Skip to main content
Jarrid Graham
Associate
February 9, 2017
Question

Best way to clone stm32f103 to new board

  • February 9, 2017
  • 8 replies
  • 6532 views
Posted on February 09, 2017 at 19:33

What I have are two identical boards except for the firmware on one is newer than the other. I thought it should be fairly easy to copy the memory from one to the other . I have a st-link v2 and can copy the firmware (no protection) out and flash it to the other but to does not work after being programmed.

I can get access to the UART1 and boot pins if need be but when I write the memory and compare it, it has been written and checks out , I was just curious what I might be missing.

I will admit that I am not very familiar with the STM32 family of stuff but have worked with other micros over the years

    This topic has been closed for replies.

    8 replies

    Tesla DeLorean
    Guru
    February 9, 2017
    Posted on February 09, 2017 at 20:04

    Perhaps it is dependent on unique serial number, external hardware, or has information programmed in OTP/Options.

    You could compare the memory image between two devices which already have the same firmware, and see if any of the FLASH is committed to configuration/calibration data which is part/board unique.

    Tips, Buy me a coffee, or three.. PayPal Venmo (See Profile) Up vote any posts that you find helpful, it shows what's working..
    Jarrid Graham
    Associate
    February 9, 2017
    Posted on February 09, 2017 at 20:32

    I do have two devices that are supposed to be the same, I will check them and see, I am guessing I only need to look at the 0x08000000 area ? someone suggested copying 64k from the device and clear the other and program I end up with the same result. I did try to change some of the option bytes and I get an error but when I go back to check they have changed.

    Ok I read both the boards and there were 4 bytes different , two were basically +0x40 and the other two were +0x01 more. these devices are pretty generic it doesnt look like there is anything to identify any kind of serial or anything but I don't know.

    I did try flashing that image and had the same result.

    Thanks

    Tesla DeLorean
    Guru
    February 9, 2017
    Posted on February 09, 2017 at 22:58

    Each device has a unique serial number. Data can also be stored in BKPRAM and erased via tamper detection.

    The most probable reason, beyond basic copy protection, is that you aren't copying the entire flash. What is the exact part number of the STM32 being used.

    Going to presume you don't actually have the approval of programs author to do what you are trying.

    Tips, Buy me a coffee, or three.. PayPal Venmo (See Profile) Up vote any posts that you find helpful, it shows what's working..
    Jarrid Graham
    Associate
    February 9, 2017
    Posted on February 09, 2017 at 23:19

    What is basically is that there is a jig to reprogram theses boards being shipped to customers to reflash them, I was supposed to have it almost 2 months ago, in the mean time my thousands of dollars in equipment is not working. I have contacted them and have told them what I am doing and have done, they have not said go or stop other than now the only jig is broke and will be a while. What I did was early on I sent some boards to the person that had it jig at the time to be updated is why I have the newer version. If I could get them flashed they could bypass me and go on to the next. At some point I will get them but being down do long has been a pain.

    The actual part number is STM32F103RCT6 

    I really hate asking such a basic question and I do appreciate the help and info, I didn't think it would be more involved than this.

    What I know about the jig is it has an updated board that it is reading from, as far as how I don't know had some support electronics wrapped in white tape, just needs usb for power only. Put your board in and push the pogo pins down and hit a switch.

    What have been told is many times it has to be flashed multiple times or you get a red flashing led which is what I am getting now, i assume it is the same but don't know, some code must be running to flash the led.

    Thanks

    Tesla DeLorean
    Guru
    February 9, 2017
    Posted on February 09, 2017 at 23:37

    So 256KB of FLASH not 64KB 

    Tips, Buy me a coffee, or three.. PayPal Venmo (See Profile) Up vote any posts that you find helpful, it shows what's working..
    Jarrid Graham
    Associate
    February 10, 2017
    Posted on February 10, 2017 at 01:57

    First thing I did was hook up the new board and pulled 0x3FFFF size from 0x08000000 and wrote that I though since is was unprotected that would get it but it didn't.  So started banging around for a bit then decided there must be something simple I am missing.

    Tesla DeLorean
    Guru
    February 10, 2017
    Posted on February 10, 2017 at 02:05

    0x40000 

    Tips, Buy me a coffee, or three.. PayPal Venmo (See Profile) Up vote any posts that you find helpful, it shows what's working..
    Jarrid Graham
    Associate
    February 10, 2017
    Posted on February 10, 2017 at 03:10

    Ha, yes you are correct, I will try it tomorrow, hey at this point if it works I will be happy and feel bad at the same time.

    Tesla DeLorean
    Guru
    February 10, 2017
    Posted on February 10, 2017 at 03:24

    Really depends if the memory is fully populated, and there is a checksum or CRC right at the end, then being one byte short is enough to derail things. I usually do this by inspection. If the firmware was still not starting I'd disassemble and debug. If there is integrity checking that's the first thing to verify that you are starting with a clean image.

    0x08000000..0x0803FFFF [0x40000]

    Tips, Buy me a coffee, or three.. PayPal Venmo (See Profile) Up vote any posts that you find helpful, it shows what's working..
    Jarrid Graham
    Associate
    February 10, 2017
    Posted on February 10, 2017 at 15:40

    Well after some more looking around I did find a section at 0x0807000 (12 bytes) that are different, I put back the original firmware and it did work, I had forgotten I did this a month ago before I gave up the first time.

    I tried flash up that point , before I was over writing it but still no-go, I don't know if it is checksum check or some other type of check so I guess I need to try to disassemble it and see what is going on out there. I wouldn't think a code checksum since it is different on each board so far. changing any of the bytes results in a no-go.

    I am guessing disassemble is next step although I am versed enough to understand anything about that, is there a software that I can watch the MCU , I know you can step with the st-link util but it would be nice to do some kind of break point type thing.

    Thanks

    Tesla DeLorean
    Guru
    February 10, 2017
    Posted on February 10, 2017 at 16:52

    Keil's debugger would work.

    I find static analysis to be highly effective, using disassemblers that enable that.

    Tips, Buy me a coffee, or three.. PayPal Venmo (See Profile) Up vote any posts that you find helpful, it shows what's working..
    Jarrid Graham
    Associate
    February 10, 2017
    Posted on February 10, 2017 at 17:23

    I will look into that, I am thinking it is something to do with the MCU. On there board there is noting that I would think that can uniquely identify the device, but there must be something.

    Thanks

    Tesla DeLorean
    Guru
    February 10, 2017
    Posted on February 10, 2017 at 17:50

    The chip has a 96-bit Unique ID, it is described in the Reference Manual for the part.

    Tips, Buy me a coffee, or three.. PayPal Venmo (See Profile) Up vote any posts that you find helpful, it shows what's working..
    Jarrid Graham
    Associate
    February 12, 2017
    Posted on February 12, 2017 at 17:54

    Well in poking around they do look at 0x1FFF F7E8 in one section of code but it doesn't directly relate to what I am seeing. To be honest I am going to tinker with it but it is way above my level of knowledge at this point. 

    While in the long run I guess I don't need to know , now I am curious and that normally leads me down a path of learning something new at least.

    Thanks