topoll113 / esp32_nrf52_swd

This software brings you the possibility to Read and Write the internal Flash of the Nordic nRF52 series with an ESP32

ESP32 SWD Flasher for nRF52

This software makes it possible to Read and Write the internal Flash of the Nordic nRF52 series with an ESP32 using the SWD interface. A tool to exploit the APPROTECT vulnerability is included as well.

You can support my work via PayPal: https://paypal.me/hoverboard1 this keeps projects like this coming.

To flash an nRF52 connect the following:

• nRF52 SWDCLK to ESP32 GPIO 21
• nRF52 SWDIO to ESP32 GPIO 19
• nRF52 GND to ESP32 GND to N-Channel MOSFET GND (Optional: O-scope GND Clips)
• Then power the nRF52 as needed

To bypass the Readout protection (APPROTECT) of an nRF52 connect all of the above and the following:

• nRF52 3.3V Power VDD to ESP32 GPIO 22 (Optional: O-scope Channel 2 Probe)
• N-Channel MOSFET PWM+ to ESP32 GPIO 5 (as shown)
• N-Channel MOSFET VOUT- to nRF52 DEC1 (as shown) (Optional: O-scope Channel 1 Probe)
• Then power the nRF52 as needed

This repo is explained and demonstrated in these videos (click to watch):

Required Hardware

• ESP32 Development Board
• N-Channel MOSFET Board
• nRF52 Series Board
• Optional: Oscilloscope

Required Software

• Arduino IDE https://www.arduino.cc/
• ESP32 core Library https://github.com/espressif/arduino-esp32
• This version of the WifiManager https://github.com/tzapu/WiFiManager/tree/feature_asyncwebserver
• AsyncTCP https://github.com/me-no-dev/AsyncTCP
• ESPAsyncWebServer https://github.com/me-no-dev/ESPAsyncWebServer

HowTo:

Note: Use version 1.0.6 of the ESP32 core. Also use the source files vs the release packages.

Arduino:

(It is also possible to use PlatformIO)

• Copy or install the three downloaded libraries (AsyncTCP, ESPAsyncWebServer, WifiManager) into the Arduino > libraries directory
• Arduino > libraries: Rename:
• AsyncTCP-master to AsyncTCP
• ESPAsyncWebServer-master to ESPAsyncWebServer
• WiFiManager-master to WiFiManager
• Add the ESP32 Core to Arduino (File > Additional Boards Manager URLS > https://raw.githubusercontent.com/espressif/arduino-esp32/gh-pages/package_esp32_index.json)
• Install the ESP32 Core (Tools > Boards Manager > Search > esp32 > Select version > 1.0.6 > Install)
• Open the "ESP32_SWD_WIFI.ino" file with Arduino and select the "ESP32 Dev Module" (Tools > Board: > ESP32 Arduino > ESP32 Dev Module)
• Make sure to select "No OTA (1MB App / 3MB SPIFFS)" as the partition scheme for the ESP32 to have more space available. (Tools > Partition Scheme: > "No OTA (1MB App/3MB SPIFFS)")
• Select the ESP32 COM port (Tools > Port: > COM#)
• Click Verify
• Click Upload
• Long-press the BOOT button on ESP32 after clicking Upload, until it is showing "Uploading"
• Once it displays "Leaving... Hard resetting..." it’s done flashing and ready to setup
• The ESP32 will now create a Wifi Network with the WifiManager called: "AutoConnectAP" after connecting to the Wifi go to the ip: 192.168.4.1 in your Browser
• Configure the Wifi for your home network
• Once fully connected enter: "http://swd.local" in your internet browser and it should show a first page from the ESP32
• Go to: "http://swd.local/edit" login with admin:admin
• Click Choose File and browse for the "data/index.htm" file and click Upload
• Go to: "http://swd.local" again, the ESP32 SWD Flasher page should now be displayed
• If not already done, connect the nRF52 via SWD. Click the button "Init SWD" and wait for the response in the info page or look in the Arduino UART terminal if something doesn't work. The nRF chip should be detected and it will display a notification about whether or not the nRF52 is locked
• To flash new firmware to an nRF52 you can erase the whole chip and then flash an uploaded file via the "Flash File" button, you need to enter the correct filename
• To dump the flash content of an nRF52 enter a filename, an offset if wanted, and a size of bytes in decimal then click the "Dump to File" button and wait for it to finish
• To Glitch the nRF52 use the Delay Input to find the right spot to glitch, it should be near the small voltage drop of the DEC1 line, best is to have an Oscilloscope connected to see what is happening, but you can also just blindly find the delay as the delay will automatically increase and the ESP32 will notify when it achieves a successful glitch after clicking "Enable Glitcher" you can change the delay time on the fly

ESP32 Glitcher schematic:

nRF52832 Glitch Tip, way better results with these 2 caps removed

Credits go to LimitedResults for finding the Power glitching Exploit: https://limitedresults.com/2020/06/nrf52-debug-resurrection-approtect-bypass-part-2/