Readout STM32 Memory? - Page 1
Forum section: electronics / general

author: ssashton
author_rank: Frequent Contributor
timestamp: September 08, 2022, 05:48:48 pm
content: Hi,This is the first time I've done anything with an STM32 so please realise I know nothing!I have a board for a 3D printer and I have managed to get access to the USB DFU function. STM32 Cube Programmer sees it and says 'connected'.Before I try to flash my own firmware I would like to extract and save the existing one so I can go back to factory settings.Can I do this over USB DFU? If so, please guide me. I clicked the 'read' button in Cube Programmer but I only got a few empty words as shown below.(The original company does not / will not give me a copy of the original binary at this time).

author: ssashton
author_rank: Frequent Contributor
timestamp: September 08, 2022, 06:42:07 pm
content: I realised I can enter the size to read in the box above. But I still get FFF.I guess it might be read protected, eh?

author: uer166
author_rank: Super Contributor
timestamp: September 08, 2022, 07:02:05 pm
content: Does your printer still work? If you requested the device read unprotect request (RDP 1 -> RDP 0), it could have erased the entire flash as that's what's needed to reduce protection level, and the 0xFF just show erased flash more or less.

author: ssashton
author_rank: Frequent Contributor
timestamp: September 08, 2022, 07:08:37 pm
content: No idea I'm playing on a spare board. When I hit read unprotect request it did disconnect from the PC then come back after a while.. I erased it?

author: thm_w
author_rank: Super Contributor
timestamp: September 08, 2022, 10:32:58 pm
content: Whats the company and printer, do they offer any firmware downloads at all?

author: luiHS
author_rank: Frequent Contributor
timestamp: September 09, 2022, 12:54:07 am
content: If it is a commercial product, you will not be able to read it, as is logical it will be protected against reading.With the STM32, I don't know, but with the NXP Kinetis if you try to read it, and it's read-protected, the content is erased. The fact that when reading it everything is seen in 0xFF does not mean that it has been deleted, simply that the content cannot be read.

author: darkspr1te
author_rank: Frequent Contributor
timestamp: September 09, 2022, 10:29:01 am
content: Quote from: ssashton on September 08, 2022, 07:08:37 pmif it has a stm styled usb DFU bootloader then make sure it's using current and offical firmware,here is where is gets harder, you ill need a linux machine and you need to remove libusb and download the sources to libusb ,patch lib usb so the buffer is 655000 instead of 4090 and then use the DFU dumper python script which makes use of the fact all stm dfu (software and hardware) have a buffer overflow when reading the device attribs , this overflow starts reading flash from 0x0 to 0x9fe98 (if you patched libusb) this will allow you to get the bootloader and reverse it to see if it has any encryption on the firmware files.darkspr1te

author: ssashton
author_rank: Frequent Contributor
timestamp: September 10, 2022, 12:05:05 pm
content: Thank you!I think this is beyond my current ability but great to know what is possible if invested enough in doing it.Do you mean this method tell me only if there is encryption, or does it provide a way to decrypt?At any rate, I should be able to write my own firmware on here without problems, right? Or is it likely write protected too?

author: luiHS
author_rank: Frequent Contributor
timestamp: September 10, 2022, 01:33:03 pm
content: Quote from: ssashton on September 10, 2022, 12:05:05 pmI highly doubt that an STM32 microcontroller with internal flash would have the firmware encrypted. I've only seen encryption on the NXP RT-series, and while I haven't used STM32s in a while, I've never seen the firmware be encrypted on ST microcontrollers.One thing is that the microcontroller has read protection, so you can not read the content, and another that the firmware is encrypted.Quote from: ssashton on September 10, 2022, 12:05:05 pmA microcontroller may also be write-protected, in which case you won't even be able to load your own firmware. In the programmer you should have an option to delete the content of the microcontroller, try to see if it lets you do it.