bus pirate & pm3

bus pirate & pm3

#This post describes my "project" in:
debricking proxmark3 with the help of a Bus Pirate 3.6 board
as the board was shipped with a firmware inferior to 5.9, jtag was not supported
So i began my work by upgrading the firmware to 5.9+ (jtag supported)

#I was primarily based on http://dangerousprototypes.com/docs/Gonemad's_Bus_Pirate/OpenOCD_walk_through

#install driver
http://www.ftdichip.com/Drivers/CDM/CDM21224_Setup.zip

#modify Device Manager => Ports => Properties
Bits per second:   115200
Data bits:         8
Parity:            None
Stop bits:         1
Flow control:      None

#fireup Tera Term Pro and 
#Change settings in Setup => Serial Port
Bits per second:   115200
Data bits:         8
Parity:            None
Stop bits:         1
Flow control:      None

#Re-connect the Bus Pirate and launch Tera Term Pro, you get the following:
HiZ>
HiZ>i
Bus Pirate v3b
Firmware v5.10 (r559)  Bootloader v4.4
DEVID:0x0447 REVID:0x3046 (24FJ64GA002 B8)
http://dangerousprototypes.com
HiZ>m
1. HiZ
2. 1-WIRE
3. UART
4. I2C
5. SPI
6. 2WIRE
7. 3WIRE
8. LCD
9. DIO
x. exit(without change)

#Download theds30_Loader package here: http://picbootloader.com/forum/attachment.php?aid=280
#Launch ds30_loader GUI and adjust all the settings manually in the GUI. The following settings should suffice.

Basic:      Baudrate:   115200
            Device:      PIC24FJ    64GA002
            Port:      USB Serial Port (COMnn)
            Write program:   "True"
            Write Eeprom:   "False"
Advanced:   De-select everything!
Timing:      Poll time:   250
            Timeout:   5000
Reset:      Manual
Activation:   Manual
Security:   De-select everything!
Terminal:   Baudrate:   115200

#Then follow this procedure:
 
• Connect your BP to your PC
• Open a terminal to your BP
• Type "$" and then accept with "yes".
• Close/disconnect terminal
• Start the "ds30 Loader" GUI
• Adjust the ds30 GUI settings according to those above, if needed
• Load the path to the new Firmware
• Hit "Write" button
• Wait until the green progress bar is complete
• Wait a few seconds more and then disconnect your BP
• Close the "ds30 Loader"
• Reconnect BP
• Open a terminal and check the results.

#Waoh!! It works!!
HiZ>i
Bus Pirate v3b
Firmware v6.0RC (r572)  Bootloader v4.4
DEVID:0x0447 REVID:0x3046 (24FJ64GA002 B8)
http://dangerousprototypes.com
HiZ>



#To configure openocd
sudo apt-get install libtool autoconf texinfo libusb-dev libftdi-dev
#download and compile the openocd 0.8.0 http://openocd.org/2014/04/openocd-0-8-0-release/
cd code
./bootstrap
./configure --enable-maintainer-mode --disable-werror --enable-buspirate
make
sudo make install

#https://bs-security.fr/tag/buspirate.html
#Attention: the cable pinout used out there is not correct
#SeeedStudio Buspirate Cable PIN should be used instead, like below:
Marron - Pin 20 - GND
Noir - Pin 13- MISO/TDO
Pink - Pin 9 - CLK
Blanc - Pin 7 - TMS
Gris - Pin 5 - MOSI/TDI

openocd -f at91sam7s512-buspirate.cfg

root@ubuntu:~# telnet localhost 4444
Trying ::1...
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
Open On-Chip Debugger
> 
> halt
> flash erase_sector 0 0 15
erased sectors 0 through 15 on flash bank 0 in 0.258088s
> flash erase_sector 1 0 15
erased sectors 0 through 15 on flash bank 0 in 0.258331s
> flash write_image /root/proxmark3/armsrc/obj/fullimage.elf
Padding image section 0 with 5762 bytes
Padding image section 1 with 6 bytes
wrote 189104 bytes from file /root/proxmark3/armsrc/obj/fullimage.elf in 206.093323s (0.896 KiB/s)
> flash write_image /root/proxmark3/bootrom/obj/bootrom.elf
wrote 3424 bytes from file /root/proxmark3/bootrom/obj/bootrom.elf in 4.401909s (0.760 KiB/s)
>

Ports

telnet_port 4444
gdb_port 3333

Interface

interface buspirate
buspirate_port /dev/ttyUSB0
adapter_khz 1000

Communication speed

buspirate_speed normal # or fast

Voltage regulator: enabled = 1 or disabled = 0

buspirate_vreg 1

Pin mode: normal or open-drain

buspirate_mode normal

Pull-up state: enabled = 1 or disabled = 0

buspirate_pullup 1

use combined on interfaces or targets that can't set TRST/SRST separately

reset_config srst_only srst_pulls_trst

jtag newtap sam7x cpu -irlen 4 -ircapture 0x1 -irmask 0xf -expected-id 0x3f0f0f0f

target create sam7x.cpu arm7tdmi -endian little -chain-position sam7x.cpu -variant arm7tdmi

sam7x.cpu configure -event reset-init {
soft_reset_halt
mww 0xfffffd00 0xa5000004 # RSTC_CR: Reset peripherals
mww 0xfffffd44 0x00008000 # WDT_MR: disable watchdog
mww 0xfffffd08 0xa5000001 # RSTC_MR enable user reset
mww 0xfffffc20 0x00005001 # CKGR_MOR : enable the main oscillator
sleep 10
mww 0xfffffc2c 0x000b1c02 # CKGR_PLLR: 16MHz * 12/2 = 96MHz
sleep 10
mww 0xfffffc30 0x00000007 # PMC_MCKR : MCK = PLL / 2 = 48 MHz
sleep 10
mww 0xffffff60 0x00480100 # MC_FMR: flash mode (FWS=1,FMCN=72)
sleep 100

}

gdb_memory_map enable
#gdb_breakpoint_override hard
#armv4_5 core_state arm

sam7x.cpu configure -work-area-virt 0 -work-area-phys 0x00200000 -work-area-size 0x10000 -work-area-backup 0
flash bank sam7x512.flash.0 at91sam7 0 0 0 0 sam7x.cpu 0 0 0 0 0 0 0 18432
flash bank sam7x512.flash.1 at91sam7 0 0 0 0 sam7x.cpu 1 0 0 0 0 0 0 18432`