I2C hacking, is this this the hidden address ? - Page 1
Forum section: electronics / general

author: MathWizard
author_rank: Super Contributor
timestamp: January 29, 2021, 09:22:57 am
content: I'm playing around with BusPirate to spark my interest in learning some programing. And I have an STM8S003F3 8bit MCU, from an ebay device I took apart.https://www.st.com/en/microcontrollers-microprocessors/stm8s003f3.htmlI hooked up the buspirate w/ I2C, and also serial decoding on my scope. I only wired power and SDA/SCK, I never pulled reset high, I left everything floating.I barely know what to do in the terminal command prompt so far, so I had buspirate do it's device address scan.I'm real new at this. When I had an eeprom hooked up, the BP would saydevices found at:some write address and a read address.But now this MCU, seems to be blocking it's address, the Terminal just saysdevices found at:And it's blank, now on my scope, I can see the search, and near the end it tries writing to or reading the same address 4 times, and each time there's a write address that's blanked out on the decode of my SDS1104 as well as in the Putty terminal (the device found at:blank)Then it goes back to normal, and that's the only blanked out stuff.So am I a hacker yet ? Is the chip actually trying to block me from writing to it? And I found it with the scope ? So I just have to hold reset high ?Or is it really programmed to try to hide itself? Then I really am a hacker. But I can't find the default address in the datasheet yet. At least on the eeprom it was easy to find in the pdfThe spot with the gaps start at 240d, F0hThen the missing blanked write addresses are 242d , 244d, or 246d /F2/F4/F6and didn't it skip the odd numbers there?

author: capt bullshot
author_rank: Super Contributor
timestamp: January 29, 2021, 09:31:56 am
content: You're trying to access an MCU through it's I2C port. Without any knowledge of the firmware inside the MCU this would be rather pointless, as the function of the I2C interface is set by the firmware. It can be not used at all, a master reading or writing an external chip (sensor or something), or in rather rare cases an I2C slave. It can have any address, or none at all. The I2C port of an MCU is just a generic peripheral that doesn't do anything if it is not used by the firmware.If you want to hack into the MCU, I'd recommend to get an appropriate debugger that speaks the debug protocol of that particular MCU and try to read out and disassemble the firmware first.

author: MathWizard
author_rank: Super Contributor
timestamp: January 29, 2021, 09:59:09 am
content: So try UART and the software from ST or like the arduino IDE ?Overall with this chip it was just a little sensor w/LED display, so it would be a good play to start trying trying more hacking.In the end I'd like to read the program from the chip, so I don't want to erase it or damage it.Time to try the UART

author: capt bullshot
author_rank: Super Contributor
timestamp: January 29, 2021, 05:04:48 pm
content: It's a STM8, which has a debug interface called "SWIM". For a debugger I'd recommend an (original) ST-Link with the SWIM interface, and some tool like the ST-Link utility to read out the firmware (if not blocked by security bits).As with the I2C, for the UART it depends on the firmware what it does or not.You should have reverse engineered the original board to find which interface is connected to where and if it has some port to outside that might show activity.

author: ricard2k
author_rank: Unknown
timestamp: March 16, 2021, 05:11:38 pm
content: Usually MCUs use I2c to communicate with peripherals, and I never seen somebody implementing a console via I2C.Ig you want to see what your MCU is doing, a ST link could help you better than I2C.