STM32F303 with Level 2 protection

I have a STM32F303 chip which cannot enter bootloader mode and I assume it has protection level 2 activated. The SW-DP port also appears to be forbidden, even though it’s available on the PCB. I think its purpose has been to allow programming the board, and the firmware disables the interface afterwards (and also sets level 2 protection).

I’d like to dump the firmware of the STM. What would be a viable strategy? I remember reading somewhere about a light exposure attack; that’s way above my abilities. However what I have is a ChipShouter which I’d love to put to the test :slight_smile:

Hi,

You should be able to downgrade to protection level 1 via a glitch (one of the attacks mentioned here: View of Shaping the Glitch: Optimizing Voltage Fault Injection Attacks). That will allow you to access the SRAM once via a debugger. That causes flash access to be disabled, however, so the core will probably halt once you try accessing SRAM.

Alex