Possible to read program stored in STM32F103C8T6 ?

[Math86]

Hello everyone,

I bought a tool that uses a STM32F103C8T6 with a program on it to transmit some CAN data. I would like to read the program that is currently on the tool and edit it.

Is it feasible ? Or is the memory protected ?

Thanks in advance for your help ! :grinning_face:

[Math86]

The problem is that the code sends some CAN messages that I need to know. It's impossible to find out by myself which ID and data needs to be included in there.

[Math86]

Indeed this looks very complicated. I read online that there are some "disassemblers" that can partly retrieve some code or at least make some sense of the compiled code. Do you think this could work here ?

[Javier1]

@Math86​ 

Take this as an opportunity to learn about it, if it were up to me i would find another way.

With dissasembler tools you can translate compiled machine code back into Simple assembly languaje

Is the programm you want to reverse engineer very simple?

Because this languaje is Harsh, and you would need to have an advanced knowledge about your hardware

[Math86]

The micro controller is embedded on a PCB that is connected to the ODB port of a car to read and transmit CAN messages.

I expect the program to read the can messages carrying the details of the car and based on that send a predefined set of CAN messages (probably 3-4 scenarios depending on the details of the car).

It will also read the VIN number and store it to block usage on another car. Accessing and changing that VIN number would already a good achievement for me.

But if I understand all of this is only possible if the read protection is off so I'll already try to figure out if that's the case or not.

[Javier1]

So you just want to code your own programm and flash it in the microcontroller?

It would be easyer than reverse engineering binaries and then add your code

I have no experience with read protections, you should try , are the SW pins of the microcontroller accesible to you?

[Math86]

I need to keep the CAN messages that are stored in the program as I have no idea what ID and data they contain.

Let's say that for now I want to keep the exact same program but I just want to remove the lock on a certain VIN number to be able to use that tool on multiple cars.

The tool has been connected to a car once, it read the ​VIN number of the car, then it sent certain CAN messages that triggered an action on the car.

Now, if the tool is connected to another car, it'll see that the VIN number doesn't match the one that he registered at the first use and it won't do anything.

I tried connecting through UART without any success. Here is the thread where I explain my setup : ​https://community.st.com/s/question/0D53W00000qvHtNSAU/help-connecting-to-stm32-on-cube-programmer

Thanks a lot for your time that you spend helping me.​

[Javier1]

What about contacting the company who manufactured those?

At the begining i tought you were trying to hack some obscure deprecated pcb, but now it looks more like youre trying to get your hands into some propietary not opensource automotive software and hack out the protection.

[Math86]

Those are small OBD dongles sold on AliExpress, I contacted many sellers to get the details of the supplier but no one could help me.

The tool is unbranded and already exists in many shapes but none display a brand I could contact.

I also tried searching based on image on Google and Chinese search engines but not luck.​

[Andrew Neil]

There are plenty of open-source projects for doing this - I think that'd be a far easier route than trying to reverse-engineer this thing.

https://learn.sparkfun.com/tutorials/getting-started-with-obd-ii/all

https://community.st.com/s/question/0D50X0000B6P853/can-interface-with-obd

http://openxcplatform.com/

https://sourceforge.net/projects/openobd/

http://www.obdtester.com/pyobd

[Math86]

Thanks ! I'll have a look !