I'm planning to edit the binary Firmware for an STM32F030K6T6 ARM microcontroller used in the IKEA Fyrtur blinds. In particular I'm trying to
- disable the Voltage check (allow alternative power source)
- increase the max length, aka max motor rotation (allow longer blinds)
- decrease the operating speed (reduce noise)
There exists a custom firmware already that does this (and a lot more). Unfortunately it is very buggy, so I've decided to investigate modifying the original firmware.
I think that, using the custom firmware as a reference, we should at least be able to figure out where the Voltage is being read and what happens with it. The custom firmware also includes the default values for the three settings I want to edit.
I'm looking for some resources and a structured approach here as I am new to using radare2 and decompilation of arm instructions. Are there some plugins / other tools that I should be using?
Here are details on how to reproduce what I've done so far (using docker):
- Download binary with
wget https://github.com/dominikkarall/fyrtur-motor-board/raw/main/bin/original-fyrtur-fw.bin(alternatively can be dumped from the IKEA Blinds)
- Start radare2 docker container with
docker run --net host -v $(pwd):/user/project -w /user/project -it --entrypoint /bin/bash radare/radare2
- In docker container start radare2 with
r2 -a arm -b 16 -m 0x80000000 -w original-fyrtur-fw.bin
- Analyze and decompile with
pdf @@ fcn* > pdf.txt
pdc @@ fcn* > pdc.txt