haapainting.blogg.se - Stm32x device protected

#STM32X DEVICE PROTECTED SERIAL#
#STM32X DEVICE PROTECTED UPGRADE#
#STM32X DEVICE PROTECTED SOFTWARE#
#STM32X DEVICE PROTECTED FREE#

To assist, I created a Python script ( ocd-client.py) connecting to OpenOCD for dumping various STM32 device registers.

Measuring input and output voltage (definitely ADC).

Controlling the output voltage (controlled by the DAC?).

What STM32 peripheral drives what function?.

Learn how buttons and other IOs are connected.

So what would be needed to create the OpenDPS firmware? Not a biggie as I was not interested in the stock firmware in itself, only what it controlled. So “readout protection” is enabled which mean you cannot read the firmware from flash. Yay! Next I connected to OpenOCD to examine the target: % telnet localhost 4444 Info : stm32f1x.cpu: hardware has 6 breakpoints, 4 watchpoints Info : STLINK v2 JTAG v17 API v2 SWIM v4 VID 0x0483 PID 0x3748 Info : Unable to match requested speed 1000 kHz, using 950 kHz The results might differ compared to plain JTAG/SWD Info : The selected transport took over low-level target control.

Info : auto-selecting first available session transport "hla_swd". GNU ARM Eclipse 64-bits Open On-Chip Debugger 0.10.8-gbbfb673 (-19:13) Debugger connectedĪfter some soldering, connecting an STLink clone and selecting an appropriate OpenOCD configuration for the STM32F100, I had a go at it: % openocd -f interface/stlink-v2.cfg -f target/stm32f1x.cfg But had the producers locked the SWO port when flashing the firmware? Luckily, no. Having the STM32 in the open quickly allowed me to identify the five test points at the top of the PCB, the expected SWO trace port. Warranty voided, oh there actually was none to begin with. As I did not have the time to play with iron and solder wick I resorted to a metal saw and promptly sawed the TFT display off (please note this is not the unit in the pictures below). The STM32 is covered by the TFT display, which in turn is soldered using eight pins.

#STM32X DEVICE PROTECTED SERIAL#

Fake port! I later realised the DPS5005 stock firmware does not even initialise the serial port. So where does one start? Looking at the PCB, I quickly found the serial port. This time, obviously, I had neither which was a bit more challenging.

This is pretty much my day job but I always have the hardware schematics and the hardware design engineer at hand. The reverse engineering of the DPS5005 can be summarised as “bring up of the STM32 based DPS5005 hardware and writing an application for it”.

#STM32X DEVICE PROTECTED UPGRADE#

If you only want to upgrade your DPS you may skip directly to part three. Part three covers the upgrade process of stock DPS:es and connecting these to the world. Part two covers the design of OpenDPS, the name given to the open DPS5005 firmware. Part one (this one) covers reverse engineering the stock firmware and could be of interest for those looking at reverse engineering STM32 devices in general. This write up of the OpenDPS project is divided into three parts.

#STM32X DEVICE PROTECTED FREE#

And so begun the OpenDPS project, a free firmware replacement for the DPS5005 and friends. Looking closely at the sandwich PCB design I noticed the DPS is powered by an STM32, which is pretty much what I expected.

#STM32X DEVICE PROTECTED SOFTWARE#

The overall impression was quite good but the software was a bit cluttered and the DPS5005 could not be instrumented via a serial port (or wifi). Then HAD wrote about it in december last year and after watching YouTube user video I just had to get one. To be honest, I dismissed the ‘5005 since it was not a complete product. Some time ago I found the DPS5005 while browsing AliExpress for programmable power supplies.