Restore grinded off markings of STM32 MCU via JTAG

Question

I have a board with presumably an STM32 mcu. I want to make custom firmware for that board as the stock one is very buggy. Unfortunately the board manufacturers were kind enough to grind off all the markings. Is there any way to get the device/family id via jtag and cross reference it to a model number? Everything I could find was about getting the unique id of the chip, which is NOT what I need.

Answer 1

You can get down to a family of STM32 through the JTAG IDCODE of the device, but getting to the exact part number will require more guessing, like actual flash and ram size, or optional features.

I would do the following:

• get IDCODE from boundary scan JTAG TAP, confirm it is ST and STM;
• look for it in manuals from ST, get to the family;
• see whether the family implements the flash identification feature (some families expose flash size and page size at fixed offsets in memory space);
• if not, probe for actual flash size through memory accesses (dichotomy in plausible address space will give good results);
• do the same for ram.

At last, you know for sure the package you have on the board. With this, you should be able to narrow down to the matching part number.

Answer 2

If you have access to a boot loader UART you can use stm32flash to identify and program the device, unless it is locked down.

Answer 3

In pystlink (SWD programmer) is implementation, which almost successfully identify any STM32 MCU.

The principle is:

1. read PART_NO from register CPUID at address 0xe000ed00 and with this is possible to identify if MCU is CortexM0, M3, M4, .. in this file stm32devices.py
2. read IDCODE_REG (M0 and M0+ has this register on different address than M3, M4 and M7) first 12bits is DEV_ID, which identify family and again look into stm32devices.py file
3. read flash size from register FLASH_SIZE_REG (each family has this register on different address) and identify concrete device again by stm32devices.py file

Or simply connect SWD and keep pystlink to detect right MCU.