Attack Firmware v1.2, Target firmware v1.3, Dump Script v1.4
This release brings fixes and enhancements to the target exploit firmware. Notably, it improves compatibility across the entire F1 family. Once again, special thanks to @deividAlfa for their generous contributions.
Here's a summary of what has changed:
Target Firmware:
-
Varying SRAM execution entry points are now dealt with dynamically by allocating a trampoline from
0x100 - 0x300. This eliminates the need to compile different binaries for each entry point. See #18 and 3bdbdd6 for more details. -
Fixed hard-faults occurring on F1's with smaller SRAM sizes (00, 01, 02) by only allocating 4KB of RAM. Lower SRAM devices would experience hard-faults when pushing to the stack (e.g. when a function was called). See #18 and 3bdbdd6 for more details. Likely also fixed #10.
-
Removed the need for USART RX. Since the dump only transmits data to the attack board, the RX pin is not required. That's one less pin that needs to be accessed!
-
Overhauled the target firmware code. That includes removing lots of dead/unused code from the original POC, fixing some minor bugs, as well as improving the readability of the code through the use of structs and comments. The assembly section has been renamed from
test.Stoentry.Sand now features comments that explain exactly what each step does.
Dump Script:
-
Entry point check now only tests if the detected entry point lies in the range of
0x100 - 0x300. See first point in Target Firmware changes. -
Mentions that Pico TX -> STM RX communication is no longer required. Completely omitting any mentions of Pico TX -> STM RX wiring has not been done since that could cause users to confuse GPIO0 with GPIO1 on the Pi Pico. Switching GPIO's was also out of the question since that could potentially break hard-wired set-ups.
