Having rescued a trove of temperature loggers out of my local universities e-waste dumpster; it's time to crack them open and see what they can do.
So far the TempTale Ultra's I have opened come in a few varieties but generally share the same features.
Included on board :
- STM32 L1xxx MCU - STM32L152RCT6 / STM32L152RET6
- USB Male Plug
- JTAG / SWD pads
- I2C Temperature Sensor ?
- SPI Flash Chip
- 3V Battery Lithium Coin Cell OR Dual 3v cells soldered.
Hello World - get code running.
- Soldered onto the SWD pads and Disconnect the on board battery.
- Lifted the boot0 pin of the MCU off the board
- Connected an STLINK to the SWD pads.
- Unlocked the flash memory sections
- Upload a blinker demo to the board.
- Bodge wire the boot0 pin back to GND (to get back to booting from flash memory)
With the Flash unlocked and the Boot0 connected back to Vss/GND the MCU remains reprogrammable over SWD.
Helpfully there was some previous art on reversing these boards.
- arduinocelentano Evaluates a number of Temperature Loggers for hackability for "Free Dev Boards" on Instructables
- Robin Bradshaw documents a TempTale Ultra teardown on Twitter
how to reuse this device ?