September 2024
Intermediate to advanced
408 pages
7h 29m
English
First documented in Brosch (2015), this chapter describes an exploit for extracting protected memory from the nRF51822 despite code protection features. The vulnerability is that while the debugger cannot read protected memory directly or write shellcode to SRAM, it can single-step through the protected code in flash memory.
Although this version is described for the nRF51 series, a similar bug is described in Obermaier, Schink, and Moczek (2020) for the CKS32F103 and GD32VF103, which are clones of the popular STM32F103. Kovrizhnykh (2023) notes that the SN32F248B from Sonix has been exploited by the same technique.
The nRF51’s protection mechanism, documented in Chapter 9 of Nordic (2014), is built ...
Read now
Unlock full access