Openocd: Difference between revisions
Created page with "<br /> == Cheat Sheet == For a comprehensive list of commands, see: http://www.openocd.org/doc/html/General-Commands.html {| class="wikitable" !Command !Description |- |<code..." |
mNo edit summary |
||
| Line 1: | Line 1: | ||
<br /> | <br /> | ||
== Cheat Sheet == | ==Cheat Sheet== | ||
For a comprehensive list of commands, see: http://www.openocd.org/doc/html/General-Commands.html | For a comprehensive list of commands, see: http://www.openocd.org/doc/html/General-Commands.html | ||
{| class="wikitable" | {| class="wikitable" | ||
| Line 41: | Line 41: | ||
|} | |} | ||
== Interfacing with STM32F100 == | ==Interfacing with STM32F100== | ||
There are some specific commands for the STM32F100 through the stm32f1x commands. To begin, run: | There are some specific commands for the STM32F100 through the stm32f1x commands. To begin, run: | ||
{{Highlight | {{Highlight | ||
| Line 61: | Line 61: | ||
|Unlock the readout protection (Warning: erases existing contents!) | |Unlock the readout protection (Warning: erases existing contents!) | ||
|} | |} | ||
=== STM32's readout protection === | |||
When running the options_read command, you will see whether there is readout protection enabled: | |||
{{Highlight | |||
| code = > stm32f1x options_read 0 | |||
Option Byte: 0x3fffffe | |||
Readout Protection On | |||
Software Watchdog | |||
Stop: No reset generated | |||
Standby: No reset generated | |||
User Option0: 0xff | |||
User Option1: 0xff | |||
| lang = terminal | |||
}} | |||
When enabled, the JTAG device will not be able to access the flash memory directly. It can however still access and interact with the CPU. | |||
There are 3 levels or RDP: | |||
* 0: No read protection. | |||
* 1: Read protection enabled. | |||
* 2: Debug/chip read protection disabled. Will disable JTAG, which is bad for our case. | |||
Changing the RDP levels with the stm32f1x unlock command will erase the contents on the device. You may try to readout the contents through the CPU using the [https://github.com/doegox/stm32f1-firmware-extractor stm32f1-firmware-extractor project], but this is imperfect and leaves many gaps in the dump. It's probably still better than nothing. | |||
<br /> | <br /> | ||
Revision as of 21:46, 25 May 2021
Cheat Sheet
For a comprehensive list of commands, see: http://www.openocd.org/doc/html/General-Commands.html
| Command | Description |
|---|---|
init
|
initalize |
halt
|
halt the processor |
reset halt
|
reset device and halt |
reset run
|
reset device and start execution |
flash list
|
lists detected flash devices |
flash read_bank <bank> <outputfile>
|
Reads the entire bank of flash memory into an output file.
Eg. read the first 32KB of flash memory |
reg
|
shows all registers |
reg <register>
|
Shows a specific register. Eg. reg r0.
|
md{d,w,h,b} <address>
|
Memory access (d = double/64 bit, w = word/32 bit, h = half/16 bit, b = byte/8 bit) |
mw{d,w,h,b} <address>
|
Memory write (same units above). |
Interfacing with STM32F100
There are some specific commands for the STM32F100 through the stm32f1x commands. To begin, run:
# openocd -f interface/stlink-v2.cfg -f target/stm32f1x.cfg
You may use the commands listed in the cheat sheet above and also the STM32 specific commands below.
| Command | Description |
|---|---|
stm32f1x mass_erase 0
|
Erase |
stm32f1x options_read 0
|
Check set options, such as if readout protection is enabled. |
stm32f1x unlock 0
|
Unlock the readout protection (Warning: erases existing contents!) |
STM32's readout protection
When running the options_read command, you will see whether there is readout protection enabled:
> stm32f1x options_read 0
Option Byte: 0x3fffffe
Readout Protection On
Software Watchdog
Stop: No reset generated
Standby: No reset generated
User Option0: 0xff
User Option1: 0xff
When enabled, the JTAG device will not be able to access the flash memory directly. It can however still access and interact with the CPU.
There are 3 levels or RDP:
- 0: No read protection.
- 1: Read protection enabled.
- 2: Debug/chip read protection disabled. Will disable JTAG, which is bad for our case.
Changing the RDP levels with the stm32f1x unlock command will erase the contents on the device. You may try to readout the contents through the CPU using the stm32f1-firmware-extractor project, but this is imperfect and leaves many gaps in the dump. It's probably still better than nothing.