| 194 | |
| 195 | def test_mcu_hacklock_stm32f407(self): |
| 196 | def crack(passwd): |
| 197 | ql = Qiling(["../examples/rootfs/mcu/stm32f407/backdoorlock.hex"], |
| 198 | archtype=QL_ARCH.CORTEX_M, ostype=QL_OS.MCU, env=stm32f407, verbose=QL_VERBOSE.OFF) |
| 199 | |
| 200 | ql.hw.create('spi2') |
| 201 | ql.hw.create('gpioe') |
| 202 | ql.hw.create('gpiof') |
| 203 | ql.hw.create('usart1') |
| 204 | ql.hw.create('rcc') |
| 205 | |
| 206 | print('Testing passwd', passwd) |
| 207 | |
| 208 | ql.patch(0x8000238, b'\x00\xBF' * 4) |
| 209 | ql.patch(0x80031e4, b'\x00\xBF' * 11) |
| 210 | ql.patch(0x80032f8, b'\x00\xBF' * 13) |
| 211 | ql.patch(0x80013b8, b'\x00\xBF' * 10) |
| 212 | |
| 213 | ql.hw.usart1.send(passwd.encode() + b'\r') |
| 214 | |
| 215 | ql.hw.systick.set_ratio(400) |
| 216 | |
| 217 | ql.run(count=400000, end=0x8003225) |
| 218 | |
| 219 | return ql.arch.effective_pc == 0x8003225 |
| 220 | |
| 221 | self.assertTrue(crack('618618')) |
| 222 | self.assertTrue(crack('778899')) |