vanbwodonk/read-stm32-firmware.md

Last active April 18, 2025 03:36

Star (23) You must be signed in to star a gist
Fork (2) You must be signed in to fork a gist

Learn more about clone URLs
Clone this repository at <script src="https://gist.github.com/vanbwodonk/6b425a093786e7eaddf535de747118dc.js"></script>
Save vanbwodonk/6b425a093786e7eaddf535de747118dc to your computer and use it in GitHub Desktop.

Download ZIP

Read stm32 firmware binary with openOCD

Raw

read-stm32-firmware.md

read-stm32-firmware

OpenOCD scripts for read STM32 firmware binary

Requirements

Linux

OpenOCD (Open On-Chip Debugger) is open-source software that interfaces with a hardware debugger's JTAG port. OpenOCD provides debugging and in-system programming for embedded target devices. OpenOCD provides the ability to flash NAND and NOR FLASH memory devices that are attached to the processor on the target system. Flash programming is supported for external CFI compatible flashes (Intel and AMD/Spansion command set) and several internal flashes (LPC2000, AT91SAM7, STR7x, STR9x, LM3 and STM32x).

OpenOCD was originally developed by Dominic Rath at the University of Applied Sciences Augsburg. The OpenOCD source code is now available through the GNU General Public License (GPL).

Under ubuntu 20.04 just install with this:

sudo apt-get install openocd

Under Arch/Manjaro:

sudo pacman -S openocd

Win32

Here is the locaiton prebuild binary can be downloaded from: https://gnutoolchains.com/arm-eabi/openocd/

OPENOCD Command

Read command example

For STM32f103c8 with 64Kbytes Flash. Target is target/stm32f1x.cfg. Size to read is 0x10000. Read firmware as firmwareF1.bin.

openocd -f interface/stlink-v2.cfg -f target/stm32f1x.cfg -c init -c "reset halt" -c "flash read_bank 0 firmwareF1.bin 0 0x10000" -c "reset" -c shutdown

For STM32f407vg with 1Mbytes Flash. Target is target/stm32f4x.cfg. Size to read is 0x100000. Read firmware as firmwareF4.bin.

openocd -f interface/stlink-v2.cfg -f target/stm32f4x.cfg -c init -c "reset halt" -c "flash read_bank 0 firmwareF4.bin 0 0x100000" -c "reset" -c shutdown

Write command example

For STM32f103c8 with 64Kbytes Flash. Target is target/stm32f1x.cfg. Write firmware firmwareF1.bin to flash.

openocd -f interface/stlink-v2.cfg -f target/stm32f1x.cfg -c init -c "reset halt" -c "flash write_image erase firmwareF1.bin 0x08000000" -c "reset" -c shutdown

For STM32f407vg with 1Mbytes Flash. Target is target/stm32f4x.cfg. Write firmware firmwareF4.bin to flash.

openocd -f interface/stlink-v2.cfg -f target/stm32f4x.cfg -c init -c "reset halt" -c "flash write_image erase firmwareF4.bin 0x08000000" -c "reset" -c shutdown

gpoleszuk commented Sep 10, 2024 •

edited

Loading

Uploading a new firmware

The original board was not detected by SO as show below

$ dmesg
[96955.681863] usb 2-1: new full-speed USB device number 76 using xhci_hcd
[96955.809832] usb 2-1: device descriptor read/64, error -71
[96956.045886] usb 2-1: device descriptor read/64, error -71
[96956.281871] usb 2-1: new full-speed USB device number 77 using xhci_hcd
[96956.409897] usb 2-1: device descriptor read/64, error -71
[96956.649891] usb 2-1: device descriptor read/64, error -71
[96956.757988] usb usb2-port1: attempt power cycle
[96957.169867] usb 2-1: new full-speed USB device number 78 using xhci_hcd
[96957.170047] usb 2-1: Device not responding to setup address.
[96957.378039] usb 2-1: Device not responding to setup address.
[96957.585859] usb 2-1: device not accepting address 78, error -71
[96957.713870] usb 2-1: new full-speed USB device number 79 using xhci_hcd
[96957.714049] usb 2-1: Device not responding to setup address.
[96957.922048] usb 2-1: Device not responding to setup address.
[96958.129872] usb 2-1: device not accepting address 79, error -71
[96958.129982] usb usb2-port1: unable to enumerate USB device

Now, trying to upload a new firmware (after the backup is done!)

$ openocd -f interface/stlink-v2.cfg -f target/stm32f1x.cfg -c init -c "reset halt" -c "flash write_image erase buck50.bin 0x08000000" -c "reset" -c shutdown
Open On-Chip Debugger 0.10.0
Licensed under GNU GPL v2
For bug reports, read
	http://openocd.org/doc/doxygen/bugs.html
Info : auto-selecting first available session transport "hla_swd". To override use 'transport select <transport>'.
Info : The selected transport took over low-level target control. The results might differ compared to plain JTAG/SWD
adapter speed: 1000 kHz
adapter_nsrst_delay: 100
none separate
Info : Unable to match requested speed 1000 kHz, using 950 kHz
Info : Unable to match requested speed 1000 kHz, using 950 kHz
Info : clock speed 950 kHz
Info : STLINK v2 JTAG v29 API v2 SWIM v7 VID 0x0483 PID 0x3748
Info : using stlink api v2
Info : Target voltage: 3.245003
Info : stm32f1x.cpu: hardware has 6 breakpoints, 4 watchpoints
target halted due to debug-request, current mode: Thread 
xPSR: 0x01000000 pc: 0x1ffff020 msp: 0x200001fc
auto erase enabled
Info : device id = 0x20036410
Info : flash size = 64kbytes
target halted due to breakpoint, current mode: Thread 
xPSR: 0x61000000 pc: 0x2000003a msp: 0x200001fc
wrote 23552 bytes from file buck50.bin in 1.322169s (17.396 KiB/s)
shutdown command invoked
$ echo $?
0

Reading the firmware

$ openocd -f interface/stlink-v2.cfg -f target/stm32f1x.cfg -c init -c "reset halt" -c "flash read_bank 0 new_firmware.bin 0 0x10000" -c "reset" -c shutdown
Open On-Chip Debugger 0.10.0
Licensed under GNU GPL v2
For bug reports, read
	http://openocd.org/doc/doxygen/bugs.html
Info : auto-selecting first available session transport "hla_swd". To override use 'transport select <transport>'.
Info : The selected transport took over low-level target control. The results might differ compared to plain JTAG/SWD
adapter speed: 1000 kHz
adapter_nsrst_delay: 100
none separate
Info : Unable to match requested speed 1000 kHz, using 950 kHz
Info : Unable to match requested speed 1000 kHz, using 950 kHz
Info : clock speed 950 kHz
Info : STLINK v2 JTAG v29 API v2 SWIM v7 VID 0x0483 PID 0x3748
Info : using stlink api v2
Info : Target voltage: 3.235473
Info : stm32f1x.cpu: hardware has 6 breakpoints, 4 watchpoints
target halted due to debug-request, current mode: Thread 
xPSR: 0x01000000 pc: 0x1ffff020 msp: 0x200001fc
Info : device id = 0x20036410
Info : flash size = 64kbytes
wrote 65536 bytes to file new_firmware.bin from flash bank 0 at offset 0x00000000 in 1.003524s (63.775 KiB/s)
shutdown command invoked
$ echo $?
0

Comparing hashes

$ md5sum new_firmware.bin 
d2b9752b83ca78dfb9bfabebb23cc3b9  new_firmware.bin
$ md5sum buck50.bin 
dfc25969132c68a212b4cece12d07160  buck50.bin

Both are different! Why? But now it is recognized!

$ dmesg
[97561.301455] usb 2-1: USB disconnect, device number 82
[97565.206080] usb 2-1: new full-speed USB device number 83 using xhci_hcd
[97565.355539] usb 2-1: New USB device found, idVendor=0483, idProduct=5740, bcdDevice= 2.00
[97565.355545] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[97565.355548] usb 2-1: Product: STM32 Virtual COM Port
[97565.355552] usb 2-1: Manufacturer: STMicroelectronics
[97565.355554] usb 2-1: SerialNumber: 87033727495085480669ff49
[97565.357117] cdc_acm 2-1:1.0: ttyACM0: USB ACM device

By pushing the old firmware file (the original one that blinks the board LED), the board is not identified by SO but returns to blink the board LED as before (original application delivered with the board).

Author

vanbwodonk commented Sep 11, 2024

By pushing the old firmware file (the original one that blinks the board LED), the board is not identified by SO but returns to blink the board LED as before (original application delivered with the board).

Sometimes my ST-LINK can't detect STM32 when i forgot to enable Debug > Serial Wire