- Published on
Dumping firmware and wifi credentials from a Particle Photon over SWD
- Authors
- Name
- Peter Peerdeman
- @peterpeerdeman
Working through an STM32 course I remembered I still have a couple old Particle Photons and wanted to try the debug interface on something real instead of a dev board. The Photon is a nice target, it is an STM32F205 with the SWD pins are easily accessible. At couple wires and commands later I was confronted with my wifi SSID and password passing in plaintext, reminding me of the sensitivity of our IOT devices.
About SWD
Serial Wire Debug is ARM's two wire debug interface, kind of like JTAG. Two pins, SWDIO and SWCLK, and the debugger can halt the core, read and write registers, and read and write flash. It is the same mechanism used by IDE's to debug and step through code. On a STM32 there is a programmable e-fuse called readout protection that you can set once if you want the SWD interface disabled. Luckily for this experiment, the Photon ships with the e-fuse "in tact".
wiring the ST-Link to the board
The target needs power, either from its own supply or from the debugger, and the SWCLK (clock) and SWDIO (input output) need to be connected. In practice you want to connect NRST (reset) as well The STM32 discovery boards have an ST-link interface built in. Please remember to remove the ST-link jumpers if you want to use the SWD interface, otherwise it'll connect to the discover board STM32 chip.
The ST-Link CN4 connector is:
| Pin | Designation | Note |
|---|---|---|
| 1 | VDD_TARGET | VDD from the application |
| 2 | SWCLK | SWD clock |
| 3 | GND | ground |
| 4 | SWDIO | SWD data in/out |
| 5 | NRST | reset of the target |
| 6 | SWO | reserved |
On the Photon, SWDIO is PA13 and SWCLK is PA14, with NRST on the corner of the board. We Put the Photon in DFU mode first by hold MODE and tapping RESET, and releasing MODE when the LED blinks yellow
With the connection up, the CubeProgrammer software can be used to the entire flash, including the stored wifi password, as the device has to be able to bring up wifi unattended, and there is no secure element on this hardware to keep / hide it in.
The project has made me realise that any IOT device you give away, sell or throw out is a copy of your wifi password, a microcontroller in an e-waste bin is a text file with your passphrase in it, leaving your network wide open to an attacker. Combined with modern IOT devices that are physically reachable outside of your house, this is provides an interesting attack vector, which can be partly mitigated by put these devices on their own SSID or VLAN