I have an .exe file, which connects via USB to a STM32F303 peripheral with unknown firmware. The .exe is able to update the STM32 firmware via the USB. The firmware update is also provided, and its extension is .fwu (I would assume that stands for firmware update).

I have no knowledge on what bootloader is used in the STM32. Unfortunately I don't have the peripheral itself. My insights on the .exe are also quite limited, as it will not work if the peripheral is not connected; all I know is that it attaches to the STM32, which provides a virtual COM port.

What I did so far:

  • Ran binwalk on the firmware update - no hits
  • Tried to extract .bin file from the firmware update, hoping that it is a plain .dfu file - failed
  • Ran strings on the firmware update - no hits. Maybe the file is encrypted - here's the entropy analysis result:
    0             0x0             Rising entropy edge (0.974136)
    36864         0x9000          Falling entropy edge (0.838064)
  • Did same on the .exe - it is not encrypted, strings are plain text

My aim here is to see what is the protocol used between the .exe and the STM32; that would have been easier if I had the peripheral, but I have no way of obtaining it at the moment. Initially I thought I would be able to reverse-engineer the firmware update and flash my own device, but the (probably) custom bootloader is stopping me.

I'd like to hear suggestions on how to proceed with the analysis.

  • One of possible configuration is that there is separate USB to UART converter on board (that is how most of STM development boards do it) which then do normal firmware update. Nov 8 '21 at 6:26
  • There's no converter on the board - I have a picture of the hardware where I can see that signals USB_DP and USB_DM are connected from the MCU to the USB port.
    – Slav
    Nov 8 '21 at 7:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.