Class: HardsploitAPI

Inherits:
Object
  • Object
show all
Includes:
USB, USB_COMMAND, USB_STATE
Defined in:
lib/HardsploitAPI/HardsploitAPI_I2C.rb,
lib/HardsploitAPI/HardsploitAPI.rb,
lib/HardsploitAPI/HardsploitAPI_SPI.rb,
lib/HardsploitAPI/HardsploitAPI_ERROR.rb,
lib/HardsploitAPI/SWD/HardsploitAPI_SWD.rb,
lib/HardsploitAPI/HardsploitAPI_CONSTANT.rb,
lib/HardsploitAPI/HardsploitAPI_FIRMWARE.rb,
lib/HardsploitAPI/HardsploitAPI_PROGRESS.rb,
lib/HardsploitAPI/HardsploitAPI_TEST_INTERACT.rb,
lib/HardsploitAPI/HardsploitAPI_USB_COMMUNICATION.rb,
lib/HardsploitAPI/HardsploitAPI_NO_MUX_PARALLELE_MEMORY.rb

Overview

Hardsploit API - By Opale Security
www.opale-security.com || www.hardsploit.io
License: GNU General Public License v3
License URI: http://www.gnu.org/licenses/gpl.txt

Defined Under Namespace

Modules: Error, I2C, USB, USB_COMMAND, USB_STATE, VERSION Classes: HardsploitProgress

Constant Summary

Constants included from USB_COMMAND

USB_COMMAND::ERASE_FIRMWARE, USB_COMMAND::FPGA_COMMAND, USB_COMMAND::FPGA_DATA, USB_COMMAND::GET_SERIAL_NUMBER, USB_COMMAND::GET_VERSION_NUMBER, USB_COMMAND::GREEN_LED, USB_COMMAND::LOOPBACK, USB_COMMAND::READ_ID_FLASH, USB_COMMAND::READ_PAGE_FIRMWARE, USB_COMMAND::RED_LED, USB_COMMAND::START_FPGA, USB_COMMAND::START_FPGA_DATA, USB_COMMAND::STOP_FPGA, USB_COMMAND::STOP_FPGA_DATA, USB_COMMAND::VCP_ERROR, USB_COMMAND::WRITE_PAGE_FIRMWARE

Constants included from USB_STATE

USB_STATE::BUSY, USB_STATE::CONNECTED, USB_STATE::ERROR_SEND, USB_STATE::NOT_CONNECTED, USB_STATE::PACKET_IS_TOO_LARGE, USB_STATE::SUCCESSFUL_RECEIVE, USB_STATE::SUCCESSFUL_SEND, USB_STATE::TIMEOUT_RECEIVE, USB_STATE::UNKNOWN_CONNECTED, USB_STATE::UNKNOWN_STATE

Constants included from USB

USB::IN_ENDPOINT, USB::OUT_ENDPOINT, USB::USB_TRAME_SIZE

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(*args) ⇒ HardsploitAPI

  • callbackSpeedOfTransfert

    callback to get back information about speed



36
37
38
39
40
41
42
43
44
45
46
 
# File 'lib/HardsploitAPI/HardsploitAPI.rb', line 36

def initialize(*args)
	parametters = HardsploitAPI.checkParametters(["callbackData","callbackInfo","callbackProgress","callbackSpeedOfTransfert"],args)
	@callbackData = parametters[:callbackData]
	@callbackInfo = parametters[:callbackInfo]
	@callbackProgress = parametters[:callbackProgress]
	@callbackSpeedOfTransfert = parametters[:callbackSpeedOfTransfert]

	@packet_send = Array.new
	@usb = LIBUSB::Context.new
	@device = nil
end

Instance Attribute Details

#debugPort ⇒ Object

Returns the value of attribute debugPort.



12
13
14
 
# File 'lib/HardsploitAPI/SWD/HardsploitAPI_SWD.rb', line 12

def debugPort
  @debugPort
end

#dev ⇒ Object

Returns the value of attribute dev.



25
26
27
 
# File 'lib/HardsploitAPI/HardsploitAPI.rb', line 25

def dev
  @dev
end

#stm32 ⇒ Object

Returns the value of attribute stm32.



13
14
15
 
# File 'lib/HardsploitAPI/SWD/HardsploitAPI_SWD.rb', line 13

def stm32
  @stm32
end

Class Method Details

.BytesToInt(*args) ⇒ Object

Obtain high byte of a word

  • lByte

    low byte

  • hByte

    high byte

Return 16 bits integer concatenate with low and high bytes



70
71
72
73
74
75
 
# File 'lib/HardsploitAPI/HardsploitAPI_USB_COMMUNICATION.rb', line 70

def self.BytesToInt(*args)
	parametters = HardsploitAPI.checkParametters(["lByte","hByte"],args)
	lByte = parametters[:lByte]
	hByte = parametters[:hByte]
	return (lByte + (hByte<<8))
end

.checkParametters(arr_parametters, *args) ⇒ Object 



96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
 
# File 'lib/HardsploitAPI/HardsploitAPI.rb', line 96

def self.checkParametters(arr_parametters,*args)
	params = Hash.new
	if args[0][0].class == Hash then
		hash_args = args[0][0]
			arr_parametters.each  do |param|
				if hash_args[param.to_sym] == nil then
						raise "Wrong parametters, you need to specify #{param.to_sym}"
				else
						params[param.to_sym] = hash_args[param.to_sym]
				end
			end
	else
		if args[0].length == arr_parametters.size then
				args[0].each_with_index do |value,key|
					params[arr_parametters[key].to_sym] = value
				end
		else
			raise "Error : method need #{arr_parametters.size} parametters"
		end
	end
	return params
end

.highByte(*args) ⇒ Object

Obtain high byte of a word

  • word

    16 bit word

Return high byte of the word



60
61
62
63
64
 
# File 'lib/HardsploitAPI/HardsploitAPI_USB_COMMUNICATION.rb', line 60

def self.highByte(*args)
	parametters = HardsploitAPI.checkParametters(["word"],args)
	word = parametters[:word]
	return  (word & 0xFF00) >> 8
end

.lowByte(*args) ⇒ Object

Obtain low byte of a word

  • word

    16 bit word

Return low byte of the word



51
52
53
54
55
 
# File 'lib/HardsploitAPI/HardsploitAPI_USB_COMMUNICATION.rb', line 51

def self.lowByte(*args)
	parametters = HardsploitAPI.checkParametters(["word"],args)
	word = parametters[:word]
	return  word & 0xFF
end

.reverseBit(byte) ⇒ Object 



92
93
94
 
# File 'lib/HardsploitAPI/HardsploitAPI.rb', line 92

def self.reverseBit(byte)
	return byte.to_s(2).rjust(8, "0").reverse.to_i(2)
end

Instance Method Details

#calcOpcode(ap, register, read) ⇒ Object 



239
240
241
242
243
244
245
246
247
248
 
# File 'lib/HardsploitAPI/SWD/HardsploitAPI_SWD.rb', line 239

def calcOpcode (ap, register, read)
		opcode = 0x00
		(ap ? opcode |= 0x40 : opcode |= 0x00)
		(read ? opcode |= 0x20 : opcode |= 0x00)
		opcode = opcode | ((register & 0x01) << 4) | ((register & 0x02) << 2) #Addr AP DP  bit 2..3
		opcode = opcode | (((opcode & 0x78).to_s(2).count('1').odd? ? 1 : 0) << 2)  #0x78 mask to take only read ap and register to process parity bit
		opcode = opcode | 0x81 #Start and Park Bit
		#puts "OpCode #{opcode.to_s(16)}"
		return opcode
end

#clearStatusRegisterOfMemory ⇒ Object 



60
61
62
63
 
# File 'lib/HardsploitAPI/HardsploitAPI_NO_MUX_PARALLELE_MEMORY.rb', line 60

def clearStatusRegisterOfMemory
	#Clear Statut register
	write_command_Memory_WithoutMultiplexing(0x000000,0x50)
end

#connect ⇒ Object

Connect board and get an instance to work with Return USB_STATE



31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
 
# File 'lib/HardsploitAPI/HardsploitAPI_USB_COMMUNICATION.rb', line 31

def connect
	@device = @usb.devices(:idVendor => 0x0483, :idProduct => 0xFFFF)
	if @device.size == 0   then
			@device_version = ""
			return USB_STATE::NOT_CONNECTED
		else
		@dev = @device.first.open
			if RUBY_PLATFORM=~/linux/i && @dev.kernel_driver_active?(0)
				@dev.detach_kernel_driver(0)
			end
		@dev.claim_interface(0)
		Thread.abort_on_exception = true
		setStatutLed(USB_COMMAND::GREEN_LED,true);
		return USB_STATE::CONNECTED
	end
end

#consoleData(value) ⇒ Object 



122
123
124
 
# File 'lib/HardsploitAPI/HardsploitAPI.rb', line 122

def consoleData(value)
	@callbackData.call(value)
end

#consoleInfo(value) ⇒ Object 



128
129
130
 
# File 'lib/HardsploitAPI/HardsploitAPI.rb', line 128

def consoleInfo(value)
	@callbackInfo.call(value)
end

#consoleProgress(percent:, startTime:, endTime:) ⇒ Object 



119
120
121
 
# File 'lib/HardsploitAPI/HardsploitAPI.rb', line 119

def consoleProgress(percent:,startTime:,endTime:)
	@callbackProgress.call(percent:percent,startTime:startTime,endTime:endTime)
end

#consoleSpeed(value) ⇒ Object 



125
126
127
 
# File 'lib/HardsploitAPI/HardsploitAPI.rb', line 125

def consoleSpeed(value)
	@callbackSpeedOfTransfert.call(value)
end

#dumpFlash(path) ⇒ Object 



63
64
65
66
67
68
69
70
71
72
73
74
75
76
 
# File 'lib/HardsploitAPI/SWD/HardsploitAPI_SWD.rb', line 63

def dumpFlash(path)
	resetSWD()
	#DUMP FLASH MEMORY TO A FILE
	@stm32.halt
  flash_size = (stm32.ahb.readWord(0x1ffff7e0) & 0xFFFF)
	puts "Flash size : #{(flash_size) } KB"
	puts "Dump flash"
  time = Time.new
	data = @stm32.flashRead(0x08000000,(flash_size*1024))
	time = Time.new - time
	puts "DUMP #{((data.size/time)).round(2)}Bytes/s #{(data.size)}Bytes in  #{time.round(4)} s"
	IO.binwrite(path, data.pack('C*'))
	puts "Finish dump"
end

#eraseBlockMemory(blockAddress) ⇒ Object 



35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
 
# File 'lib/HardsploitAPI/HardsploitAPI_NO_MUX_PARALLELE_MEMORY.rb', line 35

def eraseBlockMemory(blockAddress)
	#Read Five Word
	write_command_Memory_WithoutMultiplexing(blockAddress,0x0020)   #Block erase command
	statut = write_command_Memory_WithoutMultiplexing(blockAddress,0x00D0)   #Confirm Block erase command

	 timeout = 10
	# while (statut != 128 ) && (timeout >= 0)
	#
	# 	puts "#{statut}  #{timeout}"
	# 		statut = readByteFromMemory(0) #read statut register
	# 	sleep(100)
	# 	if timeout == 0 then
	# 		return statut
	# 	else
	# 		timeout = timeout-1
	# 	end
	# end
	for ty in 0..4
		puts readByteFromMemory(0)
	end

	puts "Return timeout"
	return statut
end

#eraseFlash ⇒ Object 



58
59
60
61
 
# File 'lib/HardsploitAPI/SWD/HardsploitAPI_SWD.rb', line 58

def eraseFlash
	puts 'Erase'
	stm32.flashErase()
end

#getVersionNumber ⇒ Object

Obtaint the version number of the board



75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
 
# File 'lib/HardsploitAPI/HardsploitAPI.rb', line 75

def getVersionNumber
	packet = Array.new
	packet.push 0  #low byte of lenght of trame refresh automaticly before send by usb
	packet.push 0  #high byte of lenght of trame refresh automaticly before send by usb
	packet.push HardsploitAPI.lowByte(USB_COMMAND::GET_VERSION_NUMBER)
	packet.push HardsploitAPI.highByte(USB_COMMAND::GET_VERSION_NUMBER)

	#remove header
	version_number = sendAndReceiveDATA(packet,1000).drop(4)
	if version_number.size < 20 then #if size more thant 20 char error when reading version number
			return version_number.pack('U*')
	else
		return "BAD VERSION NUMBER"
	end

end

#i2c_Generic_Dump(*args) ⇒ Object

  • startAddress

    Start address (included)

  • stopAddress

    Stop address (included)

  • sizeMax

    Size max of memory (important to calculate automaticly the number of byte to set address)



98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
 
# File 'lib/HardsploitAPI/HardsploitAPI_I2C.rb', line 98

def i2c_Generic_Dump (*args)
		parametters = HardsploitAPI.checkParametters(["speed","i2cBaseAddress","startAddress","stopAddress","sizeMax"],args)
		speed = parametters[:speed]
		i2cBaseAddress = parametters[:i2cBaseAddress]
		startAddress = parametters[:startAddress]
		stopAddress = parametters[:stopAddress]
		sizeMax = parametters[:sizeMax]

		if ((startAddress < 0)  or (startAddress > sizeMax-1)) then
			raise TypeError, "Start address can't be negative and not more than size max - 1"
		end
		if ((stopAddress < 0)  or (stopAddress > (sizeMax-1))) then
			raise TypeError, "Stop address can't be negative and not more than size max-1 because start at 0"
		end

		if (stopAddress <= startAddress) then
			raise TypeError, "Stop address need to be greater than start address"
		end

		numberOfByteAddress = (((Math.log(sizeMax-1,2)).floor + 1) / 8.0).ceil
		if numberOfByteAddress > 4 then
			raise TypeError, "Size max must be less than 2^32 about 4Gb"
		end

		if numberOfByteAddress <= 0 then
			raise TypeError, "There is an issue with calculating of number of byte needed"
		end
		startTime = Time.now
		packet_size = 2000 - numberOfByteAddress - 1
		number_complet_packet = ( (stopAddress-startAddress+1) / packet_size).floor
		size_last_packet =  (stopAddress-startAddress+1) % packet_size

		#SEND the first complete trame
		for i in 0..number_complet_packet-1 do
			packet = generate_i2c_read_command i2cBaseAddress,numberOfByteAddress+startAddress,i*packet_size,packet_size
			temp = i2c_Interact(speed,packet)
			case temp
				when HardsploitAPI::USB_STATE::PACKET_IS_TOO_LARGE
					puts "PACKET_IS_TOO_LARGE max: #{HardsploitAPI::USB::USB_TRAME_SIZE}"
				when HardsploitAPI::USB_STATE::ERROR_SEND
					puts "ERROR_SEND\n"
				when HardsploitAPI::USB_STATE::BUSY
					puts "BUSY"
				when HardsploitAPI::USB_STATE::TIMEOUT_RECEIVE
					puts "TIMEOUT_RECEIVE\n"
				else
					#Remove header, result of read command and numberOfByte Address too
					consoleData ( process_dump_i2c_result( temp ) )
			end

			consoleProgress(percent:100*(i+1)/(number_complet_packet+ (size_last_packet.zero? ? 0 : 1)),startTime:startTime,endTime:Time.new)
		end

	if(size_last_packet > 0 )then
		packet = generate_i2c_read_command i2cBaseAddress,numberOfByteAddress,number_complet_packet*packet_size+startAddress,size_last_packet
		temp = i2c_Interact(speed,packet)
		case temp
			when HardsploitAPI::USB_STATE::PACKET_IS_TOO_LARGE
				puts "PACKET_IS_TOO_LARGE max: #{HardsploitAPI::USB::USB_TRAME_SIZE}"
			when HardsploitAPI::USB_STATE::ERROR_SEND
				puts "ERROR_SEND\n"
			when HardsploitAPI::USB_STATE::BUSY
				puts "BUSY"
			when HardsploitAPI::USB_STATE::TIMEOUT_RECEIVE
				puts "TIMEOUT_RECEIVE\n"
			else
				#Remove header, result of read command and numberOfByte Address too
				consoleData ( process_dump_i2c_result ( temp ) )
		 end
		 consoleProgress(percent:100,startTime:startTime,endTime:Time.new)
	end

	delta = Time.now - startTime
	consoleSpeed "Write in #{delta.round(4)} sec"
end

#i2c_Generic_Import(*args) ⇒ Object

For the moment only with EEPROM (not need to erase or activate write)



175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
 
# File 'lib/HardsploitAPI/HardsploitAPI_I2C.rb', line 175

def i2c_Generic_Import (*args)
	parametters = HardsploitAPI.checkParametters(["speed","i2cBaseAddress","startAddress","pageSize","memorySize","dataFile","writePageLatency"],args)
	speed = parametters[:speed]
	i2cBaseAddress = parametters[:i2cBaseAddress]
	startAddress = parametters[:startAddress]
	pageSize = parametters[:pageSize]
	memorySize = parametters[:memorySize]
	dataFile = parametters[:dataFile]
	writePageLatency = parametters[:writePageLatency]

	startTime = Time.now
	begin
		file =	File.open(dataFile, 'rb')
		sizeFile = file.size
	rescue Exception => e
		raise Error::FileIssue, e.message
	end

	if ((startAddress < 0)  or (startAddress > memorySize-1)) then
		raise Error::WrongStartAddress
	end

	if ((pageSize <= 0) and (pageSize >1024)) then
		raise TypeError, "pageSize need to be greater than 0 and less than 1024"
	end

	numberOfByteAddress = (((Math.log(memorySize-1,2)).floor + 1) / 8.0).ceil
	if numberOfByteAddress > 4 then
		raise TypeError, "Size max must be less than 2^32 about 4Gb"
	end

	if numberOfByteAddress <= 0 then
		raise TypeError, "There is an issue with calculating of number of byte needed"
	end

	packet_size = pageSize
	number_complet_packet = (sizeFile / packet_size).floor
	size_last_packet =  sizeFile % packet_size

	#SEND the first complete trame
	for i in 0..number_complet_packet-1 do
		packet = generate_i2c_write_command i2cBaseAddress,numberOfByteAddress,i*packet_size,file.read(packet_size).unpack("C*")
		temp = i2c_Interact(speed,packet)
		case temp
			when HardsploitAPI::USB_STATE::PACKET_IS_TOO_LARGE
				puts "PACKET_IS_TOO_LARGE max: #{HardsploitAPI::USB::USB_TRAME_SIZE}"
			when HardsploitAPI::USB_STATE::ERROR_SEND
				puts "ERROR_SEND\n"
			when HardsploitAPI::USB_STATE::BUSY
				puts "BUSY"
			when HardsploitAPI::USB_STATE::TIMEOUT_RECEIVE
				puts "TIMEOUT_RECEIVE\n"
			else
				#Remove header, result of read command and numberOfByte Address too
				process_import_i2c_result( temp )
		end

		consoleProgress(percent:100*(i+1)/(number_complet_packet+ (size_last_packet.zero? ? 0 : 1)),startTime:startTime,endTime:Time.new)

		#if too many error when write increase because we need to wait to write a full page
		sleep(writePageLatency)
	end

	if(size_last_packet > 0 )then
		packet = generate_i2c_write_command(i2cBaseAddress,numberOfByteAddress,number_complet_packet*packet_size+startAddress,file.read(size_last_packet).unpack("C*"))
		temp = i2c_Interact(speed,packet)
		case temp
			when HardsploitAPI::USB_STATE::PACKET_IS_TOO_LARGE
				puts "PACKET_IS_TOO_LARGE max: #{HardsploitAPI::USB::USB_TRAME_SIZE}"
			when HardsploitAPI::USB_STATE::ERROR_SEND
				puts "ERROR_SEND\n"
			when HardsploitAPI::USB_STATE::BUSY
				puts "BUSY"
			when HardsploitAPI::USB_STATE::TIMEOUT_RECEIVE
				puts "TIMEOUT_RECEIVE\n"
			else
				#Remove header, result of read command and numberOfByte Address too
				process_import_i2c_result ( temp )
		end
			consoleProgress(percent:100,startTime:startTime,endTime:Time.new)
	end

	delta = Time.now - startTime
	consoleSpeed "Write in #{delta.round(4)} sec"
end

#i2c_Interact(*args) ⇒ Object

  • payload

    payload to send



14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
 
# File 'lib/HardsploitAPI/HardsploitAPI_I2C.rb', line 14

def i2c_Interact(*args)
	parametters = HardsploitAPI.checkParametters(["speed","payload"],args)
	speed = parametters[:speed]
	payload = parametters[:payload]

	if (speed < 0)  and (speed >3) then
		raise TypeError, 'Speed must be between 0 and 3'
	end

	if (payload.size > 4000) then
		raise TypeError, 'Size of the data need to be less than 4000'
	end

	packet = Array.new
	packet.push 0  #low byte of lenght of trame refresh automaticly before send by usb
	packet.push 0  #high byte of lenght of trame refresh automaticly before send by usb
	packet.push HardsploitAPI.lowByte(USB_COMMAND::FPGA_COMMAND)
	packet.push HardsploitAPI.highByte(USB_COMMAND::FPGA_COMMAND)

	packet.push 0x50 #Command RAW COMMUNICATION TO FPGA FIFO

	packet.push speed #Add speed
	packet.concat payload #Add data

	sendPacket packet

	tmp= receiveDATA(2000)
	case tmp
		when HardsploitAPI::USB_STATE::BUSY
			return USB_STATE::BUSY
		when HardsploitAPI::USB_STATE::TIMEOUT_RECEIVE
			return USB_STATE::TIMEOUT_RECEIVE
		else
			#remove header (4 bytes   2 for size 2 for type of command)
			return tmp.bytes.drop(4)
	end
end

#i2c_Scan(*args) ⇒ Object

  • Return An array 256 value for each addresse if 0 not present if 1 present



55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
 
# File 'lib/HardsploitAPI/HardsploitAPI_I2C.rb', line 55

def i2c_Scan(*args)
	parametters = HardsploitAPI.checkParametters(["speed"],args)
	speed = parametters[:speed]

	if (speed < 0)  and (speed >3) then
		raise TypeError, 'Speed must be between 0 and 3'
	end

	array_i2c_scan = Array.new
	result_scan = Array.new
	return_scan = Array.new

	#we want scan just read address it is a partial scan (fastest)
	for i in (1..255).step(2) do
		array_i2c_scan.push HardsploitAPI.lowByte(1)  #Count Low  Byte
		array_i2c_scan.push HardsploitAPI.highByte(1)   #Count High Byte
		array_i2c_scan.push i
	end

	result_scan = i2c_Interact(speed,array_i2c_scan)
	if result_scan.size != 256 then
		raise TypeError, "FPGA send a wrong I2C scan result, try again , check power jumper, fix wiring , power on ? (reboot the board if needed)"
	end

	for i in (0..result_scan.size-1).step(2) do
		#Check if ACK_ERROR
		if result_scan[i] == 1 then
			return_scan.push 1 #For write
			return_scan.push 1 #For read
		else
			return_scan.push 0 #For write
			return_scan.push 0 #For read
		end
	end
	return return_scan
end

#obtainCodes ⇒ Object 



24
25
26
27
28
29
30
31
32
33
 
# File 'lib/HardsploitAPI/SWD/HardsploitAPI_SWD.rb', line 24

def obtainCodes
	resetSWD()
	code = {
	  :DebugPortId => debugPort.idcode(),
	  :AccessPortId => stm32.ahb.idcode(),
	  :CpuId => stm32.ahb.readWord(0xE000ED00),
		:DeviceId => stm32.ahb.readWord(0x1FFFF7E8)
	}
	return code
end

#read_Memory_WithoutMultiplexing(*args) ⇒ Object

Read parallele memory in asynchronous mode (blocking function) but callBack data is used to receive packet

  • addressStart

    32 bits address

  • addressStop

    32 bits address

  • bits8_or_bits16_DataSize

    0 for 8 bits operation & 1 for 16 bits operation

  • latency

    latency in ns range 7ns to 1600ns=1,6ms

Return USB_STATE End with TIMEOUT_RECEIVE but need to check if received the right number of bytes to ensure all is correct



152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
 
# File 'lib/HardsploitAPI/HardsploitAPI_NO_MUX_PARALLELE_MEMORY.rb', line 152

def read_Memory_WithoutMultiplexing(*args)
parametters = HardsploitAPI.checkParametters(["addressStart","addressStop","bits8_or_bits16_DataSize","latency"],args)
 	addressStart = parametters[:addressStart]
addressStop = parametters[:addressStop]
bits8_or_bits16_DataSize = parametters[:bits8_or_bits16_DataSize]
latency = parametters[:latency]


numberOfByteReaded = 0
packet = Array.new
packet.push 0  #low byte of lenght of trame refresh automaticly before send by usb
packet.push 0  #high byte of lenght of trame refresh automaticly before send by usb
packet.push HardsploitAPI.lowByte(USB_COMMAND::FPGA_COMMAND)
packet.push HardsploitAPI.highByte(USB_COMMAND::FPGA_COMMAND)

packet.push 0x50 #Command RAW COMMUNICATION TO FPGA FIFO

#Chek if 8bits or 16 bits
if bits8_or_bits16_DataSize == true then
	packet.push 1
else
	packet.push	0
end

#Check latency value
if ((latency >= 7)  and (latency <= 1600)) then
	packet.push (latency/6.66).floor
else
	raise TypeError, 'Latency value must be from 7 to 1695'
end

#Check address
if (addressStop <= addressStart  ) then
	raise TypeError, 'Stop address is less than start address'
end

packet.push  ((addressStart & 0xFF000000) >> 24 ) #AddStart3
packet.push  ((addressStart & 0x00FF0000) >> 16 ) #AddStart2
packet.push  ((addressStart & 0x0000FF00) >> 8 )  #AddStart1
packet.push  ((addressStart & 0x000000FF) >> 0)   #AddStart0

packet.push 0x10 #Memory read command
packet.push  ((addressStop & 0xFF000000) >> 24 ) #AddStart3
packet.push  ((addressStop & 0x00FF0000) >> 16 ) #AddStop2
packet.push  ((addressStop & 0x0000FF00) >> 8 )  #AddStop1
packet.push  ((addressStop & 0x000000FF) >> 0)   #AddStop0

sendPacket(packet)

if bits8_or_bits16_DataSize then
	sizeCalculated = (addressStop-addressStart+1)
else
	sizeCalculated = (addressStop-addressStart+1)*2
end

numberOfByteReaded = 0
while true
	tmp= receiveDATA(2000)
	case tmp
		when HardsploitAPI::USB_STATE::BUSY
			raise  "USB_STATE::BUSY"
		when HardsploitAPI::USB_STATE::TIMEOUT_RECEIVE
			raise "Timeout"
		else
			#remove header (4 bytes   2 for size 2 for type of command)
			tmp = tmp.bytes.drop(4)
			numberOfByteReaded = numberOfByteReaded + tmp.size
			consoleData(tmp)

			puts "Receive #{numberOfByteReaded} of #{sizeCalculated}"
				if numberOfByteReaded >= sizeCalculated then
			 	#Exit because we received all data
			 	return
			end
		end
	end
end

#readBlockAP(size) ⇒ Object 



156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
 
# File 'lib/HardsploitAPI/SWD/HardsploitAPI_SWD.rb', line 156

def readBlockAP(size)
	packet = Array.new
	packet.push 0  #low byte of lenght of trame refresh automaticly before send by usb
	packet.push 0  #high byte of lenght of trame refresh automaticly before send by usb
	packet.push HardsploitAPI.lowByte(HardsploitAPI::USB_COMMAND::FPGA_COMMAND)
	packet.push HardsploitAPI.highByte(HardsploitAPI::USB_COMMAND::FPGA_COMMAND)

	packet.push 0x50 #Command RAW COMMUNICATION TO FPGA FIFO

	packet.push 0xAA #Read mode
	packet.push HardsploitAPI.lowByte(size)
	packet.push HardsploitAPI.highByte(size)

	result = sendAndReceiveDATA(packet,1000)
	 if result.class == Array then
	 		if result.size >= 4   then #Receive read + 4bytes for header
	 			return result.drop(4)
			else
				raise "Receive just Header where is the data ? "
	 		end
	 else # Receive and error
	 		raise "Error during reading  timeout or ACK issue "
	 end
end

#readByteFromMemory(address) ⇒ Object 



103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
 
# File 'lib/HardsploitAPI/HardsploitAPI_NO_MUX_PARALLELE_MEMORY.rb', line 103

def readByteFromMemory(address)
	packet = Array.new
	packet.push 0  #low byte of lenght of trame refresh automaticly before send by usb
	packet.push 0  #high byte of lenght of trame refresh automaticly before send by usb
	packet.push HardsploitAPI.lowByte(USB_COMMAND::FPGA_COMMAND)
	packet.push HardsploitAPI.highByte(USB_COMMAND::FPGA_COMMAND)

	packet.push 0x50 #Command RAW COMMUNICATION TO FPGA FIFO


	#16 bits
	packet.push	0
	packet.push (1500/6.66).floor


	packet.push  ((address & 0xFF000000) >> 24 ) #AddStart3
	packet.push  ((address & 0x00FF0000) >> 16 ) #AddStart2
	packet.push  ((address & 0x0000FF00) >> 8 )  #AddStart1
	packet.push  ((address & 0x000000FF) >> 0)   #AddStart0

	packet.push 0x10 #Memory read command
	packet.push  ((address & 0xFF000000) >> 24 ) #AddStart3
	packet.push  ((address & 0x00FF0000) >> 16 ) #AddStop2
	packet.push  ((address & 0x0000FF00) >> 8 )  #AddStop1
	packet.push  ((address & 0x000000FF) >> 0)   #AddStop0

	result = sendAndReceiveDATA(packet,1000)

	if result == USB_STATE::TIMEOUT_RECEIVE then
		return "TIMEOUT"
	else
		if result.size == 6 then
				return HardsploitAPI.BytesToInt(result[4] , result[5])
		else
			raise "BAD RESPONSE"
		end
	end
end

#readDeviceIdMemory ⇒ Object 



18
19
20
21
 
# File 'lib/HardsploitAPI/HardsploitAPI_NO_MUX_PARALLELE_MEMORY.rb', line 18

def readDeviceIdMemory
	write_command_Memory_WithoutMultiplexing(0x00000000,0x90) #ReadDeviceIdentifierCommand
	return readByteFromMemory(0)#Read  0
end

#readManufactuerCodeMemory ⇒ Object 



13
14
15
16
 
# File 'lib/HardsploitAPI/HardsploitAPI_NO_MUX_PARALLELE_MEMORY.rb', line 13

def readManufactuerCodeMemory
	write_command_Memory_WithoutMultiplexing(0x00000000,0x90) #ReadDeviceIdentifierCommand
	return readByteFromMemory(1) #Read from 1 to 1 = read 1 byte at 1
end

#readMode ⇒ Object 



30
31
32
33
 
# File 'lib/HardsploitAPI/HardsploitAPI_NO_MUX_PARALLELE_MEMORY.rb', line 30

def readMode
	#go in read mode
	write_command_Memory_WithoutMultiplexing(0x000000,0x00FF)
end

#readSWD(ap, register) ⇒ Object 



181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
 
# File 'lib/HardsploitAPI/SWD/HardsploitAPI_SWD.rb', line 181

def readSWD(ap,register)
	packet = Array.new
	packet.push 0  #low byte of lenght of trame refresh automaticly before send by usb
	packet.push 0  #high byte of lenght of trame refresh automaticly before send by usb
	packet.push HardsploitAPI.lowByte(HardsploitAPI::USB_COMMAND::FPGA_COMMAND)
	packet.push HardsploitAPI.highByte(HardsploitAPI::USB_COMMAND::FPGA_COMMAND)

	packet.push 0x50 #Command RAW COMMUNICATION TO FPGA FIFO

	packet.push 0x11 #Read mode
	packet.push(calcOpcode(ap,register, true)) #Send Request

	result = sendAndReceiveDATA(packet,1000)
	 if result.class == Array then
	 		if result.size == 4 + 4  then #Receive read + 4bytes for header
	 			convert = (result[7]  << 24)  + (result[6]  << 16) + (result[5]  << 8 ) + result[4]
	 			return convert
	 		elsif result.size == 4+1 then #receive ACK
				raise "Read error  ACK : #{result[4]}"
	 		else
	 			raise "Error during reading"
	 		end
	 else # Receive and error
	 	raise "Error during reading  timeout "
	 end
end

#receiveDATA(timeout) ⇒ Object

Wait to receive data

  • timeout

    timeout to read response (ms)

Return USB_STATE or array with response (improve soon with exception)



108
109
110
111
112
113
114
115
116
117
118
 
# File 'lib/HardsploitAPI/HardsploitAPI_USB_COMMUNICATION.rb', line 108

def receiveDATA(timeout)
	begin
		received_data =  dev.bulk_transfer(:endpoint=>IN_ENDPOINT, :dataIn=>USB::USB_TRAME_SIZE, :timeout=>timeout)
	rescue LIBUSB::ERROR_BUSY
		return USB_STATE::BUSY
	rescue LIBUSB::ERROR_TIMEOUT
		return USB_STATE::TIMEOUT_RECEIVE
	else
		return received_data
	end
end

#resetSWD ⇒ Object

Return array with 1 byte for ACK Return 32bits integer for data read here is Core ID Raise if error



212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
 
# File 'lib/HardsploitAPI/SWD/HardsploitAPI_SWD.rb', line 212

def resetSWD
	packet = Array.new
	packet.push 0  #low byte of lenght of trame refresh automaticly before send by usb
	packet.push 0  #high byte of lenght of trame refresh automaticly before send by usb
	packet.push HardsploitAPI.lowByte(HardsploitAPI::USB_COMMAND::FPGA_COMMAND)
	packet.push HardsploitAPI.highByte(HardsploitAPI::USB_COMMAND::FPGA_COMMAND)

	packet.push 0x50 #Command RAW COMMUNICATION TO FPGA FIFO

	packet.push 0x00 #Reset mode

	result = sendAndReceiveDATA(packet,1000)
	if result.class == Array then
			if result.size == 4 + 4  then #Receive read + 4bytes for header
				convert = (result[7]  << 24)  + (result[6]  << 16) + (result[5]  << 8 ) + result[4]
				return convert
			elsif result.size == 4 +1 then #reveice ACK
				raise "ERROR ACK #{result[4]}"
			else
				raise "Error during reading ICCODE result != 4"
			end
	else # Receive and error
		raise "Error during reading ICCODE timeout "
	end
end

#runSWD ⇒ Object 



15
16
17
18
19
20
21
22
 
# File 'lib/HardsploitAPI/SWD/HardsploitAPI_SWD.rb', line 15

def runSWD
	@debugPort = SWD_DEBUG_PORT.new(self)
	@stm32     = SWD_STM32.new(debugPort)

	resetSWD()
	#  Cortex M4 0x410FC241
	#  Cortex M3 0x411FC231
end

#sendAndReceiveDATA(packet_send, timeout) ⇒ Object

Send data and wait to receive response

  • packet_send

    array of byte

  • timeout

    timeout to read response (ms)

Return USB_STATE or array with response (improve soon with exception)



82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
 
# File 'lib/HardsploitAPI/HardsploitAPI_USB_COMMUNICATION.rb', line 82

def sendAndReceiveDATA(packet_send,timeout)
	time = Time.new
	case sendPacket(packet_send)
		when USB_STATE::SUCCESSFUL_SEND
			received_data = receiveDATA(timeout)
			case received_data
				when USB_STATE::BUSY
					return  USB_STATE::BUSY
				when USB_STATE::TIMEOUT_RECEIVE
					return USB_STATE::TIMEOUT_RECEIVE
				else
					consoleSpeed "RECEIVE #{((received_data.bytes.to_a.size/(Time.new-time))).round(2)}Bytes/s  #{(received_data.bytes.to_a.size)}Bytes in  #{(Time.new-time).round(4)} s"
					return received_data.bytes.to_a
			end
		when USB_STATE::PACKET_IS_TOO_LARGE
			return  USB_STATE::PACKET_IS_TOO_LARGE
		when USB_STATE::ERROR_SEND
			return  USB_STATE::ERROR_SEND
		else
			return  USB_STATE::UNKNOWN_STATE
	end
end

#sendPacket(packet_send) ⇒ Object

Send USB packet

  • packet

    array with bytes

Return USB_STATE or array with response (improve soon with exception)



123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
 
# File 'lib/HardsploitAPI/HardsploitAPI_USB_COMMUNICATION.rb', line 123

def sendPacket(packet_send)
	if packet_send.size <= 8191 then

		packet_send[0] = HardsploitAPI.lowByte(packet_send.size)
		packet_send[1] = HardsploitAPI.highByte(packet_send.size)

		#if a multiple of packet size add a value to explicit the end of trame
		if packet_send.size % 64 ==0 then
			packet_send.push 0
		end

		number_of_data_send = 0
		time = Benchmark.realtime  do
			number_of_data_send =  @dev.bulk_transfer(:endpoint=>OUT_ENDPOINT, :dataOut=>packet_send.pack('c*'),:timeout=>3000)
		end
		consoleSpeed "SEND #{((number_of_data_send/time)).round(2)}Bytes/s  SEND #{(number_of_data_send)}Bytes in  #{time.round(4)} s"
		if number_of_data_send ==  packet_send.size then
			return USB_STATE::SUCCESSFUL_SEND
		else
			return USB_STATE::ERROR_SEND
		end
	else
		return USB_STATE::PACKET_IS_TOO_LARGE
	end
end

#setStatutLed(*args) ⇒ Object

Set the leds of uC returning nothing

  • led

    USB_COMMAND::GREEN_LED or USB_COMMAND::RED_LED

  • state

    callback to return data for dump function



15
16
17
18
19
20
21
22
23
24
25
26
27
 
# File 'lib/HardsploitAPI/HardsploitAPI_USB_COMMUNICATION.rb', line 15

def setStatutLed(*args)
	parametters = HardsploitAPI.checkParametters(["led","state"],args)
	led = parametters[:led]
	state = parametters[:state]

	packet_send = Array.new
	packet_send.push 0 #size set before send automatic
	packet_send.push 0	#size set before send automatic
	packet_send.push HardsploitAPI.lowByte(led)
	packet_send.push HardsploitAPI.highByte(led)
	packet_send.push (state ? 1 : 0)
	return sendPacket(packet_send)
end

#setWiringLeds(*args) ⇒ Object

  • value

    64 bits (8x8 Bytes) values to represent led (PortH PortG PortF PortE PortD PortC PortB PortA)



50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
 
# File 'lib/HardsploitAPI/HardsploitAPI.rb', line 50

def setWiringLeds(*args)
	parametters = HardsploitAPI.checkParametters(["value"],args)
	val = parametters[:value]

	packet = Array.new
	packet.push 0  #low byte of lenght of trame refresh automaticly before send by usb
	packet.push 0  #high byte of lenght of trame refresh automaticly before send by usb
	packet.push HardsploitAPI.lowByte(USB_COMMAND::FPGA_COMMAND)
	packet.push HardsploitAPI.highByte(USB_COMMAND::FPGA_COMMAND)

	packet.push 0x23 #Command SPI write wiring led

	packet.push  HardsploitAPI.reverseBit((val & 0x00000000000000FF) >> 0)
	packet.push  HardsploitAPI.reverseBit((val & 0x000000000000FF00) >> 8 )
	packet.push  HardsploitAPI.reverseBit((val & 0x0000000000FF0000) >> 16 )
	packet.push  HardsploitAPI.reverseBit((val & 0x00000000FF000000) >> 24 )
	packet.push  HardsploitAPI.reverseBit((val & 0x000000FF00000000) >> 32 )
	packet.push  HardsploitAPI.reverseBit((val & 0x0000FF0000000000) >> 40 )
	packet.push  HardsploitAPI.reverseBit((val & 0x00FF000000000000) >> 48 )
	packet.push  HardsploitAPI.reverseBit((val & 0xFF00000000000000) >> 56 )

	return  self.sendPacket(packet)
end

#signalHelpingWiring(*args) ⇒ Object

Power on the led for each signal specified Params:

signal

Name of signal you want visual help (set the led)



15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
 
# File 'lib/HardsploitAPI/HardsploitAPI_CONSTANT.rb', line 15

def signalHelpingWiring(*args)
	parametters = HardsploitAPI.checkParametters(["signal"],args)
	signal = parametters[:signal]

	wires = Hash.new

	#Parallel module
	wires["A0"] = 0
	wires["A1"] = 1
	wires["A2"] = 2
	wires["A3"] = 3
	wires["A4"] = 4
	wires["A5"] = 5
	wires["A6"] = 6
	wires["A7"] = 7
	wires["A8"] = 8
	wires["A9"] = 9
	wires["A10"] = 10
	wires["A11"] = 11
	wires["A12"] = 12
	wires["A13"] = 13
	wires["A14"] = 14
	wires["A15"] = 15
	wires["A16"] = 16
	wires["A17"] = 17
	wires["A18"] = 18
	wires["A19"] = 19
	wires["A20"] = 20
	wires["A21"] = 21
	wires["A22"] = 22
	wires["A23"] = 23
	wires["A24"] = 24
	wires["A25"] = 25
	wires["A26"] = 26
	wires["A27"] = 27
	wires["A28"] = 28
	wires["A29"] = 29
	wires["A30"] = 30
	wires["A31"] = 31

	wires["D0"] = 32
	wires["D1"] = 33
	wires["D2"] = 34
	wires["D3"] = 35
	wires["D4"] = 36
	wires["D5"] = 37
	wires["D6"] = 38
	wires["D7"] = 39
	wires["D8"] = 40
	wires["D9"] = 41
	wires["D10"] = 42
	wires["D11"] = 43
	wires["D12"] = 44
	wires["D13"] = 45
	wires["D14"] = 46
	wires["D15"] = 47

	wires["RST"] = 48
	wires["CE"] = 49
	wires["OE"] = 50
	wires["WE"] = 51
	wires["CLK"] = 52
	wires["WP"] = 53
	wires["ADV"] = 54


	#SPI module
	wires["CS"] = 0
	wires["SPI_CLK"] = 1
	wires["MOSI"] = 2
	wires["MISO"] = 3

	#I2C module
	wires["I2C_CLK"] = 0
	wires["SDA"] = 1

	begin
		setWiringLeds(2**wires[signal])
	rescue Exception => e
	   raise 'UNKNOWN SIGNAL'
	end
end

#spi_Generic_Dump(*args) ⇒ Object

Spi generic dump

  • mode

    SPI mode 0,1,2,3

  • speed

    Range 1-255 SPI clock = 150Mhz / (2*speed) tested from 3 to 255 (25Mhz to about 0.3Khz)

  • readSpiCommand

    The read command

  • startAddress

    Start address (included)

  • stopAddress

    Stop address (included)

  • sizeMax

    Size max of memory (important to calculate automaticly the number of byte to set address)



208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
 
# File 'lib/HardsploitAPI/HardsploitAPI_SPI.rb', line 208

def spi_Generic_Dump (*args)
		parametters = HardsploitAPI.checkParametters(["mode","speed","readSpiCommand","startAddress","stopAddress","sizeMax"],args)
		mode = parametters[:mode]
		speed = parametters[:speed]
		readSpiCommand = parametters[:readSpiCommand]
		startAddress = parametters[:startAddress]
		stopAddress = parametters[:stopAddress]
		sizeMax = parametters[:sizeMax]


		if (mode < 0)  and (mode >3) then
			raise TypeError, 'Mode must be between 0 and 3'
		end
		if (speed <= 2)  and (speed >256) then
			raise TypeError, 'Speed must be between 3 and 255'
		end

		if ((startAddress < 0)  or (startAddress > sizeMax-1)) then
			raise TypeError, "Start address can't be negative and not more than size max - 1"
		end
		if ((stopAddress < 0)  or (stopAddress > (sizeMax-1))) then
			raise TypeError, "Stop address can't be negative and not more than size max-1 because start at 0"
		end

		if (stopAddress < startAddress) then
			raise TypeError, "Stop address need to be greater than start address"
		end

		numberOfByteAddress = (((Math.log(sizeMax-1,2)).floor + 1) / 8.0).ceil
		if numberOfByteAddress > 4 then
			raise TypeError, "Size max must be less than 2^32 about 4Gb"
		end

		if numberOfByteAddress <= 0 then
			raise TypeError, "There is an issue with calculating of number of byte needed"
		end

		#Start time
		startTime = Time.now
		packet_size = 4000 - numberOfByteAddress - 1
		number_complet_packet = ( (stopAddress-startAddress+1) / packet_size).floor
		size_last_packet =  (stopAddress-startAddress+1) % packet_size

		#SEND the first complete trame
		for i in 0..number_complet_packet-1 do
			packet = generate_spi_read_command numberOfByteAddress,readSpiCommand,i*packet_size+startAddress,packet_size
			temp = spi_Interact(mode,speed,packet)
			case temp
				when HardsploitAPI::USB_STATE::PACKET_IS_TOO_LARGE
					puts "PACKET_IS_TOO_LARGE max: #{HardsploitAPI::USB::USB_TRAME_SIZE}"
				when HardsploitAPI::USB_STATE::ERROR_SEND
					puts "ERROR_SEND\n"
				when HardsploitAPI::USB_STATE::BUSY
					puts "BUSY"
				when HardsploitAPI::USB_STATE::TIMEOUT_RECEIVE
					puts "TIMEOUT_RECEIVE\n"
				else
					#Remove header, result of read command and numberOfByte Address too
					#puts "receive real size #{temp.size}"
					consoleData temp.drop(numberOfByteAddress+1)
			end
			consoleProgress(percent:100*(i+1)/(number_complet_packet+ (size_last_packet.zero? ? 0 : 1)),startTime:startTime,endTime:Time.new)
		end

	if(size_last_packet > 0 )then
			packet = generate_spi_read_command numberOfByteAddress,readSpiCommand,number_complet_packet*packet_size+startAddress,size_last_packet
			temp = spi_Interact(mode,speed,packet)
			case temp
				when HardsploitAPI::USB_STATE::PACKET_IS_TOO_LARGE
					puts "PACKET_IS_TOO_LARGE max: #{HardsploitAPI::USB::USB_TRAME_SIZE}"
				when HardsploitAPI::USB_STATE::ERROR_SEND
					puts "ERROR_SEND\n"
				when HardsploitAPI::USB_STATE::BUSY
					puts "BUSY"
				when HardsploitAPI::USB_STATE::TIMEOUT_RECEIVE
					puts "TIMEOUT_RECEIVE\n"
				else
					#Remove header, result of read command and numberOfByte Address too
					#puts "receive real size #{temp.size}"
					consoleData temp.drop(numberOfByteAddress+1)
					consoleProgress(percent:100,startTime:startTime,endTime:Time.now)
				end
		end
		delta = Time.now - startTime
		consoleSpeed "Write in #{delta.round(4)} sec"
end

#spi_Generic_Import(*args) ⇒ Object

Spi generic Import

  • mode

    SPI mode 0,1,2,3

  • speed

    Range 1-255 SPI clock = 150Mhz / (2*speed) tested from 3 to 255 (25Mhz to about 0.3Khz)

  • writeSpiCommand

    The write command

  • startAddress

    Start address (included)

  • pageSize

    Size of page

  • memorySize

    Size max of memory in byte (important, to calculate automatically the number of byte to set address)

  • saveFile

    File contain data

  • writePageLatency

    Time to wait after each pages written

  • enableWriteSpiCommand

    Enable write commad

  • clearSpiCommand

    Bulk erase command

  • clearChipTime

    Time to erase entire the memory (bulk erase) in case of flash memory, 240 seconds for a 512Mb spansion memory and 13 seconds for a 16Mb Micron memory, see the datasheet

  • isFLASH

    True if it is a Flash memory (add clear content)



74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
 
# File 'lib/HardsploitAPI/HardsploitAPI_SPI.rb', line 74

def spi_Generic_Import (*args)
		parametters = HardsploitAPI.checkParametters(["mode","speed","startAddress","pageSize","memorySize","dataFile","writeSpiCommand","writePageLatency","enableWriteSpiCommand","clearSpiCommand","clearChipTime","isFLASH"],args)
		mode = parametters[:mode]
		speed = parametters[:speed]
		startAddress = parametters[:startAddress]
		pageSize = parametters[:pageSize]
		memorySize = parametters[:memorySize]
		dataFile = parametters[:dataFile]
		writePageLatency = parametters[:writePageLatency]

		#most of the time 0x02
		writeSpiCommand = parametters[:writeSpiCommand]
		writeSpiCommand
		#most of the time 0x06
		enableWriteSpiCommand = parametters[:enableWriteSpiCommand]

		#most of the time 0x60  chip eraseTime
		clearSpiCommand = parametters[:clearWriteSpiCommand]

		# in second
		clearChipTime = parametters[:clearChipTime]

		#if flash memory
		isFLASH = parametters[:isEEPROM]

		#Start time
		startTime = Time.now
		begin
			file =	File.open(dataFile, 'rb')
			sizeFile = file.size
		rescue Exception => e
			raise Error::FileIssue, e.message
		end

		if (mode < 0)  and (mode >3) then
			raise TypeError, 'Mode must be between 0 and 3'
		end
		if (speed <= 2)  and (speed >256) then
			raise TypeError, 'Speed must be between 3 and 255'
		end

		if ((startAddress < 0)  or (startAddress > memorySize-1)) then
			raise Error::WrongStartAddress
		end

		if ((pageSize <= 0) and (pageSize >2048)) then
			raise TypeError, "pageSize need to be greater than 0 and less than 2048"
		end

		numberOfByteAddress = (((Math.log(memorySize-1,2)).floor + 1) / 8.0).ceil
		if numberOfByteAddress > 4 then
			raise TypeError, "Size max must be less than 2^32 about 4Gb"
		end

		if numberOfByteAddress <= 0 then
			raise TypeError, "There is an issue with calculating of number of byte needed"
		end

		#if flash memory we need to erase it before and wait enought
		#time (erase cycle time in datasheet) or polling status register
		if isFLASH then
		  spi_Interact(mode:mode,speed:speed,payload:[clearSpiCommand])
			sleep(clearChipTime)
		end

		startTime = Time.now
		packet_size = pageSize
		number_complet_packet = (sizeFile / packet_size).floor
		size_last_packet =  sizeFile % packet_size

		#SEND the first complete trame
		for i in 0..number_complet_packet-1 do
			#Enable write latch
			spi_Interact(mode:mode,speed:speed,payload:[enableWriteSpiCommand])
			packet = generate_spi_write_command numberOfByteAddress,writeSpiCommand,i*packet_size+startAddress,file.read(packet_size).unpack("C*")
		  temp = spi_Interact(mode,speed,packet)
			case temp
				when HardsploitAPI::USB_STATE::PACKET_IS_TOO_LARGE
					puts "PACKET_IS_TOO_LARGE max: #{HardsploitAPI::USB::USB_TRAME_SIZE}"
				when HardsploitAPI::USB_STATE::ERROR_SEND
					puts "ERROR_SEND\n"
				when HardsploitAPI::USB_STATE::BUSY
					puts "BUSY"
				when HardsploitAPI::USB_STATE::TIMEOUT_RECEIVE
					puts "TIMEOUT_RECEIVE\n"
				else
					#Remove header, result of read command and numberOfByte Address too
					#consoleData temp.drop(numberOfByteAddress+1)
					if packet.size != packet.size then
						raise HardsploitAPI::SpiError
					end
			end

			consoleProgress(percent:100*(i+1)/(number_complet_packet+ (size_last_packet.zero? ? 0 : 1)),startTime:startTime,endTime:Time.new)
			#if too many error when write increase because we need to wait to write a full page
			sleep(writePageLatency)
		end

		if(size_last_packet > 0 )then
			#Enable write latch
			spi_Interact(mode:mode,speed:speed,payload:[enableWriteSpiCommand])
			packet = generate_spi_write_command numberOfByteAddress,writeSpiCommand,number_complet_packet*packet_size+startAddress,file.read(size_last_packet).unpack("C*")
			temp = spi_Interact(mode,speed,packet)
			case temp
				when HardsploitAPI::USB_STATE::PACKET_IS_TOO_LARGE
					puts "PACKET_IS_TOO_LARGE max: #{HardsploitAPI::USB::USB_TRAME_SIZE}"
				when HardsploitAPI::USB_STATE::ERROR_SEND
					puts "ERROR_SEND\n"
				when HardsploitAPI::USB_STATE::BUSY
					puts "BUSY"
				when HardsploitAPI::USB_STATE::TIMEOUT_RECEIVE
					puts "TIMEOUT_RECEIVE\n"
				else
					#Remove header, result of write command and numberOfByte Address too
					#consoleData temp.drop(numberOfByteAddress+1)
					if packet.size != packet.size then
						raise HardsploitAPI::SpiError
					end
			end
			#Send 100% in case of last packet
			consoleProgress(percent:100,startTime:startTime,endTime:Time.now)
		end
		delta = Time.now - startTime
		consoleSpeed "Write in #{delta.round(4)} sec"
end

#spi_Interact(*args) ⇒ Object

SPI interact

  • mode

    SPI mode 0,1,2,3

  • speed

    Range 1-255 SPI clock = 150Mhz / (2*speed) tested from 3 to 255 (25Mhz to about 0.3Khz)

  • payload

    Byte array want to send

  • Return SPI data received



17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
 
# File 'lib/HardsploitAPI/HardsploitAPI_SPI.rb', line 17

def spi_Interact(*args)
	parametters = HardsploitAPI.checkParametters(["mode","speed","payload"],args)
	mode = parametters[:mode]
	speed = parametters[:speed]
	payload = parametters[:payload]

	if (mode < 0)  and (mode >3) then
		raise TypeError, 'Mode must be between 0 and 3'
	end
	if (speed <= 2)  and (speed >256) then
		raise TypeError, 'Speed must be between 3 and 255'
	end

	if (payload.size > 4000) then
		raise TypeError, 'Size of the data need to be less than 4000'
	end

	packet = Array.new
	packet.push 0  #low byte of lenght of trame refresh automaticly before send by usb
	packet.push 0  #high byte of lenght of trame refresh automaticly before send by usb
	packet.push HardsploitAPI.lowByte(USB_COMMAND::FPGA_COMMAND)
	packet.push HardsploitAPI.highByte(USB_COMMAND::FPGA_COMMAND)

	packet.push 0x50 #Command RAW COMMUNICATION TO FPGA FIFO

	packet.push mode #Add mode
	packet.push speed #Add speed
	packet.concat payload #Add data

	sendPacket packet

	tmp= receiveDATA(1000)
	case tmp
		when HardsploitAPI::USB_STATE::BUSY
			return USB_STATE::BUSY
		when HardsploitAPI::USB_STATE::TIMEOUT_RECEIVE
			return USB_STATE::TIMEOUT_RECEIVE
		else
			#remove header (4 bytes   2 for size 2 for type of command)
			return tmp.bytes.drop(4)
	end
end

#startFPGA ⇒ Object 



34
35
36
37
38
39
40
41
 
# File 'lib/HardsploitAPI/HardsploitAPI_FIRMWARE.rb', line 34

def startFPGA
	packet = Array.new
	packet.push HardsploitAPI.lowByte(4)
	packet.push HardsploitAPI.highByte(4)
	packet.push HardsploitAPI.lowByte(USB_COMMAND::START_FPGA)
	packet.push HardsploitAPI.highByte(USB_COMMAND::START_FPGA)
	self.sendPacket(packet)
end

#stopFPGA ⇒ Object 



42
43
44
45
46
47
48
49
 
# File 'lib/HardsploitAPI/HardsploitAPI_FIRMWARE.rb', line 42

def stopFPGA
	packet = Array.new
	packet.push HardsploitAPI.lowByte(4)
	packet.push HardsploitAPI.highByte(4)
	packet.push HardsploitAPI.lowByte(USB_COMMAND::STOP_FPGA)
	packet.push HardsploitAPI.highByte(USB_COMMAND::STOP_FPGA)
	self.sendPacket(packet)
end

#test_InteractRead ⇒ Object

return [Integer] 64bits



60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
 
# File 'lib/HardsploitAPI/HardsploitAPI_TEST_INTERACT.rb', line 60

def test_InteractRead
	packet = Array.new
	packet.push 0  #low byte of lenght of trame refresh automaticly before send by usb
	packet.push 0  #high byte of lenght of trame refresh automaticly before send by usb
	packet.push HardsploitAPI.lowByte(USB_COMMAND::FPGA_COMMAND)
	packet.push HardsploitAPI.highByte(USB_COMMAND::FPGA_COMMAND)

	##packet.push 0x50 #Command RAW COMMUNICATION TO FPGA FIFO
  packet.push 0x50

	#Read mode
	packet.push 0xCD

 packet.push 0xA1
 packet.push 0xA2
 packet.push 0xA3
 packet.push 0xA4
 packet.push 0xA5
 packet.push 0xA6
 packet.push 0xA7
   packet.push 0xA8


	sendPacket packet

	tmp= receiveDATA(1000)
	case tmp
		when HardsploitAPI::USB_STATE::BUSY
			return USB_STATE::BUSY
		when HardsploitAPI::USB_STATE::TIMEOUT_RECEIVE
			puts "TIMEOUT"
		#	raise "test_InteractRead Timeout"
		else
			#remove header (4 bytes   2 for size 2 for type of command)
			tmp = tmp.bytes.drop(4)
			return  0 |  (tmp[0] << 0) |  (tmp[1] << 8) 	 |  (tmp[2] << 16)  |  (tmp[3] << 24) |  (tmp[4] << 32) |  (tmp[5] << 40)  |  (tmp[6] << 48)  | (tmp[7] << 56)
	end
end

#test_InteractWrite(*args) ⇒ Object

Write value of 64 IO for testing purpose

  • value

    64bits to write on all ports

return [Integer] Return the value sent (lookback) (64bits)



15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
 
# File 'lib/HardsploitAPI/HardsploitAPI_TEST_INTERACT.rb', line 15

def test_InteractWrite(*args)
	parametters = HardsploitAPI.checkParametters(["value"],args)
	val = parametters[:value]

	packet = Array.new
	packet.push 0  #low byte of lenght of trame refresh automaticly before send by usb
	packet.push 0  #high byte of lenght of trame refresh automaticly before send by usb
	packet.push HardsploitAPI.lowByte(USB_COMMAND::FPGA_COMMAND)
	packet.push HardsploitAPI.highByte(USB_COMMAND::FPGA_COMMAND)

	#Command RAW COMMUNICATION TO FPGA FIFO
	packet.push 0x50

	#Write mode
	packet.push 0xEF

	packet.push  ((val & 0x00000000000000FF) >> 0)
	packet.push  ((val & 0x000000000000FF00) >> 8 )
	packet.push  ((val & 0x0000000000FF0000) >> 16 )
	packet.push  ((val & 0x00000000FF000000) >> 24 )
	packet.push  ((val & 0x000000FF00000000) >> 32 )
	packet.push  ((val & 0x0000FF0000000000) >> 40 )
	packet.push  ((val & 0x00FF000000000000) >> 48 )
	packet.push  ((val & 0xFF00000000000000) >> 56 )

	sendPacket packet

	tmp= receiveDATA(1000)
	case tmp
		when HardsploitAPI::USB_STATE::BUSY
			return USB_STATE::BUSY
		when HardsploitAPI::USB_STATE::TIMEOUT_RECEIVE
			return USB_STATE::TIMEOUT_RECEIVE
		else
			#remove header (4 bytes   2 for size 2 for type of command)
			tmp = tmp.bytes.drop(4)

			return  0 |  (tmp[0] << 0) |  (tmp[1] << 8) 	 |  (tmp[2] << 16)  |  (tmp[3] << 24) |  (tmp[4] << 32) |  (tmp[5] << 40)  |  (tmp[6] << 48)  | (tmp[7] << 56)
	end
end

#unlockBlock(blockAddress) ⇒ Object 



65
66
67
68
69
 
# File 'lib/HardsploitAPI/HardsploitAPI_NO_MUX_PARALLELE_MEMORY.rb', line 65

def unlockBlock (blockAddress)
	write_command_Memory_WithoutMultiplexing(blockAddress,0x0060) #Lock Block Command
	write_command_Memory_WithoutMultiplexing(blockAddress,0x00D0) #UnLock  Command
	return readByteFromMemory(0x000000) #read statut register
end

#uploadFirmware(*args) ⇒ Object

Wait to receive data

  • pathFirmware

    path of rpd file (vhdl)

  • checkFirmware

    boolean if check is needed (recommended false, in case issue true to check)

Return true if firmware write == firmware read (slow because read the firmware for check)



16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
 
# File 'lib/HardsploitAPI/HardsploitAPI_FIRMWARE.rb', line 16

def uploadFirmware(*args)
	parametters = HardsploitAPI.checkParametters(["pathFirmware","checkFirmware"],args)
	pathFirmware = parametters[:pathFirmware]
	checkFirmware = parametters[:checkFirmware]

	stopFPGA
	eraseFirmware
	firmwarewrite = self.writeFirmware(pathFirmware)#return array of bytes write
	if checkFirmware == true then
		firmwareRead = self.readFirmware(firmwarewrite.length) #return array of bytes read
		startFPGA
		return (firmwarewrite == firmwareRead)
	else
		startFPGA
		return true
	end
end

#write_command_Memory_WithoutMultiplexing(address, data) ⇒ Object 



71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
 
# File 'lib/HardsploitAPI/HardsploitAPI_NO_MUX_PARALLELE_MEMORY.rb', line 71

def write_command_Memory_WithoutMultiplexing(address,data)
	packet = Array.new
	packet.push 0  #low byte of lenght of trame refresh automaticly before send by usb
	packet.push 0  #high byte of lenght of trame refresh automaticly before send by usb
	packet.push HardsploitAPI.lowByte(USB_COMMAND::FPGA_COMMAND)
	packet.push HardsploitAPI.highByte(USB_COMMAND::FPGA_COMMAND)

	packet.push 0x50 #Command RAW COMMUNICATION TO FPGA FIFO

	packet.push	0 #16 bits
	packet.push (1500/6.66).floor  #latency at 1500ns

	packet.push  ((address & 0xFF000000) >> 24 ) #AddStart3
	packet.push  ((address & 0x00FF0000) >> 16 ) #AddStart2
	packet.push  ((address & 0x0000FF00) >> 8 )  #AddStart1
	packet.push  ((address & 0x000000FF) >> 0)   #AddStart0
	packet.push 0x20 #Memory write command
	packet.push  ((data & 0xFF00) >> 8 )  #Data HIGHT BYTE
	packet.push  ((data & 0xFF) >> 0)  #Data LOW BYTE


	result = sendAndReceiveDATA(packet,1000)
	 if result == USB_STATE::TIMEOUT_RECEIVE then
	 	raise "TIMEOUT"
	elsif result[4] == (data & 0xFF)

	 	return readByteFromMemory(0)
	else
	 	raise "ERROR BAD RESPONSE"
	 end
end

#writeBlockAP(data) ⇒ Object 



119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
 
# File 'lib/HardsploitAPI/SWD/HardsploitAPI_SWD.rb', line 119

def writeBlockAP(data)
	if data.size > 8000 then
		raise "data is too big > 8000"
	end

	packet = Array.new
	packet.push 0  #low byte of lenght of trame refresh automaticly before send by usb
	packet.push 0  #high byte of lenght of trame refresh automaticly before send by usb
	packet.push HardsploitAPI.lowByte(HardsploitAPI::USB_COMMAND::FPGA_COMMAND)
	packet.push HardsploitAPI.highByte(HardsploitAPI::USB_COMMAND::FPGA_COMMAND)

	packet.push 0x50 #Command RAW COMMUNICATION TO FPGA FIFO
	packet.push 0xBB #Write ap
	packet.push *data

	result = sendAndReceiveDATA(packet,1000)
	if result.class == Array then
			if result.size == 1 + 4 then #receive ACK
				if result[4] == 1 then
						return true
				elsif result[4] == 2 then
						raise "WAIT response"
				elsif result[4] == 4 then
					  raise "FAULT response"
				else
						raise "WRITE ERROR #{result[4]}"
				end
			else
				raise "Error during writing"
			end
	else # Receive and error
		raise "Error during writing, timeout "
	end
		return false
end

#writeByteToMemory(address, value) ⇒ Object 



23
24
25
26
27
28
 
# File 'lib/HardsploitAPI/HardsploitAPI_NO_MUX_PARALLELE_MEMORY.rb', line 23

def writeByteToMemory(address,value)
	#Write data in word mode  and read Five status register
	write_command_Memory_WithoutMultiplexing(address,0x0040)
	write_command_Memory_WithoutMultiplexing(address,value)
	return readByteFromMemory(0)
end

#writeFlash(path) ⇒ Object 



36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
 
# File 'lib/HardsploitAPI/SWD/HardsploitAPI_SWD.rb', line 36

def writeFlash(path)
	resetSWD()
	dataWrite = IO.binread(path)
  dataWrite = dataWrite.unpack("C*")
	puts "Halting Processor"
	stm32.halt()
	puts "Erasing Flash"
	stm32.flashUnlock()
	stm32.flashErase()
	puts "Programming Flash"
	stm32.flashProgram()
	time = Time.new
	stm32.flashWrite(0x08000000, dataWrite)
	time = Time.new - time
	puts "Write #{((dataWrite.size/time)).round(2)}Bytes/s #{(dataWrite.size)}Bytes in  #{time.round(4)} s"
	stm32.flashProgramEnd()
	puts "Resetting"
	stm32.sysReset()
	puts "Start"
	stm32.unhalt
end

#writeSWD(ap, register, data) ⇒ Object 



78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
 
# File 'lib/HardsploitAPI/SWD/HardsploitAPI_SWD.rb', line 78

def writeSWD(ap,register,data)
	packet = Array.new
	packet.push 0  #low byte of lenght of trame refresh automaticly before send by usb
	packet.push 0  #high byte of lenght of trame refresh automaticly before send by usb
	packet.push HardsploitAPI.lowByte(HardsploitAPI::USB_COMMAND::FPGA_COMMAND)
	packet.push HardsploitAPI.highByte(HardsploitAPI::USB_COMMAND::FPGA_COMMAND)

	packet.push 0x50 #Command RAW COMMUNICATION TO FPGA FIFO

	packet.push 0x10 #Write mode

	packet.push (calcOpcode(ap, register, false)) #Send Request

	packet.push  ((data & 0xFF) >> 0)
	packet.push  ((data & 0xFF00) >> 8 )
	packet.push  ((data & 0xFF0000) >> 16 )
	packet.push  ((data & 0xFF000000) >> 24 )

	result = sendAndReceiveDATA(packet,1000)

	if result.class == Array then
			if result.size == 1 + 4 then #receive ACK
				if result[4] == 1 then
						return true
				elsif result[4] == 2 then
						raise "WAIT response"
				elsif result[4] == 4 then
					  raise "FAULT response"
				else
						raise "WRITE ERROR #{result[4]}"
				end
			else
				raise "Error during writing}"
			end
	else # Receive and error
		raise "Error during writing, timeout "
	end

	return false
end