Help me dump STM32F103VCT6 - Page 1
Forum section: electronics / general

author: andyB2022
author_rank: Regular Contributor
timestamp: June 02, 2023, 02:07:27 pm
content: Anyone out here that can help me dump the flash out of a STM32F103VCT6 with RDP Level 1?I can pay you.

author: barshatriplee
author_rank: Regular Contributor
timestamp: June 05, 2023, 07:30:56 am
content: I don't think it will be legal to do so....

author: radiolistener
author_rank: Super Contributor
timestamp: June 05, 2023, 09:36:35 am
content: I think it will be legal if you didn't signed agreement that you will not try to read it, and you didn't stolen device.But this is not a trivial task. If you want to get memory dump, you're needs to find people who has access to electron microscope. As I know it is possible to reverse protected memory content by using layer-by-layer etching and analysis of charges in each cell of the memory block. But such a task may require several instances of chips with the same content, because it's complicated process and the chip can be easily damaged.And as I know some chips with extended security may have some measures which make memory content extraction problematic, for example it can have self damage fixtures which triggering when someone trying layer-by-layer etching. Some of security chip can have even internal power source and intrusion detectors which triggers self erase procedure.Another way is to use current consumption and electormagnetic field detectors in order to analyze what kind of operation happens inside chip to restore code sequence, but this is much more complicated and difficult way. It will be much more cheaper and easy to hire new developers and design a new firmware than reverse existing one in such way.In any way such memory dump extraction will cost you much more than to pay software engineers to develop a new firmware.

author: wraper
author_rank: Unknown
timestamp: June 05, 2023, 09:50:12 am
content: STM32F103 firmware protection can be bypassed by power glitching. So it's not like you necessarily need advanced equipment.

author: andyB2022
author_rank: Regular Contributor
timestamp: June 05, 2023, 05:12:22 pm
content: Quote from: wraper on June 05, 2023, 09:50:12 amYeah I have seen guys on youtube and GitHub doing it but I dont' have enough konw-how to do it.

author: wraper
author_rank: Unknown
timestamp: June 05, 2023, 06:19:29 pm
content: Quote from: radiolistener on June 05, 2023, 09:36:35 amI've seen numbers like $500-2000 for MCUs like these. Unless firmware is very simple, good luck hiring a software engineer for that.

author: radiolistener
author_rank: Super Contributor
timestamp: June 07, 2023, 01:05:21 am
content: Quote from: wraper on June 05, 2023, 09:50:12 amhm, this is very interesting. Does STM32F103RCT6 vulnerable for this? Where I can read about it more details?It will be nice to get original firmware dump from Chinese device, play with it with custom firwmare and then restore original one back to avoid bricked device

author: Psi
author_rank: Super Contributor
timestamp: June 07, 2023, 01:24:41 am
content: Quote from: radiolistener on June 07, 2023, 01:05:21 amRemoving current MCU and soldering in new blank one seems like a much easier way to achieve that.

author: mosafet
author_rank: Contributor
timestamp: June 07, 2023, 03:30:42 am
content: The F1 series is vulnerable to many different types of attacks.https://www.eevblog.com/forum/microcontrollers/dumping-stm32-protected-firmware/You can also probe for vulnerabilities in the firmware itself if it uses any type of external input.

author: andyB2022
author_rank: Regular Contributor
timestamp: June 07, 2023, 08:07:19 am
content: Quote from: mosafet on June 07, 2023, 03:30:42 amHave you ever done it?

author: yangzs
author_rank: Newbie
timestamp: April 18, 2025, 12:08:20 pm
content: Have you finished it yet? I can help you.

author: andyB2022
author_rank: Regular Contributor
timestamp: April 25, 2025, 06:58:18 pm
content: Thanks for reply. Unofrtunatelly testing other smd components on the board managed to get the MCU in short circuit...However if you know how to extract the firmware feel free to share it.

author: darkspr1te
author_rank: Frequent Contributor
timestamp: April 26, 2025, 08:08:40 am
content: There are a few ways to get the firmware depending on the RDP level, board layout , features.if you have USB access and it uses DFU for updates then using linux+patched libusb you can do the STM DFU exploitif you have SWD access then you can do either the IRQ exploit to get most of the firmwareor power glitch to bypass rdp, if level 1 rdp then is usually quite easy and timing not so critical. if rdp2 then you will need special hardware in order to fine tune the timing glitch.RDP1 locked devices *might* fall for the SRAM exploit , this is where a flash dump program is loaded into sram and then the system is reset into boot from sram mode but as we dont clear the sram and we dont activate swd it does not trigger the sram lockout of reading the flash. This worked on early stm's but was fixed but other stm clones still have the bug.Sadly each device is different and requires different paths to get the firmware out, without much detail on the device it's hard to advise a path.hardware is also required , from swd programmers to power glitching controllers (eg pi pico stm glitcher) even logic sniffers and scopes to monitor signals for suther study.darkspr1te

author: DavidAlfa
author_rank: Super Contributor
timestamp: May 02, 2025, 09:06:12 am
content: Super easy, just get a st-link, a pi pico, then run this:https://github.com/CTXz/stm32f1-picopwner