Summary of NRFSEC, FOR UNLOCKING ANY PROTECTED NRF51-SERIES SYSTEM-ON-CHIP FOR DEBUG
This article details Loren Browman's research on bypassing Nordic Semiconductor's nRF51-series SoC protection. He developed "nrfsec," an open-source tool that automates unlocking and enables full memory dumps or interactive debugging, even when read-back protection is active. The tool utilizes integrated gadget searching to bypass the Memory Protection Unit (MPU) and includes features like boot delay commands for RAM dumps and firmware image saving for disassembly.
Parts used in the nrfsec project:
- nRF51822 System on Chip (SoC)
- Memory Protection Unit (MPU)
- Integrated read gadget
- UICR memory
- Boot delay command flag
- Firmware images
Loren Browman, a security analyst recently published a guide to automated unlocking of Nordic Semiconductor’s nRF51-series systems-on-chips (SoCs) which claims to be protected, enabling a full memory dump or interactive debugging regardless of protection settings. In a blog piece for security firm Optiv, Loren Browman writes
Recently, while conducting an assessment for a product based on the nRF51822 System on Chip (SoC), I found my target’s debug interface was locked — standard stuff… Reading up on the nRF51 series SoCs revealed that this is how these chips are designed. It’s always possible to perform a full memory recovery/dump, even if read back protection is enabled.
He continue:
I wanted to build on what others have discovered, extending the attack to completely and automatically bypass the memory protection mechanism offered by these SoCs. Beyond reading memory, I also wanted to unlock the device to support interactive debug sessions with my target.
This resulted to nrfsec, which is an open source research security tool published under the GNU General Public License 3, used for unlocking and reading memory on nrf51 series SoCs from Nordic Semiconductor.
Features of the nrfsec includes:
- Read all target memory, bypassing the Memory Protection Unit (MPU) settings with integrated read gadget searching.
- Automated unlock feature: read all program and UICR memory, erase all memory, patch UICR image, reflash target into unlocked state.
- Boot delay command flag for interacting with target prior to performing memory read, allowing for RAM dumps.
- All firmware images are saved for importing into your favorite disassembler.
Read more: NRFSEC, FOR UNLOCKING ANY PROTECTED NRF51-SERIES SYSTEM-ON-CHIP FOR DEBUG
- What is nrfsec?
nrfsec is an open source research security tool published under the GNU General Public License 3 used for unlocking and reading memory on nrf51 series SoCs. - Can nrfsec unlock devices with read back protection enabled?
Yes, it is designed to completely and automatically bypass the memory protection mechanism even if read back protection is enabled. - How does nrfsec interact with the target prior to memory reading?
It uses a boot delay command flag to allow interaction with the target before performing a memory read to enable RAM dumps. - Does nrfsec support interactive debug sessions?
Yes, the tool unlocks the device to support interactive debug sessions with the target beyond just reading memory. - What happens to firmware images after using nrfsec?
All firmware images are saved for importing into your favorite disassembler. - Can nrfsec erase all memory on the chip?
Yes, the automated unlock feature includes the ability to erase all memory and patch the UICR image. - Which license covers the nrfsec tool?
The tool is published under the GNU General Public License 3.
