super Contributor
timestamp: October 08, 2018, 11:28:16 pm
content: Actually section headers include human-readable names:1. UBL 08.312. UBL 08.53. MCU 19.04. UPS 09.4

author: bitcom
author_rank: Newbie
timestamp: October 08, 2018, 11:59:48 pm
content: Guys I really appreciate you efforts, I read somewhere that on cases the key might be the filename.I also think this file includes firmware for other microcontoller as well.On the same board there is this NXP CHIP, as this ups has an LCD maybe the SMT32 only controls the LCD and the NXP the rest of the system or viceversa.Regards

author: ataradov
author_rank: Super Contributor
timestamp: October 09, 2018, 12:02:06 am
content: It is not really an effort on my side. I still think that it is absolutely impractical to do this from money and time spend perspective. Only if you want to learn, but keep in mind that it will cost you much more than just buying a new unit.

author: bitcom
author_rank: Newbie
timestamp: October 09, 2018, 01:05:08 am
content: Alex, I know you're right on your view of this problem, I've already ordered a new unit but the thing is what do I do with this one, I've got the time and will to learn but @ 50 years old I don't think I'm gonna became a software or electrical engineer.I've contacted APC tech support by email, but so far no response.thanks again

author: richardman
author_rank: Frequent Contributor
timestamp: October 09, 2018, 06:50:38 am
content: Sell it for parts maybe your best bet

author: Rasz
author_rank: Super Contributor
timestamp: October 09, 2018, 11:57:17 am
content: SMT32F0 was broken wide open, I dont know of anyone testing discovered methods on SMT32F103https://www.eevblog.com/forum/microcontrollers/stm32-readout-protection-is-broken/this suggest this attack should work on f1, butof courseauthor didnt actually bother checkinghttps://medium.com/@LargeCardinal/how-to-bypass-debug-disabling-and-crp-on-stm32f103-7116e7abb546dumping firmware in chinahttp://www.pcbcopy.com/2016/ic_1128/1928.htmlhttp://www.pcbhf.com/xinpianjiemi/icxinghaopanding/320.htmlbut even after reading out the firmware it can be encrypted with unique chip ID and not work in another one without decryption/patchingso you will also needhttp://blog.sina.com.cn/s/blog_770bd2000100zssn.html