disassembled_devices:vcds_clone_cable
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| disassembled_devices:vcds_clone_cable [2025/10/25 01:41] – [How to unbrick cable?] admin | disassembled_devices:vcds_clone_cable [2025/10/26 01:01] (current) – [Patching RDP2 theoretically] admin | ||
|---|---|---|---|
| Line 43: | Line 43: | ||
| > KolimerVIILoader，Device serial number is 3N00XXXX，Tag serial number is F33-415407 | > KolimerVIILoader，Device serial number is 3N00XXXX，Tag serial number is F33-415407 | ||
| - | If you have a clone Hex v2 with Badrax or Kolimer loader you must pay a fee to unlock your hex v2 to allow future updates by FLY - [[https:// | + | If you have a clone Hex v2 with Badrax or Kolimer loader you must pay a fee to unlock your hex v2 to allow future updates by FLY ([[https:// |
| Line 55: | Line 55: | ||
| * RDP1: ST-Link / SWD access and Bootloader access is blocked (read& | * RDP1: ST-Link / SWD access and Bootloader access is blocked (read& | ||
| - | * RDP2: External access (read& | + | * RDP2: External access (read& |
| STM32F4 has an OTP (one time programmable) memory, in which RSA keys are written. OTP is what the name says: Can only be programmed once and not be undone. So when erasing the MCU, the key persists of course. The RSA key in OTP cannot be read out, no matter the RDP level. There is a HAL (high abstraction layer) providing functions to interact with the key, but there is no direct access in this controlled environment. Before RDP option byes are set, the RSA key has to be written to OTP. The RSA key is often utilized for additional DRM protection within the firmware, enabling secure authentication, | STM32F4 has an OTP (one time programmable) memory, in which RSA keys are written. OTP is what the name says: Can only be programmed once and not be undone. So when erasing the MCU, the key persists of course. The RSA key in OTP cannot be read out, no matter the RDP level. There is a HAL (high abstraction layer) providing functions to interact with the key, but there is no direct access in this controlled environment. Before RDP option byes are set, the RSA key has to be written to OTP. The RSA key is often utilized for additional DRM protection within the firmware, enabling secure authentication, | ||
| Line 91: | Line 91: | ||
| Updating can be done over USB if your cable is updateable and not bricked (be aware of fly-loader bricking cables intentionally!) \\ | Updating can be done over USB if your cable is updateable and not bricked (be aware of fly-loader bricking cables intentionally!) \\ | ||
| - | Flashing can be done via SWD programming interface if RDP2 is not set. If RDP2 is set and your cable is bricked, the easiest choice is to replace the STM32 MCU. You can get STM32F405VGT6 [[https:// | + | Flashing can be done via SWD programming interface if RDP2 is not set. " |
| Tip to remove LQFP64 package without hot air rework station: take a rotary tool and cut through all pins carefully, then make PCB clean. | Tip to remove LQFP64 package without hot air rework station: take a rotary tool and cut through all pins carefully, then make PCB clean. | ||
| Alternative: | Alternative: | ||
| The ways I have seen people up most with: ripping of pads by lifting pins tediously one by one. Well, there is always " | The ways I have seen people up most with: ripping of pads by lifting pins tediously one by one. Well, there is always " | ||
| ==== Patching RDP2 theoretically ==== | ==== Patching RDP2 theoretically ==== | ||
| - | 🗒️ Note: I have not tested/ | + | 🗒️ Note: I have not tested/ |
| ⚠️ Always dump your firmware if it is in RDP0! \\ | ⚠️ Always dump your firmware if it is in RDP0! \\ | ||
| - | ❌ Only write something with RDP set if you are really sure - RDP2 cannot be reversed! \\ | + | ❌ Only write something with RDP set if you are really sure - RDP2 cannot be reversed! |
| - | ❌ Writing dump with RDP will probably | + | ❌ Writing dump with RDP might still not work as there are no RSA keys for OTP on the internet (AFAIK). \\ |
| ✅ Get a dump with RDP0 (or RDP1?) - Share your RDP0 dumps. \\ | ✅ Get a dump with RDP0 (or RDP1?) - Share your RDP0 dumps. \\ | ||
| - | ❓ Theoretically, | + | ❓ Theoretically, |
| ❌ Patching out potential security functions which use RSA keys of OTP in dump is not described here - it is probably an excessive task. \\ | ❌ Patching out potential security functions which use RSA keys of OTP in dump is not described here - it is probably an excessive task. \\ | ||
| - | **How to theoretically remove RDP2 from dump?** | + | **How to theoretically remove RDP2 from dump? idk, I have not tried myself (only had one spare MCU after brick-by-fly) - I imagine the easiest first approach to try it could be like this:** \\ |
| 1. Load the Dump into a Disassembler like Ghidra, Binary Ninja, Radare2 or IDA Pro. \\ | 1. Load the Dump into a Disassembler like Ghidra, Binary Ninja, Radare2 or IDA Pro. \\ | ||
| Line 127: | Line 127: | ||
| </ | </ | ||
| - | Search for: | + | Search for sth like: |
| < | < | ||
| LDR R0, =0x40023C14 | LDR R0, =0x40023C14 | ||
| Line 139: | Line 139: | ||
| 4. Repack the Binary \\ | 4. Repack the Binary \\ | ||
| Save your modified binary. \\ | Save your modified binary. \\ | ||
| - | Reflash | + | Cross your fingers that this is sufficient and reflash |
| Use STM32CubeProgrammer or OpenOCD to flash to unlocked MCU with ST-Link V2 or J-Link as programmer. \\ | Use STM32CubeProgrammer or OpenOCD to flash to unlocked MCU with ST-Link V2 or J-Link as programmer. \\ | ||
disassembled_devices/vcds_clone_cable.1761349303.txt.gz · Last modified: by admin