|
| 1 | +--- |
| 2 | +created: 2025-04-19T21:19 |
| 3 | +updated: 2025-04-19T21:23 |
| 4 | +--- |
| 5 | + |
| 6 | +## Overview |
| 7 | + |
| 8 | +The **UK47XD** is an 32bit microcontroller designed for secure embedded applications. It features a simple memory layout, UART-based communication, and built-in security features to prevent tampering and unauthorized code execution. It is primarily used in the lighting industry. |
| 9 | + |
| 10 | +## Memory Map |
| 11 | +The memory map layout which programmers can access is organized as follows: |
| 12 | + |
| 13 | +| Address Range | Description | |
| 14 | +|---------------- |------------------------------| |
| 15 | +| `0x0000–0x036F` | Boot Section | |
| 16 | +| `0x0370–0x0EDBFF` | Application Flash (User Area)| |
| 17 | + |
| 18 | +> **Note**: Any access to any other addresses will result in a hard fault, requiring a reboot of the processor. |
| 19 | +
|
| 20 | +## UART Communication |
| 21 | + |
| 22 | +UK47XD communicates with external devices via UART at 115200 baud, 8N1. |
| 23 | + |
| 24 | +### UART Registers |
| 25 | + |
| 26 | +| Address | Name | Description | |
| 27 | +|-----------|--------------|-------------------------| |
| 28 | +| `0x0100` | `UART_DATA` | Data Register (R/W) | |
| 29 | +| `0x0101` | `UART_STAT` | Status Register (R) | |
| 30 | +| `0x0102` | `UART_CTRL` | Control Register (W) | |
| 31 | + |
| 32 | +#### UART Status Register Bits |
| 33 | + |
| 34 | +- Bit 0: TX Ready |
| 35 | +- Bit 1: RX Available |
| 36 | +- Bit 7: Error Flag |
| 37 | + |
| 38 | +### Programming Mode |
| 39 | + |
| 40 | +The UK47XD can be programmed over UART. In order to signal to the processor that you would like to interact with it over UART, simply send the bytes `[0x55, 0x0, 0xC1, 0x0]` within 5 seconds of booting the processor. The processor should then respond with an acknowledgement packet. |
| 41 | + |
| 42 | +#### Programming Mode Commands |
| 43 | + |
| 44 | +##### Packet Format |
| 45 | + |
| 46 | +The transport packet format for all transactions is as follows: |
| 47 | + |
| 48 | +```C |
| 49 | +struct Packet { |
| 50 | + uint8_t HEAD; // 0x33 |
| 51 | + uint16_t LEN; // Length of data that comes after this field, in little endian. |
| 52 | + PACKET_INTERNAL_DATA DATA; // Data that is stored here |
| 53 | +} |
| 54 | + |
| 55 | +struct PACKET_INTERNAL_DATA { |
| 56 | + COMMANDS CMD; // Command Index |
| 57 | + RESPONSES STATUS; // Status, used by the system whenever something goes wrong. |
| 58 | + uint8_t ARGS[LEN - 2]; // The bytes for the arguments. It will be LEN - 1. |
| 59 | +} |
| 60 | +``` |
| 61 | + |
| 62 | +##### Command Indices |
| 63 | + |
| 64 | +```C |
| 65 | +typedef enum { |
| 66 | + UNKNOWN = 0x0, |
| 67 | + COMM_INIT = 0x3, |
| 68 | + SET_CHIP_FREQ = 0x5, |
| 69 | + ID_AUTHENTICATION = 0x34, |
| 70 | + READ = 0x69, |
| 71 | +} COMMANDS; |
| 72 | +``` |
| 73 | + |
| 74 | +##### Response/Status Indices |
| 75 | + |
| 76 | +```C |
| 77 | +typedef enum { |
| 78 | + ACK = 0x50, |
| 79 | + INVALID_COMMAND = 0x80, |
| 80 | + FLOW_ERROR = 0x81, |
| 81 | + UNAUTHORIZED = 0x82, |
| 82 | + INVALID_FREQUENCY = 0x83, |
| 83 | + INVALID_ID_LEN = 0x84, |
| 84 | + INVALID_ADDRESS = 0x87, |
| 85 | + INVALID_ADDRESS_ALIGNMENT = 0x88, |
| 86 | +} RESPONSES; |
| 87 | +``` |
| 88 | + |
| 89 | +###### Responses |
| 90 | + |
| 91 | +The status field in a data packet can be set to one of the following values: |
| 92 | + |
| 93 | +- ACK: Used as an acknowledgement. |
| 94 | +- INVALID_COMMAND: Used to report a bad command. |
| 95 | +- FLOW_ERROR: Used to report a command sent out of order. |
| 96 | +- UNAUTHORIZED: Used to signify an authentication failure. |
| 97 | +- INVALID_FREQUENCY: Used to signify an invalid frquency being set. |
| 98 | +- INVALID_ID_LEN: Used to signify a malformed ID. |
| 99 | +- INVALID_ADDRESS: Used to signify a bad/out of bounds address. |
| 100 | +- INVALID_ADDRESS_ALIGNMENT: Used to signify an address that is not 0x400 aligned. |
| 101 | + |
| 102 | +###### Data Packets |
| 103 | + |
| 104 | +As implied by the above, the inline data packets need a `type`, `status`, and `args` section (if applicable) for successful communication. |
| 105 | + |
| 106 | +- The `type` will be of the command being sent or acknowledged. |
| 107 | +- The `status` is one of those in the RESPONSE enum. If you are sending a command, you do not need to fill out this field; the UK47XD will fill this field, however. |
| 108 | +- The `args` section just contains the raw data that you are trying to pass in. |
| 109 | + |
| 110 | +###### Commands.COMM_INIT |
| 111 | + |
| 112 | +Initializes communication with the processor over UART. This must be sent before any other command is sent, otherwise you will receive a packet with a `FLOW_ERROR`. Upon success, you will receive an acknowledgement back from the system. |
| 113 | + |
| 114 | +Example packet structure: ```[0x33, 0x2, 0x0, 0x3, 0x0]``` |
| 115 | + |
| 116 | +###### Commands.SET_CHIP_FREQ |
| 117 | + |
| 118 | +Sets the processor speed in megahertz. This must be sent after the `COMM_INIT` command. Upon success, you will receive an acknowledgement back from the system. You must use either 8 or 16 MHz, as these are the only two operating frequencies. |
| 119 | + |
| 120 | +Example packet structure (to set to 8 MHz): ```[0x33, 0x5, 0x0, 0x5, 0x00, 0x12, 0x7A, 0x00]``` |
| 121 | + |
| 122 | +###### Commands.ID_AUTHENTICATION |
| 123 | + |
| 124 | +Unlocks the chip for reading. This must be sent after the `COMM_INIT` command, and the `SET_CHIP_FREQ`, in that order. Upon success, you will receive an acknowledgement back from the system. This cannot be bruteforced; if an attempt is made, the chip is wiped for security reasons (see below). |
| 125 | + |
| 126 | +Example packet structure (assuming the password is DEADBEEFDEADBEEF): ```[0x33, 0x11, 0x0, 0x34, 0x44, 0x43, 0x41, 0x44, 0x42, 0x45, 0x45, 0x46, 0x44, 0x43, 0x41, 0x44, 0x42, 0x45, 0x45, 0x46]``` |
| 127 | + |
| 128 | +###### Commands.READ |
| 129 | + |
| 130 | +Reads 0x400 bytes from a region. This must be sent after the unlocking the chip (see `ID_AUTHENTICATION`). Upon success, you will receive an acknowledgement back from the system, containing the 0x400 bytes. |
| 131 | + |
| 132 | +Example packet structure (reading from 0x112233): ```[0x33, 0x5, 0x0, 0x69, 0x33, 0x22, 0x11, 0x00]``` |
| 133 | + |
| 134 | +## Security Features |
| 135 | + |
| 136 | +The UK47XD includes several mechanisms for runtime and firmware security. |
| 137 | + |
| 138 | +- An ID can be used to secure your processor. This is a 16 byte ID consisting of CAPITAL alphabetical characters 'A' through 'Z'. If a user attempts to bruteforce this password, the chip will be erased, preserving the contents. |
| 139 | +- The JTAG fuses can be blown to prevent tampering, or the OTP register set. |
| 140 | +- SWD is disabled unless you specifically request a development board from UNC Holdings. |
| 141 | +- As stated before, the bootrom and other secure assets cannot be read out, only user area. |
| 142 | +- Sudden voltage changes or glitching attempts will trigger a system reset. |
0 commit comments