jacobrosenthal

/**
 * Licensed to the Apache Software Foundation (ASF) under one
 * or more contributor license agreements.  See the NOTICE file
 * distributed with this work for additional information
 * regarding copyright ownership.  The ASF licenses this file
 * to you under the Apache License, Version 2.0 (the
 * "License"); you may not use this file except in compliance
 * with the License.  You may obtain a copy of the License at
 *
 *  http://www.apache.org/licenses/LICENSE-2.0

jacobrosenthal

Last login: Fri Feb  9 11:16:21 on ttys008
Jacobs-Air:~ jacobrosenthal$ cd Downloads/chippd3/
Jacobs-Air:chippd3 jacobrosenthal$ openocd -f interface/cmsis-dap.cfg  -f target/nrf51.cfg -c "init; reset halt; nrf51 mass_erase; exit"
Open On-Chip Debugger 0.10.0+dev-00143-gf6449a7c (2017-05-25-22:07)
Licensed under GNU GPL v2
For bug reports, read
	http://openocd.org/doc/doxygen/bugs.html
Info : auto-selecting first available session transport "swd". To override use 'transport select <transport>'.
cortex_m reset_config sysresetreq
adapter speed: 1000 kHz

jacobrosenthal

[0x9d009000]> iM
[Main]
vaddr=0x9d01c844 paddr=0x9d01c844

[0x9d009000]> ie
[Entrypoints]
vaddr=0x9d009000 paddr=0x00009000 baddr=0x9d000000 laddr=0x00000000 haddr=0x00000018 type=program

1 entrypoints

jacobrosenthal

Jacobs-MacBook-Air:~ jacobrosenthal$ node cambadge-manifesto.js 
                   This is our world now... the world of
  the electron and the switch, the beauty
     of the baud. We make use of a service
                                already existing without paying for
                      what could be dirt-cheap if it wasn't
           run by profiteering gluttons, and you
                    call us criminals. We explore... and
                you call us criminals. We seek after
  knowledge... and you call us criminals.

jacobrosenthal

var manifesto = 
["all... after all, we're all alike.",
"individual, but you can't stop us",
"manifesto. You may stop this",
"I am a hacker, and this is my",
"me for.",
"something that you will never forgive",
"crime is that of outsmarting you,",
"think, not what they look like. My",
"judging people by what they say and",

jacobrosenthal

Jacobs-MacBook-Air:Downloads jacobrosenthal$ strings Badge103.hex
$$@H
<  J%
<0 J%
$DI*}
!4$@
G0@)C|
E&!  
$9&@
$9&@

jacobrosenthal

[0x00000000]> izz
Do you want to print 2104 lines? (y/N)
vaddr=0x00000360 paddr=0x00000360 ordinal=000 sz=5 len=4 section=unknown type=ascii string=_`@\v
vaddr=0x00000ef2 paddr=0x00000ef2 ordinal=001 sz=6 len=5 section=unknown type=ascii string=\b%+\b\t
vaddr=0x00000f5e paddr=0x00000f5e ordinal=002 sz=6 len=5 section=unknown type=ascii string=\n$$@H
vaddr=0x00000f9e paddr=0x00000f9e ordinal=003 sz=7 len=6 section=unknown type=ascii string=\n<  J%
vaddr=0x00000fb2 paddr=0x00000fb2 ordinal=004 sz=7 len=6 section=unknown type=ascii string=\n<0 J%
vaddr=0x00000fcd paddr=0x00000fcd ordinal=005 sz=7 len=6 section=unknown type=ascii string=`\n@%P\n
vaddr=0x00000ff2 paddr=0x00000ff2 ordinal=006 sz=7 len=6 section=unknown type=ascii string=\n$DI*}
vaddr=0x0000100a paddr=0x0000100a ordinal=007 sz=6 len=5 section=unknown type=ascii string=\t}@L\t

jacobrosenthal

https://www.nordicsemi.com/eng/Products/Bluetooth-low-energy/nRF-Sniffer

unpacks
Sniffer/Firmware/ble-sniffer_nRF51822_1.0.1_1111_Sniffer.hex

 •	JLinkExe -if SWD -device nrf51
 •	w4 0x4001e504, 0x2
 •	w4 0x4001e50c, 0x1
 •	loadbin ble-sniffer_nRF51822_1.0.1_1111_Sniffer.hex, 0
 •	r

jacobrosenthal

#!/usr/bin/env ruby

# Dump firmware from nrf51 and maybe other cortex-m devices
# The script thats missing from http://blog.includesecurity.com/2015/11/NordicSemi-ARM-SoC-Firmware-dumping-technique.html
# Also inspired by https://tasteless.eu/post/2015/12/32c3ctf-emb400/
# Requires seperate instace gdb server already running, for my jlink I use 
# openocd -f interface/jlink.cfg -c "adapter_khz 2000; transport select swd;" -f target/nrf51.cfg

# uicr and ficr are always accessible so you might want to dump those externally and compare?
# openocd -f interface/jlink.cfg -c "adapter_khz 2000; transport select swd; set WORKAREASIZE 0;" -f target/nrf51.cfg -c "init; reset halt; flash read_bank 1 uicr-normal.bin 0x0 0x100; exit"

jacobrosenthal

/*
  Copyright (c) 2014-2015 Arduino LLC.  All right reserved.
  Copyright (c) 2016 Sandeep Mistry All right reserved.
  This library is free software; you can redistribute it and/or
  modify it under the terms of the GNU Lesser General Public
  License as published by the Free Software Foundation; either
  version 2.1 of the License, or (at your option) any later version.
  This library is distributed in the hope that it will be useful,
  but WITHOUT ANY WARRANTY; without even the implied warranty of
  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.