Cortex-M4微控制器设备标识符的伪造方法

Forgery Method of Device Identifier of Cortex-M4 Microcontroller

很多软件利用微控制器设备标识符(UID)的唯一性对程序进行加密,使每一个产品具有唯一性;利用微控制器的一些功能单元,可在不直接修改软件的情况下伪造UID。增加部分代码,先于目标软件运行,利用微控制器存储保护单元(MPU)或数据监视点和跟踪(DWT)单元捕获对UID的访问,并使用Flash补丁和断点(FPB)单元或中断向量重定位机制来修改部分中断向量的位置,避免直接修改目标软件。以Cortex-M4为内核的STM32F429为例,利用Flash补丁伪造96位的UID。在拥有MPU、DWT或FPB单元的微控制器上,都可以使用相似的方法伪造UID,但防范也相对容易,只要破坏相关设置即可。

In order to make each product unique,many software encrypt the program by using the unique device identifier(UID)of the microcontroller.In this paper,we use some functional units of microcontroller to forge UID without directly modifying the original code.We add some code to run before the target software,capture the access to UID by using MPU or DWT unit,and use FPB unit or vector table relocation to relocate some interrupt vectors to avoid directly modifying the target software.Taking STM32F429 with cortex-m4 as an example,a 96-bit UID is successfully forged by using the Flash patch.The similar method can be used to forge UIDs on other microcontrollers with MPU or DWT or FPB units,but prevention is relatively easy,as long as the relevant settings are destroyed.