The Cheap Way To Glitch An STM8 Microcontroller

Reverse engineering or modifying a device often requires you to access the firmware stored on a microcontroller. Since companies are usually not fond of people who try to peek into their proprietary data, most commercial devices are readout protected. [rumpeltux] ran into this problem when he tried to dump the firmware on an HC-12 wireless serial communication module for yet undisclosed reasons. Hacking into the device was a challenge that he gladly accepted and in the end, he succeeded by building a low-cost setup for voltage glitching.

Voltage glitching is a form of fault injection that has, e.g., been successfully used to hack the Playstation Vita. It involves the injection of voltage spikes on the power line in order to force the bootloader to skip security checks. The hard thing is trying to find the right shape of the waveform and the best way to inject the signal.

While there are already open-source boards for fault injection like ChipWhisperer, [rumpeltux] chose to build his own setup around an FPGA. By using a cheap EPM240 board, some MOSFET, and a USB-to-Serial converter, the total costs of the glitching setup were under 20 Euros. [rumpeltux] then recorded a larger number of voltage traces on the VCC pin around the reset phase and analyzed the differences. This helped him to pinpoint the best time for injecting the signal and refine the search space. After some unsuccessful attempts to glitch the VCC and GND pins, he got lucky when using one of the voltage regulator pins instead.

Be sure not to miss Samy Kamkar’s talk at Supercon 2019 if you want to know more about hardware attacks or how to eavesdrop on people using a bag of potato chips.

Getting Started With STM8

There are so many different CPUs today and often the hardest thing about using any of them is getting started and gathering the right software tools. If you’ve ever eyed up the very inexpensive STM8 processor, you’ll want to check out [Shane Burrell’s] video (see below) about how to get started with the STM8.

The STM8 isn’t a 32-bit processor — you could probably guess that from the name. [Shane] uses SDCC (small device C compiler) to target the little chip. He also shows how he manages a fairly substantial piece of code and how he controls the build process.

Continue reading “Getting Started With STM8”

Hackaday Prize Entry: HID Dial

Microsoft has introduced a few interesting bits of hardware recently, and the most drool worthy by far is the Microsoft Surface Dial. What is this magical input device that will revolutionize creative work on a computer? Basically, it’s a Griffin PowerMate — a rotary encoder and button — an interface that really hasn’t changed in a decade and a half.

[K.C. Lee] figures a device this simple would make for a great Hackaday Prize entry, so he built a USB HID multimedia dial. It’s a rotary encoder and a button. This one lights up, though, making this a gamer USB HID multimedia dial.

The electronics for this build are based around the STM8S003, an extraordinarily cheap microcontroller that will work well enough in this application. The mechanical part of this build is a little more interesting; [K.C.] says not everyone has access to fancy CNC or 3D printing equipment, so he built this model out of bits of plastic, metal, and superglue. This enclosure is literally an old superglue bottle cap, an empty dental floss spool, and bits of metal. It works, and took less time to build than it would take to design in a CAD program.

Right now, [K.C.] is working through some USB issues with the STM8 microcontroller. Once those issues are behind him, he’ll have a very cool and very useful input device sitting on his desk. It might look like parts waiting for the recycling bin, but it will be at least as useful as the fancy Microsoft version.

Smaller Cheaper Arduino

Well, honestly, [Michael Mayer’s] STM8 Arduino (called Sduino) isn’t actually much to do with the Arduino, except in spirit. The STM8 is an 8-bit processor. It is dirt cheap and has some special motor control features that are handy. There’s a significant library available for it. However, it can be a pain to use the library and set up the build.

Just like how the Arduino IDE provides libraries and a build system for gcc, Sduino provides similar libraries and a build system for the sdcc compiler that can target the STM8. However, if you are expecting the Arduino’s GUI or a complete knock off of the Arduino library, you won’t get that.

Continue reading “Smaller Cheaper Arduino”

Software USB On The STM8

STM8

Thanks to V-USB, software-based USB is all the rage now, with a lot of uses for very small and low power microcontrollers.[ZiB] wondered if it would be possible to implement a USB controller on the STM8 microcontroller (Google translation) in software and succeeded.

The STM8 is a bit of a change from the usual 8-bit micros we see like AVRs and PICs. [ZiB] chose the STM8S103F3, although any chip in the STM8 family will work with this project when a 12MHz crystal is attached.

The build began by generating USB signals with the help of a whole lot of NOPs. This code doesn’t take up much space – only 300 bytes, and the receiving code (Google translation) is similarly sized.

The code isn’t quite there yet, but [ZiB] has proven a software-based USB implementation on the STM8 is possible. All the code is available for download (comments in Russian) and a video demoing the project available below. If anyone cares to translate this project to English, we’ll post a link to your work here.

Continue reading “Software USB On The STM8”

Turning Cheap Voltmeters Into I2C Displays

Voltmeter I2C Displays

[Tom] needed 8 displays for a project. He wanted to to control them over I2C, and was trying to reduce cost. Some vendors make I2C controllable seven segment displays, but they cost about $10 each. [Tom] figured he could hack cheap voltmeters to get the same results for about $3 a pop.

The voltmeters that [Tom] bought used a 8 bit STM8S003F3P6 microcontroller. He reverse engineered the device and re-created the schematic to find out where the I2C and programming pins would be. Then he hooked it up to a STM8 Discovery development board, which has an integrated programmer.

With the hardware figured out, it was time for new firmware. Fortunately, [ba0sh1] had already written firmware for a similar purpose which could easily be adapted. The code implements a software I2C slave, which reads data off the bus and displays it. It’s all available on Github.

The end result is a I2C controlled display for a third of the cost. Next time you need a bunch of these in a project, consider picking up some cheap voltmeters.

Versaloon Ported To STM8 And STM32 Discovery Boards

[Bingo] did some work porting Versaloon for STM8 and STM32 discovery boards. Versaloon is a multiple-architecture programmer that we saw a few weeks back. At its center is an STM32 microprocessor, which greatly simplifies the work necessary to use the two discovery boards instead. Flashing the firmware to the boards will zap the ST-link firmware and [Bingo] doesn’t know of a way to restore that so be warned. This hack is still pretty fresh off the bench, but so far it looks like vsprog and OpenOCD both work just fine with the new hardware.