cancel
Showing results for 
Search instead for 
Did you mean: 

CAN Bootloader. Commands with ROP dependece

caio2
Associate
Posted on November 18, 2010 at 01:57

CAN Bootloader. Commands with ROP dependece

#bootloader #can-bootloader-stm32-stm32f105-stm32f107
3 REPLIES 3
Posted on May 17, 2011 at 14:15

Yes, ROP will disable all useful functions of the boot loader, this is to prevent you compromising the protection of the part, as the ROM code is able to read the entire part.

Send 0x92,0x6D to clear the ROP state and erase the part. The alternative is to use a J-Link with the STM32 application.

Tips, buy me a coffee, or three.. PayPal Venmo Up vote any posts that you find helpful, it shows what's working..
caio2
Associate
Posted on May 17, 2011 at 14:15

Hi clive1.

I can´t use other alternative only CAN.

I apply AN2262 item 3.15 and it work very good. Whenever i send ID=0x92, DLC = 0x01 and data[0] = 0x00 STM32F107 answer ID=0x92,DLC=0x01 and data = 0x79 so i got an ACK (twice). I´ve a tools USART Loader (STMEletronics) and i can check (ROP) is disable.

Whenever i use read memory ID=0x11,DLC=0x05 and Data[]=0x08,0x00,0x00,0x00,0x08 so that aswer only Nack (0x11,0x01,0x1F)

Best regards.

Posted on May 17, 2011 at 14:15

Sounds like you're going to have heaps of fun.

ROP makes things particularly difficult, on purpose.

You might still be well advised to try the USART1 and JTAG methods on a dev board that does support such, and experiment. ROP can be very unforgiving in a board in which you've provided limited access.

I can't speak to the CAN implementation, but the boot loader responds to some commands with multiple ACK's. One to indicate the command acceptance, and another to indicate completion of the operation (pass/fail). The CHIP ID and GET VER ROPS spring to mind.

The 0x92 (+0x6D checksum) on USART1 runs the READOUT PERM UNPROTECT command. This sends one ACK, updates the option and erases, sends another ACK, and then RESETs the device. On the USART1 interface you'd need to send another 0x7F to reinitialize the loader, to do any other queries. If you have logic interfering with the reset pin, it might not reset properly. You could however cycle the power after the second ACK.

Reading out 256 bytes on the USART1 interface

    BYTE data[9] = { 0x11, 0xEE, 0x1F, 0xFF, 0xF0, 0x00, 0x10, 0xFF, 0x00 }; // 256 Bytes @ 1FFFF000

Try ID=0x11,DLC=0x05 and Data[]=0x1F,0xFF,0xF0,0x00,0x07

Tips, buy me a coffee, or three.. PayPal Venmo Up vote any posts that you find helpful, it shows what's working..