OI!STER: Difference between revisions
Unbinawiki (talk | contribs) No edit summary |
Unbinawiki (talk | contribs) mNo edit summary |
||
(135 intermediate revisions by the same user not shown) | |||
Line 1: | Line 1: | ||
{{PAGEBANNER:Oister_banner.jpg|origin=625,150}} | |||
The OI!STER is an STM32L5 Target Board with a QFP48 clamshell socket aimed at debugging and glitching salvaged MCUs. The board can be powered via USB-C, a 2032 coin cell battery on the back of the board or an external power suppy. All pins are broken out in the 24-pin headers on either side at the top of the board. The OI!STER contains five debug headers, to support a wide range of debugging hardware such as a [https://hydrabus.com/hydrabus-1-0-specifications/ Hydrabus] or a [https://1bitsquared.com/products/black-magic-probe Black Magic Probe]. It comes with six SMA connectors arranged in I/O pairs. One pair is dedicated to glitching the external LSE clock, another for glitching the external HSE clock and one pair for power analysis and fault injection with a [https://www.newae.com/chipwhisperer Chipwhisperer]. Each SMA connector can be bypassed by removing a small jumper. The OI!STER also has additional solder jumpers for the external clocks and each of the power traces to the MCU to allow for quick experimentation. | The OI!STER is an STM32L5 Target Board with a QFP48 clamshell socket aimed at debugging and glitching salvaged MCUs. The board can be powered via USB-C, a 2032 coin cell battery on the back of the board or an external power suppy. All pins are broken out in the 24-pin headers on either side at the top of the board. The OI!STER contains five debug headers, to support a wide range of debugging hardware such as a [https://hydrabus.com/hydrabus-1-0-specifications/ Hydrabus] or a [https://1bitsquared.com/products/black-magic-probe Black Magic Probe]. It comes with six SMA connectors arranged in I/O pairs. One pair is dedicated to glitching the external LSE clock, another for glitching the external HSE clock and one pair for power analysis and fault injection with a [https://www.newae.com/chipwhisperer Chipwhisperer]. Each SMA connector can be bypassed by removing a small jumper. The OI!STER also has additional solder jumpers for the external clocks and each of the power traces to the MCU to allow for quick experimentation. | ||
<br><br> | |||
The Pinout diagrams below are directed at reverse engineering. The first diagram is targeted at debugging and reverse engineering an STM32L5 MCU itself. The second diagram is aimed at the communication between external peripherals and the MCU. Although some functionaly might overlap, we've found it practical to define these two pinout groups. Additional documentation is currently under development. | |||
<br><br> | |||
<div id="OisterCarousel" class="carousel slide carousel-slide" data-ride="carousel" data-interval="5000" style="filter: invert(100%);> | |||
<!-- Indicators --> | |||
<ol class="carousel-indicators mb-2"> | |||
<li data-target="#OisterCarousel" data-slide-to="0" class="active" style="background-color: #C6C2B6"></li> | |||
<li data-target="#OisterCarousel" data-slide-to="1" style="background-color: #C6C2B6"></li> | |||
<li data-target="#OisterCarousel" data-slide-to="2" style="background-color: #C6C2B6"></li> | |||
</ol> | |||
<!-- Controls --> | |||
<ol class="carousel-control"> | |||
<li class="carousel-control-prev" data-target="#OisterCarousel" role="button" data-slide="prev"> | |||
<span class="carousel-control-prev-icon" aria-hidden="true"></span> | |||
<span class="sr-only">Previous</span> | |||
</li> | |||
<li class="carousel-control-next" data-target="#OisterCarousel" role="button" data-slide="next"> | |||
<span class="carousel-control-next-icon" aria-hidden="true"></span> | |||
<span class="sr-only">Next</span> | |||
</li> | |||
</ol> | |||
<!-- Carousel items --> | |||
<div class="carousel-inner"> | |||
<div class="carousel-item active">[[Image:OISTER-DIAG-30.png|class=img-fluid d-block w-100]]</div> | |||
<div class="carousel-item">[[Image:OISTER-30.png|class=img-fluid d-block w-100]]</div> | |||
<div class="carousel-item">[[Image:OISTER-PCB-30.png|class=img-fluid d-block w-100]]</div> | |||
</div> | |||
</div> | |||
<br> | |||
=='''Debug Pinout Diagram'''== | |||
[[Image:OISTER Pinout DBG-50.png | class=img-fluid]] | |||
<br> | |||
{| class="wikitable" cellspacing=5 cellpadding=5 | |||
|+ | |||
! colspan="3" |Debug Pinout | |||
|- | |||
! width="50" colspan="1" scope="col" |Pin | |||
! width="100" colspan="1" scope="col" |Function | |||
! width="150" scope="col" |Alternate Function | |||
|- | |||
! scope="row" |1 | |||
|VBAT | |||
|- | |||
! scope="row" |2 | |||
|PC13 | |||
|- | |||
! scope="row" |3 | |||
|PC14 | |||
| OSC32_IN | |||
|- | |||
! scope="row" |4 | |||
|PC15 | |||
|OSC32_OUT | |||
|- | |||
! scope="row" | 5 | |||
|PH0 | |||
|OSC_IN | |||
|- | |||
! scope="row" |6 | |||
|PH1 | |||
|OSC_OUT | |||
|- | |||
! scope="row" |7 | |||
|NRST | |||
|- | |||
! scope="row" |8 | |||
|VSSA | |||
|VREF- | |||
|- | |||
! scope="row" |9 | |||
|VDDA | |||
|VREF+ | |||
|- | |||
! scope="row" | 10 | |||
|PA0 | |||
|UART4_TX | |||
|- | |||
! scope="row" |11 | |||
|PA1 | |||
|UART4_RX | |||
|- | |||
! scope="row" |12 | |||
|PA2 | |||
|LPUART1_TX | |||
|- | |||
! scope="row" |13 | |||
|PA3 | |||
|LPUART1_RX | |||
|- | |||
! scope="row" |14 | |||
|PA4 | |||
|USART2_CK | |||
|- | |||
! scope="row" |15 | |||
|PA5 | |||
|- | |||
! scope="row" |16 | |||
|PA6 | |||
|LPUART1_CTS | |||
|- | |||
! scope="row" |17 | |||
|PA7 | |||
|- | |||
! scope="row" | 18 | |||
|PB0 | |||
|LED1 | |||
|- | |||
! scope="row" |19 | |||
|PB1 | |||
|LED2 | |||
|- | |||
! scope="row" |20 | |||
|PB2 | |||
|UCPD1_FRSTX2 | |||
|- | |||
! scope="row" |21 | |||
| PB10 | |||
|USART3_TX | |||
|- | |||
! scope="row" |22 | |||
|PB11 | |||
|USART3_RX | |||
|- | |||
! scope="row" |23 | |||
|VSS | |||
|- | |||
! scope="row" |24 | |||
|VDD | |||
|- | |||
! scope="row" |25 | |||
|PB12 | |||
|LPUART1_RTS | |||
|- | |||
! scope="row" |26 | |||
|PB13 | |||
|LPUART1_CTS | |||
|- | |||
! scope="row" |27 | |||
|PB14 | |||
|UCPD1_DB2 | |||
|- | |||
! scope="row" |28 | |||
|PB15 | |||
|UCPD1_CC2 | |||
|- | |||
! scope="row" |29 | |||
|PA8 | |||
|USART1_CK | |||
|- | |||
! scope="row" |30 | |||
|PA9 | |||
|USART1_TX | |||
|- | |||
! scope="row" |31 | |||
|PA10 | |||
|USART1_RX | |||
|- | |||
! scope="row" |32 | |||
|PA11 | |||
|USART1_CTS | |||
|- | |||
! scope="row" |33 | |||
|PA12 | |||
|USART1_RTS | |||
|- | |||
! scope="row" |34 | |||
| PA13 | |||
|JTMS | |||
|- | |||
! scope="row" |35 | |||
|VSS_2 | |||
|- | |||
! scope="row" |36 | |||
|VDD_2 | |||
|- | |||
! scope="row" |37 | |||
|PA14 | |||
|JTCK | |||
|- | |||
! scope="row" |38 | |||
|PA15 | |||
|JTDI | |||
|- | |||
! scope="row" |39 | |||
|PB3 | |||
| JTDO | |||
|- | |||
! scope="row" |40 | |||
|PB4 | |||
|NJTRST | |||
|- | |||
! scope="row" | 41 | |||
|PB5 | |||
|UCPD1_DB1 | |||
|- | |||
! scope="row" |42 | |||
|PB6 | |||
|USART1_TX | |||
|- | |||
! scope="row" |43 | |||
|PB7 | |||
|UART4_CTS | |||
|- | |||
! scope="row" |44 | |||
|PH3 | |||
|BOOT0 | |||
|- | |||
! scope="row" |45 | |||
|PB8 | |||
|- | |||
! scope="row" | 46 | |||
|PB9 | |||
|- | |||
! scope="row" |47 | |||
|VSS_3 | |||
|- | |||
! scope="row" |48 | |||
|VDD_3 | |||
|} | |||
=='''Protocol Pinout Reference'''== | |||
{| class="wikitable" cellspacing=5 cellpadding=5 | |||
|+ | |||
! colspan="3" |'''USB''' | |||
|- | |||
! width="50" colspan="1" scope="col" |Pin | |||
! width="150" colspan="1" scope="col" |Function | |||
! width="200" colspan="1" scope="col" |Description | |||
|- | |||
|- | |||
! scope="row" |32 | |||
|USB_DM | |||
|Data - | |||
|- | |||
! scope="row" |33 | |||
|USB_DP | |||
| Data + | |||
|- | |||
! scope="row" |34 | |||
|USB_NOE | |||
|Output Enable | |||
|} | |||
{| class="wikitable" cellspacing=5 cellpadding=5 | |||
|+ | |||
| colspan="3" |'''UCPD1''' | |||
|- | |||
! width="50" colspan="1" scope="col" |Pin | |||
! width="150" colspan="1" scope="col" |Function | |||
! width="200" colspan="1" scope="col" |Description | |||
|- | |||
! scope="row" |12 | |||
|UCPD1_FRSTX1 | |||
|Fast Role Swap Signal | |||
|- | |||
! scope="row" |20 | |||
|UCPD1_FRSTX2 | |||
|Fast Role Swap Signal | |||
|- | |||
! scope="row" | 27 | |||
|UCPD1_DB2 | |||
|Dead-Battery Signal | |||
|- | |||
! scope="row" |28 | |||
|UCPD1_CC2 | |||
|Configuration Control Line | |||
|- | |||
! scope="row" |38 | |||
|UCPD1_CC1 | |||
|Configuration Control Line | |||
|- | |||
! scope="row" |41 | |||
|UCPD1_DB1 | |||
|Dead-Battery Signal | |||
|} | |||
{| class="wikitable" cellspacing=5 cellpadding=5 | |||
|+ | |||
| colspan="3" |'''UART4''' | |||
|- | |||
! width="50" colspan="1" scope="col" |Pin | |||
! width="150" colspan="1" scope="col" |Function | |||
! width="200" colspan="1" scope="col" |Description | |||
|- | |||
! scope="row" |10 | |||
|UART4_TX | |||
| Transmit Data | |||
|- | |||
! scope="row" |11 | |||
|UART4_RX | |||
|Receive Data | |||
|- | |||
! scope="row" |38 | |||
|UART4_RTS | |||
|Request To Send | |||
|- | |||
! scope="row" |43 | |||
|UART4_CTS | |||
|Clear To Send | |||
|} | |||
{| class="wikitable" cellspacing=5 cellpadding=5 | |||
|+ | |||
| colspan="4" |'''LPUART1''' | |||
|- | |||
! width="60" colspan="2" scope="col" |Pin | |||
! width="150" colspan="1" scope="col" |Function | |||
! width="200" colspan="1" scope="col" |Description | |||
|- | |||
! scope="row" |12 | |||
! scope="row" |22 | |||
|LPUART1_TX | |||
|Transmit Data | |||
|- | |||
! scope="row" |13 | |||
! scope="row" |21 | |||
|LPUART1_RX | |||
|Receive Data | |||
|- | |||
! scope="row" |16 | |||
! scope="row" | 26 | |||
| LPUART1_CTS | |||
| Clear To Send | |||
|- | |||
! scope="row" |19 | |||
! scope="row" | 25 | |||
|LPUART1_RTS | |||
|Request To Send | |||
|} | |||
{| class="wikitable" cellspacing=5 cellpadding=5 | |||
|+ | |||
| colspan="4" |'''USART1''' | |||
|- | |||
! width="60" colspan="2" scope="col" |Pin | |||
! width="150" colspan="1" scope="col" |Function | |||
! width="200" colspan="1" scope="col" |Description | |||
|- | |||
! scope="row" |29 | |||
! scope="row" |41 | |||
|USART1_CK | |||
|Transmitter Clock | |||
|- | |||
! scope="row" | 30 | |||
! scope="row" |42 | |||
|USART1_TX | |||
|Transmit Data | |||
|- | |||
! scope="row" |31 | |||
! scope="row" | 43 | |||
|USART1_RX | |||
|Receive Data | |||
|- | |||
! scope="row" |32 | |||
! scope="row" |40 | |||
|USART1_CTS | |||
| Clear To Send | |||
|- | |||
! scope="row" |32 | |||
! scope="row" |40 | |||
|USART1_NSS | |||
|Slave Select | |||
|- | |||
! scope="row" |33 | |||
! scope="row" | 39 | |||
|USART1_RTS | |||
| Request To Send | |||
|- | |||
! scope="row" |33 | |||
! scope="row" | 39 | |||
|USART1_DE | |||
|Driver Enable | |||
|} | |||
{| class="wikitable" cellspacing=5 cellpadding=5 | |||
|+ | |||
| colspan="4" |'''USART2''' | |||
|- | |||
! width="60" colspan="2" scope="col" |Pin | |||
! width="150" colspan="1" scope="col" |Function | |||
! width="200" colspan="1" scope="col" |Description | |||
|- | |||
! scope="row" |10 | |||
! scope="row" | | |||
|USART2_CTS | |||
|Clear To Send | |||
|- | |||
! scope="row" |10 | |||
! scope="row" | | |||
|USART2_NSS | |||
|Slave Select | |||
|- | |||
! scope="row" |11 | |||
! scope="row" | | |||
|USART2_RTS | |||
|Request To Send | |||
|- | |||
! scope="row" |11 | |||
! scope="row" | | |||
|USART2_DE | |||
|Driver Enable | |||
|- | |||
! scope="row" |12 | |||
! scope="row" | | |||
| USART2_TX | |||
| Transmit Data | |||
|- | |||
! scope="row" |13 | |||
! scope="row" |38 | |||
|USART2_RX | |||
|Receive Data | |||
|- | |||
! scope="row" |14 | |||
! scope="row" | | |||
|USART2_CK | |||
|Transmitter Clock | |||
|} | |||
{| class="wikitable" cellspacing=5 cellpadding=5 | |||
|+ | |||
| colspan="5" |'''USART3''' | |||
|- | |||
! width="90" colspan="3" scope="col" |Pin | |||
! width="150" colspan="1" scope="col" |Function | |||
! width="200" colspan="1" scope="col" |Description | |||
|- | |||
! scope="row" |16 | |||
! scope="row" |26 | |||
! scope="row" | | |||
|USART3_CTS | |||
|Clear To Send | |||
|- | |||
! scope="row" |16 | |||
! scope="row" |26 | |||
! scope="row" | | |||
|USART3_NSS | |||
|Slave Select | |||
|- | |||
! scope="row" |18 | |||
! scope="row" |25 | |||
! scope="row" | | |||
|USART3_CK | |||
|Transmitter Clock | |||
|- | |||
! scope="row" | 19 | |||
! scope="row" |27 | |||
! scope="row" |38 | |||
|USART3_RTS | |||
|Request To Send | |||
|- | |||
! scope="row" |21 | |||
! scope="row" | 27 | |||
! scope="row" |38 | |||
|USART3_DE | |||
| Driver Enable | |||
|- | |||
! scope="row" |21 | |||
! scope="row" | | |||
! scope="row" | | |||
|USART3_TX | |||
|Transmit Data | |||
|- | |||
! scope="row" |22 | |||
! scope="row" | | |||
! scope="row" | | |||
|USART3_RX | |||
|Request Data | |||
|} | |||
{| class="wikitable" cellspacing=5 cellpadding=5 | |||
|+ | |||
| colspan="3" |'''JTAG''' | |||
|- | |||
! width="50" colspan="1" scope="col" |Pin | |||
! width="150" colspan="1" scope="col" |Function | |||
! width="200" colspan="1" scope="col" |Description | |||
|- | |||
! scope="row" |34 | |||
|JTMS | |||
|Test Mode State | |||
|- | |||
! scope="row" |37 | |||
|JTCK | |||
|Test Clock | |||
|- | |||
! scope="row" |38 | |||
|JTDI | |||
|Test Data In | |||
|- | |||
! scope="row" |39 | |||
|JTDO | |||
|Test Data Out | |||
|- | |||
! scope="row" |40 | |||
|NJTRST | |||
|Reset | |||
|} | |||
{| class="wikitable" cellspacing=5 cellpadding=5 | |||
|+ | |||
| colspan="3" |'''SWD''' | |||
|- | |||
! width="50" colspan="1" scope="col" |Pin | |||
! width="150" colspan="1" scope="col" |Function | |||
! width="200" colspan="1" scope="col" |Description | |||
|- | |||
! scope="row" |7 | |||
|NRST | |||
|Reset | |||
|- | |||
! scope="row" |34 | |||
|SWDIO | |||
|Data I/O | |||
|- | |||
! scope="row" |37 | |||
|SWCLK | |||
|Clock | |||
|- | |||
! scope="row" |39 | |||
|TRACESWO | |||
|Trace Output | |||
|} | |||
{| class="wikitable" cellspacing=5 cellpadding=5 | |||
|+ | |||
| colspan="3" |'''OSC''' | |||
|- | |||
[[ | ! width="50" colspan="1" scope="col" |Pin | ||
<br> | ! width="150"colspan="1" scope="col" |Function | ||
! width="350" colspan="1" scope="col" |Description | |||
|- | |||
! scope="row" |5 | |||
|OSC_IN | |||
|High Speed External Clock In (HSEI) | |||
|- | |||
! scope="row" |6 | |||
|OSC_OUT | |||
|High Speed External Clock Out (HSEO) | |||
|} | |||
{| class="wikitable" cellspacing=5 cellpadding=5 | |||
|+ | |||
| colspan="3" |'''OSC32''' | |||
|- | |||
! width="50" colspan="1" scope="col" |Pin | |||
! width="150" colspan="1" scope="col" |Function | |||
! width="350" colspan="1" scope="col" |Description | |||
|- | |||
! scope="row" |3 | |||
|OSC32_IN | |||
|Low Speed External Clock In (LSEI) | |||
|- | |||
! scope="row" |4 | |||
|OSC32_OUT | |||
|Low Speed External Clock Out (LSEO) | |||
|} | |||
=='''Peripheral Pinout Diagram'''== | |||
[[Image:OISTER Peripheral Pinout.png | class=img-fluid]] | |||
<br> | |||
{| class="wikitable"" cellspacing=5 cellpadding=5 | |||
|+ | |||
| colspan="6" |'''Peripheral Pinout''' | |||
|- | |||
! width="50" colspan="1" scope="col" |Pin | |||
! width="100" colspan="1" scope="col" |Function | |||
! width="150" colspan="1" scope="col" |Alternate | |||
! width="150" colspan="1" scope="col" | | |||
! width="150" colspan="1" scope="col" | | |||
! width="150" colspan="1" scope="col" | | |||
|- | |||
! scope="row" |1 | |||
|VBAT | |||
|- | |||
! scope="row" |2 | |||
|PC13 | |||
|- | |||
! scope="row" | 3 | |||
|PC14 | |||
|- | |||
! scope="row" |4 | |||
|PC15 | |||
|- | |||
! scope="row" |5 | |||
|PH0 | |||
|- | |||
! scope="row" |6 | |||
|PH1 | |||
|- | |||
! scope="row" | 7 | |||
|NRST | |||
|- | |||
! scope="row" |8 | |||
|VSSA | |||
|- | |||
! scope="row" | 9 | |||
|VDDA | |||
|- | |||
! scope="row" |10 | |||
|PA0 | |||
|- | |||
! scope="row" |11 | |||
|PA1 | |||
| I2C1_SMBA | |||
|SPI1_SCK | |||
|- | |||
! scope="row" |12 | |||
|PA2 | |||
|OCTOSPI1_NCS | |||
|- | |||
! scope="row" |13 | |||
|PA3 | |||
|OCTOSPI1_CLK | |||
|- | |||
! scope="row" |14 | |||
|PA4 | |||
|SPI1_NSS | |||
|SPI3_NSS | |||
|OCTOSPI1_NCS | |||
|- | |||
! scope="row" |15 | |||
| PA5 | |||
|SPI1_SCK | |||
|- | |||
! scope="row" |16 | |||
|PA6 | |||
|SPI1_MISO | |||
|OCTOSPI1_IO3 | |||
|- | |||
! scope="row" |17 | |||
|PA7 | |||
|I2C3_SCL | |||
|SPI1_MOSI | |||
|OCTOSPI1_IO2 | |||
|- | |||
! scope="row" |18 | |||
|PB0 | |||
|SPI1_NSS | |||
| OCTOSPI1_IO1 | |||
|- | |||
! scope="row" |19 | |||
|PB1 | |||
|OCTOSPI1_IO0 | |||
|- | |||
! scope="row" |20 | |||
|PB2 | |||
|I2C3_SMBA | |||
|- | |||
! scope="row" | 21 | |||
|PB10 | |||
|I2C2_SCL | |||
|I2C4_SCL | |||
|SPI2_SCK | |||
|OCTOSPI1_CLK | |||
|- | |||
! scope="row" |22 | |||
|PB11 | |||
|I2C2_SDA | |||
|I2C4_SDA | |||
|OCTOSPI1_NCS | |||
|- | |||
! scope="row" |23 | |||
|VSS | |||
|- | |||
! scope="row" | 24 | |||
|VDD | |||
|- | |||
! scope="row" |25 | |||
|PB12 | |||
|I2C2_SMBA | |||
| SPI2_NSS | |||
|OCTOSPI_NCLK | |||
|- | |||
! scope="row" |26 | |||
|PB13 | |||
|I2C2_SCL | |||
|SPI2_SCK | |||
|- | |||
! scope="row" |27 | |||
|PB14 | |||
|I2C2_SDA | |||
|SPI2_MISO | |||
|- | |||
! scope="row" | 28 | |||
|PB15 | |||
|SPI2_MOSI | |||
|- | |||
! scope="row" |29 | |||
|PA8 | |||
|- | |||
! scope="row" |30 | |||
|PA9 | |||
|SPI2_SCK | |||
|- | |||
! scope="row" |31 | |||
|PA10 | |||
|- | |||
! scope="row" | 32 | |||
|PA11 | |||
|SPI1_MISO | |||
|FDCAN1_RX | |||
|- | |||
! scope="row" |33 | |||
|PA12 | |||
|SPI1_MOSI | |||
|FDCAN1_TX | |||
|- | |||
! scope="row" |34 | |||
|PA13 | |||
|- | |||
! scope="row" |35 | |||
|VSS_2 | |||
|- | |||
! scope="row" |36 | |||
|VDD_2 | |||
|- | |||
! scope="row" |37 | |||
|PA14 | |||
|I2C1_SMBA | |||
| I2C4_SMBA | |||
|- | |||
! scope="row" |38 | |||
|PA15 | |||
|SPI1_NSS | |||
|SPI3_NSS | |||
|- | |||
! scope="row" |39 | |||
|PB3 | |||
|SPI1_SCK | |||
|SPI3_SCK | |||
|- | |||
! scope="row" |40 | |||
|PB4 | |||
|I2C3_SDA | |||
|SPI1_MISO | |||
|SPI3_MISO | |||
|- | |||
! scope="row" |41 | |||
|PB5 | |||
|I2C1_SMBA | |||
| SPI1_MOSI | |||
| SPI3_MOSI | |||
|- | |||
! scope="row" |42 | |||
|PB6 | |||
|I2C2_SCL | |||
|I2C4_SCL | |||
|- | |||
! scope="row" |43 | |||
| PB7 | |||
|I2C1_SDA | |||
|I2C4_SDA | |||
|- | |||
! scope="row" |44 | |||
|PH3 | |||
|- | |||
! scope="row" |45 | |||
|PB8 | |||
|I2C1_SCL | |||
|FDCAN1_RX | |||
|- | |||
! scope="row" |46 | |||
|PB9 | |||
|I2C1_SDA | |||
|SPI2_NSS | |||
|FDCAN1_TX | |||
|- | |||
! scope="row" |47 | |||
|VSS_3 | |||
|- | |||
! scope="row" |48 | |||
|VDD_3 | |||
|} | |||
=='''Protocol Pinout Reference'''== | |||
{| class="wikitable" cellspacing=5 cellpadding=5 | |||
|+ | |||
| colspan="4" |'''I2C1''' | |||
|- | |||
! width="60" colspan="2" scope="col" |Pin | |||
! width="100" colspan="1" scope="col" |Function | |||
! width="350" colspan="1" scope="col" |Description | |||
|- | |||
! scope="row" |11 | |||
! scope="row" |41 | |||
|I2C1_SMBA | |||
|System Management Bus Alert (SMBus mode) | |||
|- | |||
! scope="row" |43 | |||
! scope="row" |46 | |||
|I2C1_SDA | |||
|Serial Data Line | |||
|- | |||
! scope="row" |42 | |||
! scope="row" |45 | |||
|I2C1_SCL | |||
|Serial Clock Line | |||
|} | |||
{| class="wikitable" cellspacing=5 cellpadding=5 | |||
|+ | |||
| colspan="4" |'''I2C2''' | |||
|- | |||
! width="60" colspan="2" scope="col" | Pin | |||
! width="100" colspan="1" scope="col" |Function | |||
! width="350" colspan="1" scope="col" |Description | |||
|- | |||
! scope="row" |21 | |||
! scope="row" |26 | |||
|I2C2_SCL | |||
| Serial Clock Line | |||
|- | |||
! scope="row" | 22 | |||
! scope="row" |27 | |||
|I2C2_SDA | |||
| Serial Data Line | |||
|- | |||
! scope="row" |25 | |||
! scope="row" | | |||
|I2C2_SMBA | |||
|System Management Bus Alert (SMBus mode) | |||
|} | |||
{| class="wikitable" cellspacing=5 cellpadding=5 | |||
|+ | |||
| colspan="4" |'''I2C3''' | |||
|- | |||
! width="60" colspan="1" scope="col" |Pin | |||
! width="100" colspan="1" scope="col" | Function | |||
! width="350" colspan="1" scope="col" |Description | |||
|- | |||
! scope="row" | 17 | |||
|I2C3_SCL | |||
|Serial Clock Line | |||
|- | |||
! scope="row" |25 | |||
| I2C3_SMBA | |||
|System Management Bus Alert (SMBus mode) | |||
|- | |||
! scope="row" |40 | |||
|I2C3_SDA | |||
|Serial Data Line | |||
|} | |||
{| class="wikitable" cellspacing=5 cellpadding=5 | |||
|+ | |||
| colspan="4" |'''I2C4''' | |||
|- | |||
! width="60" colspan="2" scope="col" |Pin | |||
! width="100" colspan="1" scope="col" |Function | |||
! width="350" colspan="1" scope="col" |Description | |||
|- | |||
! scope="row" |21 | |||
! scope="row" |42 | |||
|I2C4_SCL | |||
| Serial Clock Line | |||
|- | |||
! scope="row" |22 | |||
! scope="row" |43 | |||
|I2C4_SDA | |||
|Serial Data Line | |||
|- | |||
! scope="row" |37 | |||
! scope="row" | | |||
|I2C4_SMBA | |||
|System Management Bus Alert (SMBus mode) | |||
|} | |||
{| class="wikitable" cellspacing=5 cellpadding=5 | |||
|+ | |||
| colspan="4" |'''SPI1''' | |||
|- | |||
! width="90" colspan="3" scope="col" |Pin | |||
! width="100" colspan="1" scope="col" | Function | |||
! width="150" colspan="1" scope="col" |Description | |||
|- | |||
! scope="row" |11 | |||
! scope="row" |15 | |||
! scope="row" |39 | |||
|SPI1_SCK | |||
|Serial Clock | |||
|- | |||
! scope="row" |14 | |||
! scope="row" |18 | |||
! scope="row" |38 | |||
|SPI1_NSS | |||
|Slave Select | |||
|- | |||
! scope="row" |16 | |||
! scope="row" |32 | |||
! scope="row" |40 | |||
|SPI1_MISO | |||
|Master-in, Slave-out | |||
|- | |||
! scope="row" |17 | |||
! scope="row" |33 | |||
! scope="row" |41 | |||
|SPI1_MOSI | |||
|Master-out, Slave-in | |||
|} | |||
{| class="wikitable" cellspacing=5 cellpadding=5 | |||
|+ | |||
| colspan="4" |'''SPI2''' | |||
|- | |||
! width="60" colspan="2" scope="col" |Pin | |||
! width="100" colspan="1" scope="col" |Function | |||
! width="150" colspan="1" scope="col" |Description | |||
|- | |||
! scope="row" |21 | |||
! scope="row" |26 | |||
|SPI2_SCK | |||
|Serial Clock | |||
|- | |||
! scope="row" |25 | |||
! scope="row" | | |||
|SPI2_NSS | |||
|Slave Select | |||
|- | |||
! scope="row" |27 | |||
! scope="row" | | |||
|SPI2_MISO | |||
|Master-in, Slave-out | |||
|- | |||
! scope="row" |28 | |||
! scope="row" | | |||
|SPI2_MOSI | |||
|Master-out, Slave-in | |||
|} | |||
{| class="wikitable" cellspacing=5 cellpadding=5 | |||
|+ | |||
| colspan="4" |'''SPI3''' | |||
|- | |||
! width="60" colspan="2" scope="col" |Pin | |||
! width="100" colspan="1" scope="col" |Function | |||
! width="150" colspan="1" scope="col" |Description | |||
|- | |||
! scope="row" |14 | |||
! scope="row" |38 | |||
|SPI3_NSS | |||
|Slave Select | |||
|- | |||
! scope="row" |39 | |||
! scope="row" | | |||
|SPI3_SCK | |||
|Serial Clock | |||
|- | |||
! scope="row" |40 | |||
! scope="row" | | |||
|SPI3_MISO | |||
|Master-in, Slave-out | |||
|- | |||
! scope="row" |41 | |||
! scope="row" | | |||
|SPI3_MOSI | |||
|Master-out, Slave-in | |||
|} | |||
== ''' | {| class="wikitable" cellspacing=5 cellpadding=5 | ||
|+ | |||
| colspan="4" |'''OCTOSPI1''' | |||
|- | |||
! width="60" colspan="2" scope="col" |Pin | |||
! width="130" colspan="1" scope="col" | Function | |||
! width="150" colspan="1" scope="col" |Description | |||
|- | |||
! scope="row" |12 | |||
! scope="row" |14 | |||
| OCTOSPI1_NCS | |||
|Chip Select | |||
|- | |||
! scope="row" |13 | |||
! scope="row" |21 | |||
|OCTOSPI1_CLK | |||
|Clock | |||
|- | |||
! scope="row" |16 | |||
! scope="row" | | |||
|OCTOSPI1_IO3 | |||
|I/O Data Line | |||
|- | |||
! scope="row" |17 | |||
! scope="row" | | |||
|OCTOSPI1_IO2 | |||
|I/O Data Line | |||
|- | |||
! scope="row" | 18 | |||
! scope="row" | | |||
|OCTOSPI1_IO1 | |||
|I/O Data Line | |||
|} | |||
{| class="wikitable" | {| class="wikitable" cellspacing=5 cellpadding=5 | ||
|+ | |+ | ||
! | | colspan="4" |'''FDCAN''' | ||
|- | |||
! width="60" colspan="2" scope="col" |Pin | |||
! width="100" colspan="1" scope="col" |Function | |||
! width="150" colspan="1" scope="col" | Description | |||
|- | |||
! scope="row" | 32 | |||
! scope="row" |45 | |||
|FDCAN_RX | |||
| Receive Data | |||
|- | |- | ||
| | ! scope="row" |33 | ||
! scope="row" |46 | |||
|FDCAN_TX | |||
|Transmit Data | |||
|} | |} |
Latest revision as of 15:09, 5 July 2023
The OI!STER is an STM32L5 Target Board with a QFP48 clamshell socket aimed at debugging and glitching salvaged MCUs. The board can be powered via USB-C, a 2032 coin cell battery on the back of the board or an external power suppy. All pins are broken out in the 24-pin headers on either side at the top of the board. The OI!STER contains five debug headers, to support a wide range of debugging hardware such as a Hydrabus or a Black Magic Probe. It comes with six SMA connectors arranged in I/O pairs. One pair is dedicated to glitching the external LSE clock, another for glitching the external HSE clock and one pair for power analysis and fault injection with a Chipwhisperer. Each SMA connector can be bypassed by removing a small jumper. The OI!STER also has additional solder jumpers for the external clocks and each of the power traces to the MCU to allow for quick experimentation.
The Pinout diagrams below are directed at reverse engineering. The first diagram is targeted at debugging and reverse engineering an STM32L5 MCU itself. The second diagram is aimed at the communication between external peripherals and the MCU. Although some functionaly might overlap, we've found it practical to define these two pinout groups. Additional documentation is currently under development.
Debug Pinout Diagram
Debug Pinout | ||
---|---|---|
Pin | Function | Alternate Function |
1 | VBAT | |
2 | PC13 | |
3 | PC14 | OSC32_IN |
4 | PC15 | OSC32_OUT |
5 | PH0 | OSC_IN |
6 | PH1 | OSC_OUT |
7 | NRST | |
8 | VSSA | VREF- |
9 | VDDA | VREF+ |
10 | PA0 | UART4_TX |
11 | PA1 | UART4_RX |
12 | PA2 | LPUART1_TX |
13 | PA3 | LPUART1_RX |
14 | PA4 | USART2_CK |
15 | PA5 | |
16 | PA6 | LPUART1_CTS |
17 | PA7 | |
18 | PB0 | LED1 |
19 | PB1 | LED2 |
20 | PB2 | UCPD1_FRSTX2 |
21 | PB10 | USART3_TX |
22 | PB11 | USART3_RX |
23 | VSS | |
24 | VDD | |
25 | PB12 | LPUART1_RTS |
26 | PB13 | LPUART1_CTS |
27 | PB14 | UCPD1_DB2 |
28 | PB15 | UCPD1_CC2 |
29 | PA8 | USART1_CK |
30 | PA9 | USART1_TX |
31 | PA10 | USART1_RX |
32 | PA11 | USART1_CTS |
33 | PA12 | USART1_RTS |
34 | PA13 | JTMS |
35 | VSS_2 | |
36 | VDD_2 | |
37 | PA14 | JTCK |
38 | PA15 | JTDI |
39 | PB3 | JTDO |
40 | PB4 | NJTRST |
41 | PB5 | UCPD1_DB1 |
42 | PB6 | USART1_TX |
43 | PB7 | UART4_CTS |
44 | PH3 | BOOT0 |
45 | PB8 | |
46 | PB9 | |
47 | VSS_3 | |
48 | VDD_3 |
Protocol Pinout Reference
USB | ||
---|---|---|
Pin | Function | Description |
32 | USB_DM | Data - |
33 | USB_DP | Data + |
34 | USB_NOE | Output Enable |
UCPD1 | ||
Pin | Function | Description |
---|---|---|
12 | UCPD1_FRSTX1 | Fast Role Swap Signal |
20 | UCPD1_FRSTX2 | Fast Role Swap Signal |
27 | UCPD1_DB2 | Dead-Battery Signal |
28 | UCPD1_CC2 | Configuration Control Line |
38 | UCPD1_CC1 | Configuration Control Line |
41 | UCPD1_DB1 | Dead-Battery Signal |
UART4 | ||
Pin | Function | Description |
---|---|---|
10 | UART4_TX | Transmit Data |
11 | UART4_RX | Receive Data |
38 | UART4_RTS | Request To Send |
43 | UART4_CTS | Clear To Send |
LPUART1 | |||
Pin | Function | Description | |
---|---|---|---|
12 | 22 | LPUART1_TX | Transmit Data |
13 | 21 | LPUART1_RX | Receive Data |
16 | 26 | LPUART1_CTS | Clear To Send |
19 | 25 | LPUART1_RTS | Request To Send |
USART1 | |||
Pin | Function | Description | |
---|---|---|---|
29 | 41 | USART1_CK | Transmitter Clock |
30 | 42 | USART1_TX | Transmit Data |
31 | 43 | USART1_RX | Receive Data |
32 | 40 | USART1_CTS | Clear To Send |
32 | 40 | USART1_NSS | Slave Select |
33 | 39 | USART1_RTS | Request To Send |
33 | 39 | USART1_DE | Driver Enable |
USART2 | |||
Pin | Function | Description | |
---|---|---|---|
10 | USART2_CTS | Clear To Send | |
10 | USART2_NSS | Slave Select | |
11 | USART2_RTS | Request To Send | |
11 | USART2_DE | Driver Enable | |
12 | USART2_TX | Transmit Data | |
13 | 38 | USART2_RX | Receive Data |
14 | USART2_CK | Transmitter Clock |
USART3 | ||||
Pin | Function | Description | ||
---|---|---|---|---|
16 | 26 | USART3_CTS | Clear To Send | |
16 | 26 | USART3_NSS | Slave Select | |
18 | 25 | USART3_CK | Transmitter Clock | |
19 | 27 | 38 | USART3_RTS | Request To Send |
21 | 27 | 38 | USART3_DE | Driver Enable |
21 | USART3_TX | Transmit Data | ||
22 | USART3_RX | Request Data |
JTAG | ||
Pin | Function | Description |
---|---|---|
34 | JTMS | Test Mode State |
37 | JTCK | Test Clock |
38 | JTDI | Test Data In |
39 | JTDO | Test Data Out |
40 | NJTRST | Reset |
SWD | ||
Pin | Function | Description |
---|---|---|
7 | NRST | Reset |
34 | SWDIO | Data I/O |
37 | SWCLK | Clock |
39 | TRACESWO | Trace Output |
OSC | ||
Pin | Function | Description |
---|---|---|
5 | OSC_IN | High Speed External Clock In (HSEI) |
6 | OSC_OUT | High Speed External Clock Out (HSEO) |
OSC32 | ||
Pin | Function | Description |
---|---|---|
3 | OSC32_IN | Low Speed External Clock In (LSEI) |
4 | OSC32_OUT | Low Speed External Clock Out (LSEO) |
Peripheral Pinout Diagram
Peripheral Pinout | |||||
Pin | Function | Alternate | |||
---|---|---|---|---|---|
1 | VBAT | ||||
2 | PC13 | ||||
3 | PC14 | ||||
4 | PC15 | ||||
5 | PH0 | ||||
6 | PH1 | ||||
7 | NRST | ||||
8 | VSSA | ||||
9 | VDDA | ||||
10 | PA0 | ||||
11 | PA1 | I2C1_SMBA | SPI1_SCK | ||
12 | PA2 | OCTOSPI1_NCS | |||
13 | PA3 | OCTOSPI1_CLK | |||
14 | PA4 | SPI1_NSS | SPI3_NSS | OCTOSPI1_NCS | |
15 | PA5 | SPI1_SCK | |||
16 | PA6 | SPI1_MISO | OCTOSPI1_IO3 | ||
17 | PA7 | I2C3_SCL | SPI1_MOSI | OCTOSPI1_IO2 | |
18 | PB0 | SPI1_NSS | OCTOSPI1_IO1 | ||
19 | PB1 | OCTOSPI1_IO0 | |||
20 | PB2 | I2C3_SMBA | |||
21 | PB10 | I2C2_SCL | I2C4_SCL | SPI2_SCK | OCTOSPI1_CLK |
22 | PB11 | I2C2_SDA | I2C4_SDA | OCTOSPI1_NCS | |
23 | VSS | ||||
24 | VDD | ||||
25 | PB12 | I2C2_SMBA | SPI2_NSS | OCTOSPI_NCLK | |
26 | PB13 | I2C2_SCL | SPI2_SCK | ||
27 | PB14 | I2C2_SDA | SPI2_MISO | ||
28 | PB15 | SPI2_MOSI | |||
29 | PA8 | ||||
30 | PA9 | SPI2_SCK | |||
31 | PA10 | ||||
32 | PA11 | SPI1_MISO | FDCAN1_RX | ||
33 | PA12 | SPI1_MOSI | FDCAN1_TX | ||
34 | PA13 | ||||
35 | VSS_2 | ||||
36 | VDD_2 | ||||
37 | PA14 | I2C1_SMBA | I2C4_SMBA | ||
38 | PA15 | SPI1_NSS | SPI3_NSS | ||
39 | PB3 | SPI1_SCK | SPI3_SCK | ||
40 | PB4 | I2C3_SDA | SPI1_MISO | SPI3_MISO | |
41 | PB5 | I2C1_SMBA | SPI1_MOSI | SPI3_MOSI | |
42 | PB6 | I2C2_SCL | I2C4_SCL | ||
43 | PB7 | I2C1_SDA | I2C4_SDA | ||
44 | PH3 | ||||
45 | PB8 | I2C1_SCL | FDCAN1_RX | ||
46 | PB9 | I2C1_SDA | SPI2_NSS | FDCAN1_TX | |
47 | VSS_3 | ||||
48 | VDD_3 |
Protocol Pinout Reference
I2C1 | |||
Pin | Function | Description | |
---|---|---|---|
11 | 41 | I2C1_SMBA | System Management Bus Alert (SMBus mode) |
43 | 46 | I2C1_SDA | Serial Data Line |
42 | 45 | I2C1_SCL | Serial Clock Line |
I2C2 | |||
Pin | Function | Description | |
---|---|---|---|
21 | 26 | I2C2_SCL | Serial Clock Line |
22 | 27 | I2C2_SDA | Serial Data Line |
25 | I2C2_SMBA | System Management Bus Alert (SMBus mode) |
I2C3 | |||
Pin | Function | Description | |
---|---|---|---|
17 | I2C3_SCL | Serial Clock Line | |
25 | I2C3_SMBA | System Management Bus Alert (SMBus mode) | |
40 | I2C3_SDA | Serial Data Line |
I2C4 | |||
Pin | Function | Description | |
---|---|---|---|
21 | 42 | I2C4_SCL | Serial Clock Line |
22 | 43 | I2C4_SDA | Serial Data Line |
37 | I2C4_SMBA | System Management Bus Alert (SMBus mode) |
SPI1 | ||||
Pin | Function | Description | ||
---|---|---|---|---|
11 | 15 | 39 | SPI1_SCK | Serial Clock |
14 | 18 | 38 | SPI1_NSS | Slave Select |
16 | 32 | 40 | SPI1_MISO | Master-in, Slave-out |
17 | 33 | 41 | SPI1_MOSI | Master-out, Slave-in |
SPI2 | |||
Pin | Function | Description | |
---|---|---|---|
21 | 26 | SPI2_SCK | Serial Clock |
25 | SPI2_NSS | Slave Select | |
27 | SPI2_MISO | Master-in, Slave-out | |
28 | SPI2_MOSI | Master-out, Slave-in |
SPI3 | |||
Pin | Function | Description | |
---|---|---|---|
14 | 38 | SPI3_NSS | Slave Select |
39 | SPI3_SCK | Serial Clock | |
40 | SPI3_MISO | Master-in, Slave-out | |
41 | SPI3_MOSI | Master-out, Slave-in |
OCTOSPI1 | |||
Pin | Function | Description | |
---|---|---|---|
12 | 14 | OCTOSPI1_NCS | Chip Select |
13 | 21 | OCTOSPI1_CLK | Clock |
16 | OCTOSPI1_IO3 | I/O Data Line | |
17 | OCTOSPI1_IO2 | I/O Data Line | |
18 | OCTOSPI1_IO1 | I/O Data Line |
FDCAN | |||
Pin | Function | Description | |
---|---|---|---|
32 | 45 | FDCAN_RX | Receive Data |
33 | 46 | FDCAN_TX | Transmit Data |