Class: SWD_STM32

Inherits:
Object
  • Object
show all
Defined in:
lib/HardsploitAPI/SWD/HardsploitAPI_SWD_STM32.rb

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(debugPort) ⇒ SWD_STM32

Returns a new instance of SWD_STM32.



14
15
16
 
# File 'lib/HardsploitAPI/SWD/HardsploitAPI_SWD_STM32.rb', line 14

def initialize(debugPort)
	@ahb = SWD_MEM_AP.new(debugPort, 0)
end

Instance Attribute Details

#ahb ⇒ Object

Returns the value of attribute ahb.



12
13
14
 
# File 'lib/HardsploitAPI/SWD/HardsploitAPI_SWD_STM32.rb', line 12

def ahb
  @ahb
end

Instance Method Details

#flashErase ⇒ Object 



85
86
87
88
89
90
91
92
93
94
95
96
97
 
# File 'lib/HardsploitAPI/SWD/HardsploitAPI_SWD_STM32.rb', line 85

def flashErase
		puts "Flash unlock"
		flashUnlock
		# start the mass erase
		@ahb.writeWord(0x40022010, 0x00000204)
		@ahb.writeWord(0x40022010, 0x00000244)
		# check the BSY flag
		while (@ahb.readWord(0x4002200C) & 1) == 1
				puts "waiting for erase completion..."
		end
		@ahb.writeWord(0x40022010, 0x00000200)
		puts "Finish unlock flash"
end

#flashProgram ⇒ Object 



98
99
100
 
# File 'lib/HardsploitAPI/SWD/HardsploitAPI_SWD_STM32.rb', line 98

def flashProgram
		@ahb.writeWord(0x40022010, 0x00000201)
end

#flashProgramEnd ⇒ Object 



101
102
103
 
# File 'lib/HardsploitAPI/SWD/HardsploitAPI_SWD_STM32.rb', line 101

def flashProgramEnd
		@ahb.writeWord(0x40022010, 0x00000200)
end

#flashRead(address, size) ⇒ Object 



31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
 
# File 'lib/HardsploitAPI/SWD/HardsploitAPI_SWD_STM32.rb', line 31

def	flashRead(address,size)
	data = Array.new
	# Read a word of 32bits (4 Bytes in same time)
	size = size / 4
	#Chunk to 1k block for SWD
	#	ARM_debug_interface_v5 	Automatic address increment is only guaranteed to operate on the bottom 10-bits  of the
	# address held in the TAR. Auto address incrementing of bit [10] and beyond is
	# IMPLEMENTATION DEFINED. This means that auto address incrementing at a 1KB boundary
	# is IMPLEMENTATION DEFINED

	#But for hardsploit max 8192  so chuck to  1k

	packet_size = 1024
	number_complet_packet = (size/packet_size).floor
	size_last_packet =  size % packet_size

	#number_complet_packet
	for i in 0..number_complet_packet-1 do
			data.push(*self.ahb.readBlock(i*4*packet_size+address,packet_size))
		puts "Read #{packet_size} KB : #{i}"
	end
	#Last partial packet
	if size_last_packet > 0 then
  	data.push(*self.ahb.readBlock(number_complet_packet*4*packet_size+address,size_last_packet))
			puts "Read last packet : #{size_last_packet} packet of 4 bytes"
	end
	return data
end

#flashUnlock ⇒ Object 



80
81
82
83
84
 
# File 'lib/HardsploitAPI/SWD/HardsploitAPI_SWD_STM32.rb', line 80

def flashUnlock
		# unlock main flash
		@ahb.writeWord(0x40022004, 0x45670123)
		@ahb.writeWord(0x40022004, 0xCDEF89AB)
end

#flashWrite(address, data) ⇒ Object 



60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
 
# File 'lib/HardsploitAPI/SWD/HardsploitAPI_SWD_STM32.rb', line 60

def	flashWrite(address,data)
		#Chunk to 1k block for SWD
		packet_size = 1024 #1024
		number_complet_packet = (data.size/packet_size).floor
		size_last_packet =  data.size % packet_size

		ahb.csw(2, 1) # 16-bit packed incrementing addressing
		#number_complet_packet
		for i in 0..number_complet_packet-1 do
			self.ahb.writeBlock(address+i*packet_size,data[i*packet_size..i*packet_size-1+packet_size])
			puts "Write #{packet_size} KB : #{i}"
		end
		#Last partial packet
		if size_last_packet > 0 then
				self.ahb.writeBlock(address+number_complet_packet*packet_size,data[number_complet_packet*packet_size..number_complet_packet*packet_size+size_last_packet])
				puts "Write last packet : #{size_last_packet} packet"
		end
		ahb.csw(1, 2) # 16-bit packed incrementing addressing
end

#halt ⇒ Object 



18
19
20
21
 
# File 'lib/HardsploitAPI/SWD/HardsploitAPI_SWD_STM32.rb', line 18

def halt
		# halt the processor core
		@ahb.writeWord(0xE000EDF0, 0xA05F0003)
end

#sysReset ⇒ Object 



26
27
28
29
 
# File 'lib/HardsploitAPI/SWD/HardsploitAPI_SWD_STM32.rb', line 26

def sysReset
		# restart the processor and peripherals
		@ahb.writeWord(0xE000ED0C, 0x05FA0004)
end

#unhalt ⇒ Object 



22
23
24
25
 
# File 'lib/HardsploitAPI/SWD/HardsploitAPI_SWD_STM32.rb', line 22

def unhalt
		# unhalt the processor core
		@ahb.writeWord(0xE000EDF0, 0xA05F0000)
end