STM32F427VI firmware retrieval

[fabrecordz]

Hi All,

Been reading and learning a lot about MCU's in general. I'm very very new to all of this so please bare with me.

The board comes with STM32F427, and a custom .exe that can flash directly via USB-C. I've read about fake STM32's, and. I'm not sure if the MCU is genuine or not, but I'm adding the picture so someone can maybe help.

The board comes with Ethernet, 3 USB-A, 1 USB-C (act as UART maybe?)

The custom .exe can be flashed via USB-C after I put it in DFU mode I presume? (I hold the boot, it flashes blue to allow the flashing). I can click on flash, restore, or even backup basic configs.

I would like to duplicate or retrieve the firmware so I can test it in another board. I tried STM32Cube, ESPtools, and many others, but it doesn't seem to recognize any connectivity.

Any help or guidance would be appreciate.

Thanks.

[TDK]

A few things:

If it is using DFU mode (as opposed to a custom bootloader), you can connect with STM32CubeProgrammer and download the flash, provided it doesn't have readout protection (RDP) set up. If it does, you're out of luck.

If you can find a BOOT0 pad, shorting it while resetting will probably put it in bootloader mode. Look in device manager after you do this and you should see a DFU device available.

It's probably a genuine chip.

[fabrecordz]

Thanks you for the reply. When I put it in DFu mode to use their flash, it won’t show up in device manager, but it can be flashed with a firmware. Does that mean it uses a custom bootloader? And is there a way to bypass that?

ill look at shorting the boot0 to get access if possible. 

[TDK · Accepted solution]

Something should show up if you're connected via USB. Perhaps a serial port, but something. If after you "put it in DFu mode", nothing changes in the device manager, then it's not using the system DFU bootloader, or any DFU bootloader. Perhaps it's using a custom one (most likely), but perhaps it's using the serial port system bootloader. If it is, you can still connect with STM32CubeProgrammer and read memory (if RDP is not set).

If you can trace the USB data lines on the board, it should be straightforward to see where they go, unless they're buried.

[fabrecordz]

Thanks again. 

the device has a usb-c that connects to the Pc and creates a virtual controller and a HID device. When I press the boot button, then plug the device, it switch to firmware mode I guess where you can use their .exe to flash/recover/factory reset the device or even save configs. 

so once it’s in that state, I don’t see any serials in DevMan, but I cannot see it with any MCU tool, including STM32Cube. 

any guidance would be really appreciated. 

Thanks again. 

[TDK]

Shorting BOOT0 to VCC during reset is probably your best bet. An STM32 DFU device should show up if those data pins are connected to the device.

More information on what this board is would be helpful. Pretty in the dark here.

The TUSB2036 chip is a USB hub. That's probably where the USB data lines go.