STM32F2 RDP1 core halted on JTAG connection

Embedded Security Glitching
1

Is there any way to resume stm32f2 core from halted to start firmware at 0x8000000 after connecting JTAG in OpenOCD? After glitching successfully downgrade from RDP2->RDP1, I can verify that JTAG is re-enabled using autotap as shown in screenshots #1,2. However, whenever I connect to the MCU, the core is halted as shown in screenshot #3. I tried resume 0x8000000 command and saw reg pc changed to that address but core still halted. Thanks in advanced!
jtag1

jtag2
jtag2733×396 132 KB

jtag3

2

Looking at the STM32 RDP documentation, I believe Flash and SRAM access are disabled in RDP1 if a debugger is connected so the STM won’t be able to load any code to run. You can set the PC register to 0x8000000, but nothing can be loaded from that (or any other) address.

Alex

1 Like
3

Thanks Alex! It’s indeed core halted when jtag connected in RDP1. It works as expected I guess.