An Interesting Find: STM32 RDP1 "Decryptor"

2026-03-01T00:00:00+00:00

Recently while browsing Xianyu (闲鱼)</a> looking for BYK-series chips (Sinowealth 8051 MCUs) for another project I'm working on, I stumbled across something peculiar: a device claiming to bypass STM32 RDP1 (Read-Out Protection Level 1) on F0, F1, F2 and F4 series chips. As it turns out, there's a whole market for these if you search for "STM32解密"</a> (STM32 decryption).</p>

</a>

a picture from one of the many "STM32 decryptor" listings on Xianyu</figcaption> </figure>

At about 150 yuan, roughly 19 EUR plus shipping and forwarding on top, I decided to bite the bullet and just buy one to see if it actually works.</p>

What arrived §</a> </h2>
The package contained a blue USB dongle (the programmer), two green adapter PCBs, a row of double and a row of single 2.54mm pin headers and a couple of 10K resistors.</p>
</a>
everything that came in the package</figcaption> </figure>
The adapter boards have footprints for the various packages of F0, F1 and F2/F4 chips, along with pads for decoupling capacitors on the necessary VCAP pins and a resistor pulling BOOT1 down. I had to supply the 0.1uF caps for the VCAP pads myself.</p>
</a> </figure>
Testing with an STM32F205RBT6 §</a> </h2>
I had an STM32F205RBT6 lying around, so I desoldered it and placed it on the adapter board.</p>
</a>
STM32F205RBT6 soldered onto the adapter board and plugged into the dongle</figcaption> </figure>
The device comes with a Windows utility. Before I could even get it running, I had to deal with a couple of hurdles. First, the software immediately triggers Windows Defender, probably for good reason. Since I was running this in a throwaway VM anyway, I just turned it off. Second, the application wouldn't launch until I changed the system encoding for non-Unicode programs to Chinese Simplified in the Windows 11 regional settings (`Settings > Time & language > Language & region > Language for non-Unicode programs > Chinese (Simplified, Mainland China)</code>).</p>`
`The instructions that came with the device recommended using freeze spray on the chip during the read process. I was ready for that, but it turned out to be unnecessary in my case. It read just fine at room temperature.</p>`
</a> the host Windows application showing a successful flash readout. The failed validation message at the bottom is probably related to the overshoot and can be ignored.</figcaption> </figure> One quirk: the software would always overshoot when reading. A STM32F205RB has 128KB of flash, but the tool would happily read past that boundary, padding everything beyond it with 0xFF</code>. The actual flash contents within the valid 128KB region were correct though, so it's easy enough to just trim the output to the right size.</p> Conclusion§</a> </h2> This thing actually works. It successfully dumped the full flash contents of an RDP1-protected STM32F205RBT6 without needing to introduce any external faults like cooling the chip down.</p> To be clear, this device is not the first to allow circumventing RDP1. There have already been documented ways for most of these devices: voltage glitching on STM32F4</a>, the Exception(al) Failure</a> debug interface exploit on STM32F1, Cold-Boot Stepping</a> on STM32F0, and reproducible glitching setups</a> with open-source tooling. But all of these require understanding the attack, building or buying a glitching rig, and tuning parameters. A turnkey product like this one just lets you solder the chip onto the adapter and click a button. It's both concerning and exciting.</p> Finally, other than glancing at the PCB, which has an SOP-16 IC with the label scraped off (presumably the microcontroller), I haven't tried analyzing how this device works yet. The Windows-only host app is not great either, but shouldn't be too hard to recreate it if someone wanted to. Might have to take a closer look at what's going on under the hood sometime. Or hopefully someone else will!</p>

racknex UM-SBC-209 + TI LP5012

2025-03-29T00:00:00+00:00

As you might have seen from my previous post</a>, my RPi cluster is housed in a racknex UM-SBC-209</a> case. It's a great case that I utilized to the max by setting up my RPis with poe+ hats, custom hats</a> that I made to expose i2c via two qwiic</a> (jst sh) connectors and an additional 5v fan header that I use to connect to Noctua NF-A4x10 5V</a> fans. I had made keystone holder</a> for a tiny OLED display and had it connected via the same Qwiic connectors. The only thing left untouched were the holes for the LEDs.</p>

</a> </figure>

I wasn’t keen on wiring 3mm LEDs directly to individual GPIOs on the board. That's why my Qwiic hat was designed with two connectors instead of just one, though the second connector had been sitting idle for quite some time.</p>

Finally, I decided it was time to put it to good use.</p>

Electronics §</a> </h2>
First off, I found a led controller. The TI LP50xx</a> seemed like a great choice, since:</p>

it's driven through i2c</li>
the LP5012 supports up to 4 RGB LEDs</li>
the linux kernel has had a driver</a> for it for years now.</li> </ul>
I went ahead and designed a simple board for it, and there's not much to say about except that it's now open source</a>.</p>
When making a board this time around, instead of soldering components onto the board myself like I usually do, I took a gamble on the first revision and ordered it assembled by JLCPCB</a> instead of assembling it myself.</p>
</a> </figure>
</a> </figure> </p>
Surprisingly, everything worked on the first try!</p>
A big shout-out to the maintainers of i2c-tools</a>. This toolset was invaluable for quickly verifying that both the controller and LEDs were functioning correctly before proceeding to load the kernel driver via the device tree.</p>
Bracket §</a> </h2>
Even though this board works perfectly, it can't just float in mid-air. It needs to be securely positioned to align precisely with the LED holes. To solve this, I designed a custom bracket that fits snugly between the keystone frame, the Raspberry Pi and the bends of the front faceplate.</p>

carlossless

An Interesting Find: STM32 RDP1 "Decryptor"

racknex UM-SBC-209 + TI LP5012