Class: SWD_STM32

Inherits:
Object
  • Object
show all
Defined in:
lib/HardsploitAPI/Modules/SWD/HardsploitAPI_SWD_STM32.rb

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(debugPort) ⇒ SWD_STM32

Returns a new instance of SWD_STM32.



14
15
16
17
 
# File 'lib/HardsploitAPI/Modules/SWD/HardsploitAPI_SWD_STM32.rb', line 14

def initialize(debugPort)
  @ahb = SWD_MEM_AP.new(debugPort, 0)
  @debugPort = debugPort
end

Instance Attribute Details

#ahb ⇒ Object

Returns the value of attribute ahb.



12
13
14
 
# File 'lib/HardsploitAPI/Modules/SWD/HardsploitAPI_SWD_STM32.rb', line 12

def ahb
  @ahb
end

Instance Method Details

#flashErase ⇒ Object 



102
103
104
105
106
107
108
109
110
111
112
113
114
 
# File 'lib/HardsploitAPI/Modules/SWD/HardsploitAPI_SWD_STM32.rb', line 102

def flashErase
    HardsploitAPI.instance.consoleInfo "Flash unlock"
    flashUnlock
    # start the mass erase

    @ahb.writeWord(0x40022010, 0x00000204)
    @ahb.writeWord(0x40022010, 0x00000244)
    # check the BSY flag

    while (@ahb.readWord(0x4002200C) & 1) == 1
        HardsploitAPI.instance.consoleInfo "waiting for erase completion..."
    end
    @ahb.writeWord(0x40022010, 0x00000200)
    HardsploitAPI.instance.consoleInfo "Finish unlock flash"
end

#flashProgram ⇒ Object 



115
116
117
 
# File 'lib/HardsploitAPI/Modules/SWD/HardsploitAPI_SWD_STM32.rb', line 115

def flashProgram
    @ahb.writeWord(0x40022010, 0x00000201)
end

#flashProgramEnd ⇒ Object 



118
119
120
 
# File 'lib/HardsploitAPI/Modules/SWD/HardsploitAPI_SWD_STM32.rb', line 118

def flashProgramEnd
    @ahb.writeWord(0x40022010, 0x00000200)
end

#flashRead(address, size) ⇒ Object 



32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
 
# File 'lib/HardsploitAPI/Modules/SWD/HardsploitAPI_SWD_STM32.rb', line 32

def flashRead(address,size)
  data = Array.new
  # Read a word of 32bits (4 Bytes in same time)

  size = size / 4
  #Chunk to 1k block for SWD

  #  ARM_debug_interface_v5   Automatic address increment is only guaranteed to operate on the bottom 10-bits  of the

  # address held in the TAR. Auto address incrementing of bit [10] and beyond is

  # IMPLEMENTATION DEFINED. This means that auto address incrementing at a 1KB boundary

  # is IMPLEMENTATION DEFINED


  #But for hardsploit max 8192  so chuck to  1k due to swd limitation


  packet_size = 1024
  number_complet_packet = (size / packet_size).floor
  size_last_packet =  size % packet_size
  startTime = Time.now
  #number_complet_packet

  for i in 0..number_complet_packet - 1 do
      data.push(*self.ahb.readBlock(i * 4 * packet_size + address, packet_size))
    #puts "Read #{packet_size} KB : #{i}"

    HardsploitAPI.instance.consoleProgress(
      percent:  100 * (i + 1) / (number_complet_packet + (size_last_packet.zero? ? 0 : 1)),
      startTime: startTime,
      endTime:  Time.new
    )
  end
  #Last partial packet

  if size_last_packet > 0 then
    data.push(*self.ahb.readBlock(number_complet_packet*4*packet_size+address,size_last_packet))
      #puts "Read last packet : #{size_last_packet} packet of 4 bytes"

      HardsploitAPI.instance.consoleProgress(
        percent:   100,
        startTime: startTime,
        endTime:   Time.new
      )
  end
  return data
end

#flashUnlock ⇒ Object 



97
98
99
100
101
 
# File 'lib/HardsploitAPI/Modules/SWD/HardsploitAPI_SWD_STM32.rb', line 97

def flashUnlock
    # unlock main flash

    @ahb.writeWord(0x40022004, 0x45670123)
    @ahb.writeWord(0x40022004, 0xCDEF89AB)
end

#flashWrite(address, data) ⇒ Object 



71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
 
# File 'lib/HardsploitAPI/Modules/SWD/HardsploitAPI_SWD_STM32.rb', line 71

def flashWrite(address,data)
    #Chunk to 1k block for SWD

    packet_size = 1024 #1024

    number_complet_packet = (data.size/packet_size).floor
    size_last_packet =  data.size % packet_size
    startTime = Time.now
    #ahb.csw(2, 1) # 16-bit packed incrementing addressing

    #number_complet_packet

    for i in 0..number_complet_packet-1 do
      self.ahb.writeBlock(address+i*packet_size,data[i*packet_size..i*packet_size-1+packet_size])
      #puts "Write #{packet_size} KB : #{i}"

      HardsploitAPI.instance.consoleProgress(
        percent: 100 * (i + 1) / (number_complet_packet + (size_last_packet.zero? ? 0 : 1)),
        startTime: startTime,
        endTime:Time.new
      )
    end
    #Last partial packet

    if size_last_packet > 0 then
        self.ahb.writeBlock(address+number_complet_packet*packet_size,data[number_complet_packet*packet_size..number_complet_packet*packet_size+size_last_packet])
        #puts "Write last packet : #{size_last_packet} packet"

        HardsploitAPI.instance.consoleProgress(percent:100,startTime:startTime,endTime:Time.new)
    end
    ahb.csw(1, 2) # set to default 32-bit incrementing addressing

end

#halt ⇒ Object 



19
20
21
22
 
# File 'lib/HardsploitAPI/Modules/SWD/HardsploitAPI_SWD_STM32.rb', line 19

def halt
    # halt the processor core

    @ahb.writeWord(0xE000EDF0, 0xA05F0003)
end

#sysReset ⇒ Object 



27
28
29
30
 
# File 'lib/HardsploitAPI/Modules/SWD/HardsploitAPI_SWD_STM32.rb', line 27

def sysReset
    # restart the processor and peripherals

    @ahb.writeWord(0xE000ED0C, 0x05FA0004)
end

#unhalt ⇒ Object 



23
24
25
26
 
# File 'lib/HardsploitAPI/Modules/SWD/HardsploitAPI_SWD_STM32.rb', line 23

def unhalt
    # unhalt the processor core

    @ahb.writeWord(0xE000EDF0, 0xA05F0000)
end