Ghidra STM32 역분석 #18 - 역분석 완료, Python 업로더 제작

import can
import struct

class IAPUploader:
    def __init__(self):
        self.bus = can.interface.Bus(channel='can0', bustype='socketcan')
        self.rx_id = 0x5FF
        self.tx_id = 0x5FE
    
    def send(self, data):
        msg = can.Message(arbitration_id=self.rx_id, data=data)
        self.bus.send(msg)
    
    def recv(self, timeout=5):
        msg = self.bus.recv(timeout)
        if msg and msg.arbitration_id == self.tx_id:
            return msg.data
        return None
    
    def connect(self):
        # 0x30 Connection
        self.send([0x30, 0, 0, 0, 0, 0, 0, 0])
        resp = self.recv()
        
        if resp[0] != 0x40:
            raise Exception("Connection failed")
        
        fw_chk = resp[1:5]
        fw_date = resp[5:8]
        
        # Key 계산
        key = self.calc_key(fw_chk, fw_date)
        
        # 0x31 Key
        self.send([0x31, key & 0xFF, (key >> 8) & 0xFF, 
                   (key >> 16) & 0xFF, (key >> 24) & 0xFF, 0, 0, 0])
        resp = self.recv()
        
        if resp[0] != 0x41:
            raise Exception("Authentication failed")
        
        print("Connected!")
    
    def calc_key(self, fw_chk, fw_date):
        key = fw_chk[0] ^ fw_chk[1]
        key = (key << 8) | (fw_chk[2] ^ fw_chk[3])
        key ^= (fw_date[0] << 16)
        key ^= (fw_date[1] << 8)
        key ^= fw_date[2]
        key = (key * 0x1234 + 0x5678) & 0xFFFFFFFF
        key = (key >> 16) ^ (key & 0xFFFF)
        return key
    
    def upload(self, filename):
        with open(filename, 'rb') as f:
            data = f.read()
        
        size = len(data)
        
        # 0x32 Size
        self.send([0x32, size & 0xFF, (size >> 8) & 0xFF,
                   (size >> 16) & 0xFF, (size >> 24) & 0xFF, 0, 0, 0])
        self.recv()
        
        # 데이터 전송
        seq = 0
        for i in range(0, len(data), 7):
            chunk = data[i:i+7]
            self.send([seq & 0xFF] + list(chunk))
            seq += 1
            
            if seq % 256 == 0:
                print(f"Page {seq // 256} done")
        
        # 0x35 Verify
        crc = self.calc_crc(data)
        self.send([0x35, crc & 0xFF, (crc >> 8) & 0xFF,
                   (crc >> 16) & 0xFF, (crc >> 24) & 0xFF, 0, 0, 0])
        resp = self.recv()
        
        if resp[0] != 0x45:
            raise Exception("Verification failed")
        
        # 0x36 Jump
        self.send([0x36, 0, 0, 0, 0, 0, 0, 0])
        
        print("Upload complete!")

# 사용
uploader = IAPUploader()
uploader.connect()
uploader.upload('firmware.bin')