Read code from SMT32F103 microcontroller

[bitcom]

while trying to add a cooling fan to my brand new APC SMT750, I've managed to short out the SMT32F103 microcontroller on it. It was a stupid mistake I left a piece of soldering wire on top of the circuit and bang next thing I know it wont start, anyway I found the problem to be a NCV5500 regulator that supplies vcc to the microcontroller but even after removing the 5500, the contrller seems to be shorted. So here is my question:
Is it possible to read the code from a good working chip and load that code on to a new mcu as this chip is very common and cheap, as for the code, I've ordered another exact model of ups which is on its way also this code might be present in the firmware update files I've downloaded from APC they are .enc extension files and are 260kb in size.
it would be a shame to throw away such nice piece of hardware.
I've now removed the bad mcu and I'm sure there is no longer a short so in fact this is the culprit.
I really hope some of you guys help me bring this ups back from the dead.
If anybody wants to look at this file here it is:
https://files.fm/u/n2gpahwr
Thank alot

[lucazader]

If readout protection hasn't been enabled, then this is pretty trivial.

Just get an ST-Link V2 programmer (either digikey or similar if you need it quick, or get a cheap aliexpress clone if it can take a while).
Connect the ST_Link to the SWDIO, SWCLK and reset pins of the micro, along with a GND.
Open either ST-Link utility or the STMCubeProgrammer, connect to the chip and read out the data.

If read out protection has been enabled, then it becomes a bit more difficult. I am not sure the process, but i do know that the readout protection has been broken/bypassed on most if not all STM32 chips.
Also be very careful if read out protection has been enabled. If you accidentally turn this off while connected with the programmer, then it will wipe the flash of the chip.

[bitcom]

Thank you so much for your reply.
Just so you know I'm not at all familiar with this or any other microcontroller, I'm only an electronics technician with only limited experience with arduino's various boards.
How would I know  if it is read protect or not, I would need to be real careful here as I don't wanna blow yet another UPS.
What about the other route digging for the firmware from the file I uploaded on my previous post and burning it to one of this cheap ebay arduino like board with SMT32F103 chip on it like this one.
[urlhttps://www.ebay.com/itm/STM32F103C8T6-ARM-STM32-Minimum-System-Development-Board-Module-For-Arduino/311156408508?epid=8023398214&hash=item48725e00bc:g:onsAAOSwETJaNPe2][/url]
I would prefer this option the only problem is I don't know how too open unpack or decrypt this .enc file.
Thanks again

[ataradov]

If they have bothered to encrypt it, then it is likely that MCU is locked. And it is also likely that any effort to unlock it will cost more than the price of the new UPS.

[bitcom]

Thanks for your input Alex:
Well I do't know that it is encrypted or not it may be that it is compressed like so many other firmwares for consumer electronics, but but this being a commercial product it could well be enc.
This UPS costs close to $400.00 @ the store, I was lucky to get it for 100.00 off ebay but it was like new condition so I think it would be worth for me to try to fix it specially since the bad part is so cheap and readily available just so it happens to be a mcu.
Luis

[ataradov]

You can try of course.

The file does not look compressed. It has huge chunks of repeated data in it. It also does not look like ARM code, so it is firmware that is manipulated somehow. Probably encrypted.

If you don't have experience doing this sort of thing, you will have to learn, and learning can be expensive, much more expensive than $400.

[bitcom]

Well that is not very encouraging, I'll have to try reading the flash from the good UPS once I get it.
In the mean time I'm gonna have to order the ST-LINK programmer as well.
I'll comment later on my findings
thanks to everyone for commenting.
Luis

[Totoxa]

This looks suspicious to me, may be some key hidden there?

[ataradov]

I doubt it. That would be a super weak encryption. Later on there is another segment with different fill values. So it may be constant padding that was "encrypted", and the key is different for both parts.

[Totoxa]

I've seen weak "encryption" on firmware updates of commercial products but they can be easily spot by the entropy graph of binwalk.
Al least with this file it is almost flat.

[ataradov]

The problem is that even you decrypt  this file, it still does not have the bootloader.

It does look like big fill blocks are located at the end of a section, since they are always followed by what appears to be a header for the next section.

So the file is clearly not a single binary image, but a number of combined sections. Probably, represents the code and resources separately.

It may be worth looking at those headers to see if some reasonable structure appears.

[ataradov]

Actually section headers include human-readable names:
1. UBL 08.31
2. UBL 08.5
3. MCU 19.0
4. UPS 09.4

[bitcom]

Guys I really appreciate you efforts, I read somewhere that on cases the key might be the filename.
I also think this file includes firmware for other microcontoller as well.
On the same board there is this NXP CHIP, as this ups has an LCD maybe the SMT32 only controls the LCD and the NXP the rest of the system or viceversa.
Regards

[ataradov]

It is not really an effort on my side. I still think that it is absolutely impractical to do this from money and time spend perspective. Only if you want to learn, but keep in mind that it will cost you much more than just buying a new unit.

[bitcom]

Alex, I know you're right on your view of this problem, I've already ordered a new unit but the thing is what do I do with this one, I've got the time and will to learn but @ 50 years old I don't think I'm gonna became a software or electrical engineer.
I've contacted APC tech support by email, but so far no response.
thanks again

[richardman]

Sell it for parts maybe your best bet 

[Rasz]

SMT32F0 was broken wide open, I dont know of anyone testing discovered methods on SMT32F103 
https://www.eevblog.com/forum/microcontrollers/stm32-readout-protection-is-broken/

this suggest this attack should work on f1, but of course author didnt actually bother checking https://medium.com/@LargeCardinal/how-to-bypass-debug-disabling-and-crp-on-stm32f103-7116e7abb546

dumping firmware in china
http://www.pcbcopy.com/2016/ic_1128/1928.html
http://www.pcbhf.com/xinpianjiemi/icxinghaopanding/320.html

but even after reading out the firmware it can be encrypted with unique chip ID and not work in another one without decryption/patching
so you will also need http://blog.sina.com.cn/s/blog_770bd2000100zssn.html