NXP LPC1758 Bootloader 使用串口芯片破解

芯片破解NXP LPC1758 Bootloader 使用串口0 支持xmodem1k协议，可以使用超级终端将应用程序上传到FLASH实现IAP程序升级

芯片破解单片机源程序如下:

#include "LPC17xx.h" /* LPC17xx外设寄存器 */
#include "../UART/uart.h"
#include "../IAP/iap.h"
#include "../CRC/crc.h"
#include "../XMODEM1K/xmodem1k.h"
#include <string.h>
extern uint32_t SystemFrequency;
/*
* Define flash memory address at which user application is located
*/
#define APP_START_ADDR 0x00010000UL
#define APP_END_ADDR 0x00080000UL /* LPC1766 256K Flash */
/*
* Define the flash sectors used by the application
*/
#define APP_START_SECTOR 16
#define APP_END_SECTOR 29 /* LPC1766 256K Flash */
volatile uint32_t IAPFlagTimeOut;
static uint32_t u32InvalidateApp(void);
void ExceuteApplication(void);
static void vBootLoader_Task(void);
static uint32_t u32BootLoader_AppPresent(void);
static uint32_t u32Bootloader_WriteCRC(uint16_t u16CRC);
static uint32_t u32BootLoader_ProgramFlash(uint8_t *pu8Data, uint16_t u16Len);
/*********************************************************************************************************
** Function name: Timer0_Init
** Descriptions: 定时器0初始化程序
** input parameters: 无
** output parameters: 无
** Returned value: 无
*********************************************************************************************************/
void Timer0_Init (uint32_t ulsec)
{
LPC_TIM0->TCR = 0x02;
LPC_TIM0->IR = 0x01;
LPC_TIM0->CTCR = 0;
LPC_TIM0->TC = 0;
LPC_TIM0->PR = 0;
LPC_TIM0->MR0 = (SystemFrequency/4)*ulsec; /* nS中断1次 */
LPC_TIM0->MCR = 0x05; /* 匹配后产生中断 */
LPC_TIM0->TCR = 0x01; /* 启动定时器 */
}
/*********************************************************************************************************
** Function name: JMP_Boot
** Descriptions: 跳转到应用程序
** input parameters: address 应用程序地址
** output parameters: 无
** Returned value: 无
*********************************************************************************************************/
__asm void JMP_Boot( uint32_t address ){
LDR SP, [R0] ;Load new stack pointer address
LDR PC, [R0, #4] ;Load new program counter address
}
/*********************************************************************************************************
** Function name: Boot
** Descriptions: 跳转到应用程序
** input parameters: 无
** output parameters: 无
** Returned value: 无
*********************************************************************************************************/
void Boot( void )
{
SCB->VTOR = APP_START_ADDR & 0x1FFFFF80; //修改中断向量表
//SCB->VTOR = APP_START_ADDR;
JMP_Boot(APP_START_ADDR);
}
/*********************************************************************************************************
** Function name: main
** Descriptions: Bootloader控制循环
** input parameters: 无
** output parameters: 无
** Returned value: 无
*********************************************************************************************************/
int main(void)
{
uint8_t uartBuffer[16], len;
SystemInit();
vUARTInit(BAUD_RATE); //P0.2,P0.3对就串口0，115200
vUARTSend((uint8_t *)("\r\nLPC1700 Ready For Updates >"), strlen("\r\nLPC1700 Ready For Updates >"));
Timer0_Init (10);
len = 0;
//获取IAP升级命令IAP
while (1)
{
if ((LPC_TIM0->IR & 0x01) == 0x01)
{
LPC_TIM0->IR = 0x01; /* 清除中断标志 */
IAPFlagTimeOut = 1; /* 等待升级命令超时 */
vUARTSend((uint8_t *)("\r\nTimeout waiting for the upgrade command!\r\n"), strlen("\r\nTimeout waiting for the upgrade command!\r\n"));
break;
}
//等待置信IAP字例入IAP升级，超进退出。
if (u8UARTReceive(uartBuffer) > 0)
{ /* 判断升级命令 IAP */
vUARTSend(uartBuffer, 1);
if (uartBuffer[0] == 'I')
{
len = 1;
}
if (uartBuffer[0] == 'A')
{
if (len == 1)
{
len = 2;
}
else
{
len = 0;
}
}
if (uartBuffer[0] == 'P')
{
if (len == 2)
{
len = 3;
}
else
{
len = 0;
}
}
}
if (len == 3)
{
IAPFlagTimeOut = 0;
vUARTSend((uint8_t *)("\r\nReceiving a successful upgrade command!\r\n"), strlen("\r\nReceiving a successful upgrade command!\r\n"));
break;
}
}

NXP LPC1758 Bootloader 使用串口芯片破解

飞芯科技

联系方式