Posts

Showing posts from February, 2021

Automotive Secured Microprocessor SPC560P40L3 Firmware Recovering

Image
Automotive Secured Microprocessor SPC560P40L3 Firmware Recovering is a process starting from  de-capsulate microprocessor’s silicon package  and locate the locked bit of SPC560P40L3, then  readout embedded program from mcu spc560p40l3 flash memory ; Below  Table  provides a summary of different members of the SPC560P34/SPC560P40 family and their features—relative to full-featured version—to enable a comparison among the family members and an understanding of the range of functionality offered within this family when  reverse engineering spc560p40l1 mcu flash program . SPC560P34/SPC560P40 is available in two configurations having different features: Full- featured and airbag.  Table 3  shows the main differences between the two versions of the SPC560P40 MCU. Analog-to-digital converter (ADC) Multi-channel, 10-bit analog-to-digital converter Boot assist module (BAM) Block of read-only memory containing VLE code which is executed according to the boo...

Reverse Engineering SPC560P40L1 MCU Flash Program

Image
Reverse Engineering SPC560P40L1 MCU Flash Program is a process to  recover embedded heximal from secured flash memory of locked microcontroller spc560p40l1 , the security fuse bit of SPC560P40L1 will be  disable so the software inside its flash memory can readout directly ; Communications interfaces 2 LINFlex channels (1× Master/Slave, 1× Master only) Up to 3 DSPI channels with automatic chip select generation (up to 8/4/4 chip selects) Up to 2 FlexCAN interface (2.0B Active) with 32 message buffers 1 safety port based on FlexCAN with 32 message buffers and up to 8 Mbit/s at 64 MHz capability usable as second CAN when not used as safety port One 10-bit analog-to-digital converter (ADC) Up to 16 input channels (16 on LQFP100 / 12 on LQFP64) Conversion time < 1 µs including sampling time at full precision Programmable Cross Triggering Unit (CTU) 4 analog watchdogs with interrupt capability On-chip CAN/UART bootstrap loader with Boot Assist Module (BAM) 1 FlexPWM unit: 8 compl...

Break STMicrocontroller SPC560P34L1 Flash Memory

Image
Break STMicrocontroller SPC560P34L1 Flash Memory needs to disable the locked bits of MCU and  restore embedded firmware content from MCU SPC560P34L1 program flash  and  copy this heximal to new secured microprocessor SPC560P34L1 ; Up to 64 MHz, single issue, 32-bit CPU core complex (e200z0h) Compliant with Power Architecture® embedded category Variable Length Encoding (VLE) Memory organization Up to 256 KB on-chip code flash memory with ECC and erase/program controller Additional 64 (4 × 16) KB on-chip data flash memory with ECC for EEPROM emulation Up to 20 KB on-chip SRAM with ECC Fail-safe protection Programmable watchdog timer Non-maskable interrupt Fault collection unit Nexus Class 1 interface Interrupts and events 16-channel eDMA controller 16 priority level controller Up to 25 external interrupts PIT implements four 32-bit timers 120 interrupts are routed via INTC. General purpose I/Os Individually programmable as input, output or special function which can be...