Aaron Christophel's Open Source Tool Unprotects, Reads, and Flashes Any nRF52 From an ESP32
Designed to unlock protected nRF52 SoCs, Christophel's tool follows on from a similar exploit discovered for protected STM8 chips.
Developer Aaron Christophel has released a tool to read and write the internal flash of any part in the Nordic Semiconductor nRF52 family — using little more than a low-cost Espressif ESP32 microcontroller.
"This software brings you the possibility to read and write the internal flash of the Nordic nRF52 series with an ESP32 using the SWD [Serial Wire Debug] interface," Christophel writes of his open source utility. "A tool to exploit the APPROTECT vulnerability is included as well."
Christophel's tool builds on work done by pseudonymous security researcher LimitedResults, who discovered a means of bypassing the "APPROTECT" flag that normally blocks the SWD interface and access to the internal flash.
"This security investigation presents a way to bypass the APPROTECT on a protected nRF52840," LimitedResults' wrote of the vulnerability, "in order to reactivate the Serial Wire Debug Interface (SWD), offering full debug capabilities on the target (R/W access to flash/RAM/registers, code exec[ution] and reprogramming). All the nRF52 versions are impacted."
The tool Christophel has built makes it easy to implement the APPROTECT bypass, using an ESP32 microcontroller — though to get the timing right for the power glitch, which unlocks the nRF52, an oscilloscope could be required — "but you can also just blindly find the delay," Christophel notes, "as the delay will increase and the ESP32 will notify about a successful glitch."
Once the SWD interface is unlocked via power glitching, the ESP32 can be used as a straightforward flashing tool to both read and write the internal flash — even if it had originally been protected.
It's not the first time power glitching has been found to unlock supposedly-protected microcontrollers: Last year Hagen Fritsch detailed how power glitching could unlock an STMicro STM8, which had been locked with read protection.
A schematic for wiring the ESP32 to an nRF52 for flashing or glitching is available on Christophel's GitHub repository, along with the full source code under the reciprocal GNU General Public License 3.
