STM32F030C8T6 - the brains behind the Nextion Basic

The basic boards utilize the STM32F030C8 series processor. The specific part number used on recent boards is STM32F030C8T6, which is a LQFP48 package ARM microcontroller sold for low cost applications.

Datasheet

image

TODO: check to confirm if Read Out Protection bit is set, can we dump the 64k flash?

Potential bypass: https://medium.com/@LargeCardinal/how-to-bypass-debug-disabling-and-crp-on-stm32f103-7116e7abb546

Interestingly, this makes use of the BOOT0 pin, which just so happens to be tied to a 10k resistor (R14) on the Nextion boards, and which isn’t present at all on the TJC boards, and which is also be the only difference we’ve picked out on the component side of the two boards.

The first chip F030 you point to Nextion using is a Cortex M0, the Read Out Protection is to an L1 chip, the second posts’ article is about an F103 which is a Cortex M3. I am less certain you can mix and match in this manner.

As it turns out readout protection doesn’t appear to be enabled after all. With a cheap STM programmer and the provided SWD pads you can dump the contents of the F030 pretty easily.

As that firmware is presumably copyrighted, I can’t post the resulting hex file but for < $9 it’s easy to obtain.

I can see that an STMF030R8T6 is used for the Enhanced

But, if I may ask what is the purpose? You state you can’t post the hex because it is presumably copyrighted, but you are clearly posting how to easily obtain the hex. Just trying to see where this is headed and what the real goal is. Do we need this hex file?

1 Like

I can only speak for myself, but my goal is to better understand this platform and to share what I’ve learned with others who might want to know too. I also don’t want to be sued, so I need to keep everything within the letter of the law. It’s legal for me to dump a hex file, it’s legal for me to tell you how to do it, but it’s not legal for me to share the contents of that hex file if it’s copyrighted.

2 Likes

Thanks, so two things for now.
Do I need this hex file, and what is it that we are trying to look for?

Just curiosity is all. What can we learn about how things are put together, can we modify things in any useful way, or can we make this platform work better for some users. I don’t know, and I won’t know until I look so… I’m looking. You can too!

12 posts were merged into an existing topic: Bitching about Nextion

Hi,

I’m new in this community. But I am doing IoT since years now.

My latest project is a central oil heater control with display.

So I am going to Use the first time a Nextion display. (Unfortunately I got a 3.5inch TCJ display from china)

I tried to read or the flash of the STM but it was read out protected. So I removed the ROD with openGDB successfully. So I want to flash a Nextion image to my display.

Has someone any idea how to obtain an image of a 3.5 inch basic Nextion .

Maybe out of a tft file?

Thanks

It seems like they have fixed this oversight in recent revisions unless I am doing something wrong.

So I was able to dump a 3.2 enhanced display.

it seems that the actual firmware is just a type of bootloader. The actual program is stored on the flash chip. Clearing and reflashing the firmware will reload the last .TFT that was stored on flash with the display information. The firmware is the same across TJC and Nextion. Even though the dumps are different, the flash program will readjust back to stock for the display.

Has anyone had any luck dumping the flash chip for the display? I believe I have hit a lack of knowledge road block.

1 Like

Well, I was about to post another bug to the Nextion forum and it seems I was banned from it for posting this in this forum. Good to know they have absolutely no tolerance for research.

I know this is an old thread plus I am new and pushing the limts of what is allowed but I hope someone can help.

While messing around I accidently relashed the STM32F030 on one of my Nextion boards and effectively bricked it. The other boards I own have Read-Out protection set so I can’t just copy from one to the other.

The board is a NX3224T028_011 but I suspect the same boot loader is used across all Nextion boards that use the same chip (pretty sure all it does is save and boot files thats are generated by the editor).

Would anyone have a hex or bin file they could share via a private message?

Are you sure that it’s worth the time and the work since you can easily get a new one for less than $20? How much is your working hour?

I read this as a hacker experimenting with the tools at hand, as opposed to making a financial model for the project.

It only takes a few minutes to flash a board, so that’s not an issue. Plus, ignoring the replacement cost I have an issue about throwing out perfectly good hardware!

Since time is not money for me at the moment, I just spent most of the day researching how to bypass read-out protection on the STM32F0 range for fun. So far that has been a failure due to my lack of python skills (search for Dumping the flash of the Syscan 2015 badge). I will probably try again tomorrow however I need to setup a Linux ARM development environment to try the same method using C code (search for Shedding too much Light on a Microcontroller’s Firmware Protection).

The joys of being told to stay at home :slight_smile:

2 Likes

Ok so I solved the problem and managed to get the code from the Syscan web page working.

All it took was a nights rest after which it took a few simple code line changes got the program to work properly. The code does require a buspirate as an interface which thankfully I just happened to have.

A couple of hours later and I now have a copy of the bootloader. This has been sucesfully flashed into my faulty board and it now works again!

3 Likes

Seriously above my skill level. Good to see there are folks that can figure out these things…in case I ever need it. :wink:

Hey! I need your help! I didn’t accidentally save a hex file from stm32 when trying to upload a finished copy from another display. Can you share it?