Class: HardsploitAPI_SWD

Inherits:
Object
  • Object
show all
Defined in:
lib/HardsploitAPI/Modules/SWD/HardsploitAPI_SWD.rb

Constant Summary collapse

DCRDR =

attr_accessor :stm32

0xE000EDF8
DCRSR =

address of Debug Core Register Data Register

0xE000EDF4

Instance Method Summary collapse

Constructor Details

#initialize(memory_start_address:, memory_size_address:, cpu_id_address:, device_id_address:) ⇒ HardsploitAPI_SWD

address of Debug Core Register Selector Register



18
19
20
21
22
23
24
 
# File 'lib/HardsploitAPI/Modules/SWD/HardsploitAPI_SWD.rb', line 18

def initialize(memory_start_address:, memory_size_address:, cpu_id_address:, device_id_address:)
	HardsploitAPI.instance.connect
	@memory_start_address = memory_start_address.hex
	@memory_size_address  = memory_size_address.hex
	@cpu_id_address 	  	= cpu_id_address.hex
	@device_id_address 	  = device_id_address.hex
end

Instance Method Details

#calcOpcode(ap, register, read) ⇒ Object 



358
359
360
361
362
363
364
365
366
 
# File 'lib/HardsploitAPI/Modules/SWD/HardsploitAPI_SWD.rb', line 358

def calcOpcode (ap, register, read)
	opcode = 0x00
	(ap ? opcode |= 0x40 : opcode |= 0x00)
	(read ? opcode |= 0x20 : opcode |= 0x00)
	opcode = opcode | ((register & 0x01) << 4) | ((register & 0x02) << 2) #Addr AP DP  bit 2..3
	opcode = opcode | (((opcode & 0x78).to_s(2).count('1').odd? ? 1 : 0) << 2)  #0x78 mask to take only read ap and register to process parity bit
	opcode = opcode | 0x81 #Start and Park Bit
	return opcode
end

#dumpFlash(path) ⇒ Object 



131
132
133
134
135
136
137
138
139
140
141
142
143
 
# File 'lib/HardsploitAPI/Modules/SWD/HardsploitAPI_SWD.rb', line 131

def dumpFlash(path)
	obtainCodes
	@stm32.halt
  flash_size = (@stm32.ahb.readWord(@memory_size_address) & 0xFFFF)
	HardsploitAPI.instance.consoleInfo "Flash size : #{(flash_size)} KB"
	HardsploitAPI.instance.consoleInfo "Dump flash"
    time = Time.new
	data = @stm32.flashRead(@memory_start_address, (flash_size * 1024))
	time = Time.new - time
	HardsploitAPI.instance.consoleSpeed "DUMP #{((data.size/time)).round(2)}Bytes/s #{(data.size)}Bytes in  #{time.round(4)} s"
	IO.binwrite(path, data.pack('C*'))
	HardsploitAPI.instance.consoleInfo "Finish dump"
end

#eraseFlash ⇒ Object 



125
126
127
128
129
 
# File 'lib/HardsploitAPI/Modules/SWD/HardsploitAPI_SWD.rb', line 125

def eraseFlash
	obtainCodes
	HardsploitAPI.instance.consoleInfo 'Erase'
	@stm32.flashErase
end

#find(numberOfConnectedPinFromA0:) ⇒ Object 



79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
 
# File 'lib/HardsploitAPI/Modules/SWD/HardsploitAPI_SWD.rb', line 79

def find(numberOfConnectedPinFromA0:)
	posibility = HardsploitAPI.allPosibility(
		numberOfConnectedPinFromA0: numberOfConnectedPinFromA0,
		numberOfSignalsForBus: 2
	)
	for item in posibility
		currentWiring = 0
		for value in item
			currentWiring += 2 ** value
		end
		HardsploitAPI.instance.setWiringLeds(value: currentWiring)
		for i in 0..(63 - item.size)
			item.push i + numberOfConnectedPinFromA0
		end
		HardsploitAPI.instance.setCrossWiring(value: item)
	begin
	  	code =  obtainCodes
			return item
	  rescue Exception => msg
	  		puts msg
	  end
	end
end

#obtainCodes ⇒ Object 



58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
 
# File 'lib/HardsploitAPI/Modules/SWD/HardsploitAPI_SWD.rb', line 58

def obtainCodes
	@debugPort = SWD_DEBUG_PORT.new(self)
	@stm32     = SWD_STM32.new(@debugPort)
	#  Cortex M4 0x410FC241
	#  Cortex M3 0x411FC231
	resetSWD
	# code = {
	#   :DebugPortId  => @debugPort.idcode,
	#   :AccessPortId => @stm32.ahb.idcode,
	#   :CpuId 				=> @stm32.ahb.readWord(@cpu_id_address),
	# 	:DeviceId 		=> @stm32.ahb.readWord(@device_id_address)
	# }

	code = {
		:DebugPortId  => @debugPort.idcode,
		:AccessPortId => @stm32.ahb.idcode,
	  :CpuId 				=> @stm32.ahb.readWord(@cpu_id_address)
	}
	return code
end

#read_mem32(address, size) ⇒ Object

Raises:



175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
 
# File 'lib/HardsploitAPI/Modules/SWD/HardsploitAPI_SWD.rb', line 175

def read_mem32(address,size)
	packet = HardsploitAPI.prepare_packet
	packet.push 0xAA #Read mode
	packet.push HardsploitAPI.lowByte(word: size)
	packet.push HardsploitAPI.highByte(word: size)
	packet.push ((address & 0xFF) >> 0)
	packet.push ((address & 0xFF00) >> 8 )
	packet.push ((address & 0xFF0000) >> 16 )
	packet.push ((address & 0xFF000000) >> 24 )

	# --[2:0]	Size
	# 	--Size of access field:
	# 	--b000 = 8 bits
	# 	--b001 = 16 bits
	# 	--b010 = 32 bits
	# 	--b011-111 are reserved.
	# 	--Reset value: b000
	#
	# 	--[5:4]	AddrInc
	# 	--0b00 = auto increment off.
	# 	--0b01 = increment single. Single transfer from corresponding byte lane.
	# 	--0b10 = increment packed.[b]
	# 	--0b11 = reserved. No transfer.
	# 	--Size of address increment is defined by the Size field [2:0].
	# 	--Reset value: 0b00.
	packet.push 0b00010010 # single 32 bits auto increment

	result = HardsploitAPI.instance.sendAndReceiveDATA(packet, 1000)
	raise HardsploitAPI::ERROR::SWD_ERROR,"Error during reading  timeout or ACK issue" unless result.class == Array
	raise HardsploitAPI::ERROR::SWD_ERROR,"We need to receive #{size +4 } and we received #{result.size}"	 unless (result.size-4)/4 == size # Receive all data
	return result.drop(4)
end

#read_mem8(address, size) ⇒ Object

Raises:



144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
 
# File 'lib/HardsploitAPI/Modules/SWD/HardsploitAPI_SWD.rb', line 144

def read_mem8(address,size)
	packet = HardsploitAPI.prepare_packet
	packet.push 0xAA #Read mode
	packet.push HardsploitAPI.lowByte(word: size)
	packet.push HardsploitAPI.highByte(word: size)
	packet.push ((address & 0xFF) >> 0)
	packet.push ((address & 0xFF00) >> 8 )
	packet.push ((address & 0xFF0000) >> 16 )
	packet.push ((address & 0xFF000000) >> 24 )

	# --[2:0]	Size
	# 	--Size of access field:
	# 	--b000 = 8 bits
	# 	--b001 = 16 bits
	# 	--b010 = 32 bits
	# 	--b011-111 are reserved.
	# 	--Reset value: b000
	#
	# 	--[5:4]	AddrInc
	# 	--0b00 = auto increment off.
	# 	--0b01 = increment single. Single transfer from corresponding byte lane.
	# 	--0b10 = increment packed.[b]
	# 	--0b11 = reserved. No transfer.
	# 	--Size of address increment is defined by the Size field [2:0].
	# 	--Reset value: 0b00.
	packet.push 0b00010000 # single 8 bits auto increment
	result = HardsploitAPI.instance.sendAndReceiveDATA(packet, 1000)
	raise HardsploitAPI::ERROR::SWD_ERROR,"Error during reading  timeout or ACK issue" unless result.class == Array
	#raise HardsploitAPI::ERROR::SWD_ERROR,"We need to receive #{size  } and we received #{result.size-4}"	 unless (result.size-4) == size # Receive all data
	return result.drop(4)
end

#readRegs ⇒ Object 



26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
 
# File 'lib/HardsploitAPI/Modules/SWD/HardsploitAPI_SWD.rb', line 26

def readRegs
	#halt the target before read register
	stop

	@stm32.ahb.csw(1,2)

	p read_mem8(0x1FFFF7E0,2)
	#p @stm32.ahb.readWord(@memory_size_address).to_s(16)
	for i in 0..36
		#Write DCRSR address into TAR register
		#Write core register index Rn into DRW register.
		write_mem32( DCRSR,[i,0,0,0])
		#@stm32.ahb.writeWord( DCRSR,i)

		#Write DCRDR address into TAR register.
		#Read core register value from DRW register.
		#value = @stm32.ahb.readWord( DCRDR)
		result = read_mem32(DCRDR,1)
		value = result[0] + (result[1] << 8) + (result[2] << 16) + (result[3] << 24)
		puts "R#{i} #{value.to_s(16)}"
	end
end

#readSWD(ap, register) ⇒ Object

Raises:



334
335
336
337
338
339
340
341
342
343
 
# File 'lib/HardsploitAPI/Modules/SWD/HardsploitAPI_SWD.rb', line 334

def readSWD(ap, register)
	packet = HardsploitAPI.prepare_packet
	packet.push 0x11 #Read mode
	packet.push(calcOpcode(ap,register, true)) #Send Request
	result = HardsploitAPI.instance.sendAndReceiveDATA(packet, 1000)
	raise HardsploitAPI::ERROR::SWD_ERROR,"Error during reading  timeout" 			 unless result.class == Array
	raise HardsploitAPI::ERROR::SWD_ERROR,"Read error ACK : #{result[4]}" 			 if result.size == 5 # Receive ACK
	return (result[7] << 24) + (result[6] << 16) + (result[5] << 8 ) + result[4] if result.size == 8 # Receive read + 4bytes for header
	raise HardsploitAPI::ERROR::SWD_ERROR,"Error during reading"
end

#resetSWD ⇒ Object

Return array with 1 byte for ACK Return 32bits integer for data read here is Core ID Raise if error

Raises:



348
349
350
351
352
353
354
355
356
 
# File 'lib/HardsploitAPI/Modules/SWD/HardsploitAPI_SWD.rb', line 348

def resetSWD
	packet = HardsploitAPI.prepare_packet
	packet.push 0x00 #Reset mode
	result = HardsploitAPI.instance.sendAndReceiveDATA(packet, 1000)
	raise HardsploitAPI::ERROR::SWD_ERROR,"Error during reading ICCODE timeout"  unless result.class == Array
	return (result[7] << 24) + (result[6] << 16) + (result[5] << 8 ) + result[4] if result.size == 8
	raise HardsploitAPI::ERROR::SWD_ERROR,"Reset error ACK #{result[4]}" 				 if result.size == 5 #reveice ACK
	raise HardsploitAPI::ERROR::SWD_ERROR,"Error during reading ICCODE result != 4"
end

#start ⇒ Object 



54
55
56
57
 
# File 'lib/HardsploitAPI/Modules/SWD/HardsploitAPI_SWD.rb', line 54

def start
	# start the processor core
	write_mem32(0xE000EDF0,[0x00,0x00,0x5F,0xA0])
end

#stop ⇒ Object 



49
50
51
52
 
# File 'lib/HardsploitAPI/Modules/SWD/HardsploitAPI_SWD.rb', line 49

def stop
	# halt the processor core
	write_mem32(0xE000EDF0,[0x03,0x00,0x5F,0xA0])
end

#write_mem16Packed(address, data) ⇒ Object

Raises:



281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
 
# File 'lib/HardsploitAPI/Modules/SWD/HardsploitAPI_SWD.rb', line 281

def write_mem16Packed(address,data)
	raise "Too many data (> 2000)" if data.size > 2000
	packet = HardsploitAPI.prepare_packet
	packet.push 0xBB #Write ap
	packet.push ((address & 0xFF) >> 0)
	packet.push ((address & 0xFF00) >> 8 )
	packet.push ((address & 0xFF0000) >> 16 )
	packet.push ((address & 0xFF000000) >> 24 )

	# --[2:0]	Size
	# 	--Size of access field:
	# 	--b000 = 8 bits
	# 	--b001 = 16 bits
	# 	--b010 = 32 bits
	# 	--b011-111 are reserved.
	# 	--Reset value: b000
	#
	# 	--[5:4]	AddrInc
 	    # 	--0b00 = auto increment off.
	# 	--0b01 = increment single. Single transfer from corresponding byte lane.
	# 	--0b10 = increment packed.[b]
	# 	--0b11 = reserved. No transfer.
	# 	--Size of address increment is defined by the Size field [2:0].
	# 	--Reset value: 0b00.
	packet.push 0b00100001 # packet 16 bits auto increment neeed to write in flash

	packet.push *data
	result = HardsploitAPI.instance.sendAndReceiveDATA(packet, 1000)
	raise HardsploitAPI::ERROR::SWD_ERROR,"Error during writing, timeout" unless result.class == Array
	raise HardsploitAPI::ERROR::SWD_ERROR,"Error during writing" 					unless result.size == 5
	return true 																													if result[4] == 1
	raise HardsploitAPI::ERROR::SWD_ERROR,"WAIT response" 								if result[4] == 2
	raise HardsploitAPI::ERROR::SWD_ERROR,"FAULT response" 								if result[4] == 4
	raise HardsploitAPI::ERROR::SWD_ERROR,"WRITE ERROR #{result[4]}"
end

#write_mem32(address, data) ⇒ Object

Raises:



207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
 
# File 'lib/HardsploitAPI/Modules/SWD/HardsploitAPI_SWD.rb', line 207

def write_mem32(address,data)
	raise "Too many data (> 2000)" if data.size > 2000
	packet = HardsploitAPI.prepare_packet
	packet.push 0xBB #Write ap
	packet.push ((address & 0xFF) >> 0)
	packet.push ((address & 0xFF00) >> 8 )
	packet.push ((address & 0xFF0000) >> 16 )
	packet.push ((address & 0xFF000000) >> 24 )

	# --[2:0]	Size
	# 	--Size of access field:
	# 	--b000 = 8 bits
	# 	--b001 = 16 bits
	# 	--b010 = 32 bits
	# 	--b011-111 are reserved.
	# 	--Reset value: b000
	#
	# 	--[5:4]	AddrInc
 	# 	--0b00 = auto increment off.
	# 	--0b01 = increment single. Single transfer from corresponding byte lane.
	# 	--0b10 = increment packed.[b]
	# 	--0b11 = reserved. No transfer.
	# 	--Size of address increment is defined by the Size field [2:0].
	# 	--Reset value: 0b00.
	packet.push 0b00010010 # single 32 bits auto increment neeed to write in flash

	packet.push *data
	result = HardsploitAPI.instance.sendAndReceiveDATA(packet, 1000)
	raise HardsploitAPI::ERROR::SWD_ERROR,"Error during writing, timeout" unless result.class == Array
	raise HardsploitAPI::ERROR::SWD_ERROR,"Error during writing" 					unless result.size == 5
	return true 																													if result[4] == 1
	raise HardsploitAPI::ERROR::SWD_ERROR,"WAIT response" 								if result[4] == 2
	raise HardsploitAPI::ERROR::SWD_ERROR,"FAULT response" 								if result[4] == 4
	raise HardsploitAPI::ERROR::SWD_ERROR,"WRITE ERROR #{result[4]}"
end

#write_mem8(address, data) ⇒ Object

Raises:



243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
 
# File 'lib/HardsploitAPI/Modules/SWD/HardsploitAPI_SWD.rb', line 243

def write_mem8(address,data)
	raise "Too many data (> 2000)" if data.size > 2000
	packet = HardsploitAPI.prepare_packet
	packet.push 0xBB #Write ap
	packet.push ((address & 0xFF) >> 0)
	packet.push ((address & 0xFF00) >> 8 )
	packet.push ((address & 0xFF0000) >> 16 )
	packet.push ((address & 0xFF000000) >> 24 )

	# --[2:0]	Size
	# 	--Size of access field:
	# 	--b000 = 8 bits
	# 	--b001 = 16 bits
	# 	--b010 = 32 bits
	# 	--b011-111 are reserved.
	# 	--Reset value: b000
	#
	# 	--[5:4]	AddrInc
			# 	--0b00 = auto increment off.
	# 	--0b01 = increment single. Single transfer from corresponding byte lane.
	# 	--0b10 = increment packed.[b]
	# 	--0b11 = reserved. No transfer.
	# 	--Size of address increment is defined by the Size field [2:0].
	# 	--Reset value: 0b00.
	packet.push 0b00010000 # single 8 bits auto increment neeed to write in flash
	packet.push *data

	packet.push 0 #Dummy need to be improve in VHDL

	result = HardsploitAPI.instance.sendAndReceiveDATA(packet, 1000)
	raise HardsploitAPI::ERROR::SWD_ERROR,"Error during writing, timeout" unless result.class == Array
	raise HardsploitAPI::ERROR::SWD_ERROR,"Error during writing" 					unless result.size == 5
	return true 																													if result[4] == 1
	raise HardsploitAPI::ERROR::SWD_ERROR,"WAIT response" 								if result[4] == 2
	raise HardsploitAPI::ERROR::SWD_ERROR,"FAULT response" 								if result[4] == 4
	raise HardsploitAPI::ERROR::SWD_ERROR,"WRITE ERROR #{result[4]}"
end

#writeFlash(path) ⇒ Object 



103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
 
# File 'lib/HardsploitAPI/Modules/SWD/HardsploitAPI_SWD.rb', line 103

def writeFlash(path)
	obtainCodes
	dataWrite = IO.binread(path)
    dataWrite = dataWrite.unpack("C*")
	HardsploitAPI.instance.consoleInfo "Halting Processor"
	@stm32.halt
	HardsploitAPI.instance.consoleInfo "Erasing Flash"
	@stm32.flashUnlock
	@stm32.flashErase
	HardsploitAPI.instance.consoleInfo "Programming Flash"
	@stm32.flashProgram
	time = Time.new
	@stm32.flashWrite(@memory_start_address, dataWrite)
	time = Time.new - time
	HardsploitAPI.instance.consoleSpeed "Write #{((dataWrite.size/time)).round(2)}Bytes/s #{(dataWrite.size)}Bytes in  #{time.round(4)} s"
	@stm32.flashProgramEnd
	HardsploitAPI.instance.consoleInfo "Resetting"
	@stm32.sysReset
	HardsploitAPI.instance.consoleInfo "Start"
	@stm32.unhalt
end

#writeSWD(ap, register, data) ⇒ Object

Raises:



317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
 
# File 'lib/HardsploitAPI/Modules/SWD/HardsploitAPI_SWD.rb', line 317

def writeSWD(ap, register, data)
	packet = HardsploitAPI.prepare_packet
	packet.push 0x10 #Write mode
	packet.push (calcOpcode(ap, register, false)) #Send Request
	packet.push ((data & 0xFF) >> 0)
	packet.push ((data & 0xFF00) >> 8 )
	packet.push ((data & 0xFF0000) >> 16 )
	packet.push ((data & 0xFF000000) >> 24 )
	result = HardsploitAPI.instance.sendAndReceiveDATA(packet, 1000)
	raise HardsploitAPI::ERROR::SWD_ERROR,"Error during writing, timeout" unless result.class == Array
	raise HardsploitAPI::ERROR::SWD_ERROR, "Error during writing" 				unless result.size == 5
	return true 																													if result[4] == 1
	raise HardsploitAPI::ERROR::SWD_ERROR,"WAIT response" 								if result[4] == 2
	raise HardsploitAPI::ERROR::SWD_ERROR,"FAULT response" 								if result[4] == 4
	raise HardsploitAPI::ERROR::SWD_ERROR,"WRITE ERROR #{result[4]}"
end