Skip to content

5. Firmware Analysis

Jump to bottom
Spb2005 edited this page Feb 16, 2026 · 3 revisions

SWD Debug Interface

The T248 wheel PCB exposes a debug footprint containing the following pins:

  • NRST
  • SWCLK (PA14)
  • SWDIO (PA13)
  • 3.3 V
  • GND

Attempts were made to dump the wheel firmware via ST-Link using the SWD interface.

Result:

  • No successful firmware dump
  • Likely causes: connection failure or a locked/disabled debug interface

Pin Multiplexing Issue

During analysis, it was observed that the debug pins are shared with other functions:

  • PA14 (SWCLK) is also connected to the Mode button and the wheel connector
  • PA13 (SWDIO) is shared with Button 9

Possible explanations for the failed access:

  1. Debug interface is disabled in the firmware
  2. Readout Protection (RDP) is enabled
  3. Pins are reconfigured very early during boot
  4. A specific boot mode may be required for debug access

The exact reason remains unknown.

Firmware Updating

The wheelbase firmware can be updated via the official Windows updater. It is currently unclear if this process also updates the wheel firmware. If it does, it likely uses the UART interface, possibly involving the Reset line and PA14 (SWCLK).

I located the firmware files in the updater directory:
C:\Program Files\Guillemot\tmfwupdater\firmware

  • File extension: .tmf (likely Thrustmaster Firmware)
  • Renaming to .bin allows inspection with ST-Link Utility or similar tools

File structure (260 KB):

  1. First Section:
    • Starts at the beginning and ends at 0x00017840 (~1/3 of the file)
  2. Empty Gap:
    • From 0x00017840 to 0x00037870 (~1/2 of the file)
  3. Second Section:
    • From 0x00037870 to 0x0003E7D0 (~1/10 of the file)
  4. Final Empty Region:
    • Extends to 0x0003F870 (~1/14 of the file)

Observations:

  • The first section likely contains the wheelbase firmware (128 KB)
  • The second section likely contains the wheel firmware (64 KB)
  • Suggests that both firmware images are combined into a single .tmf file

It is unclear whether the wheel firmware is first uploaded to the wheelbase and flashed from there, or if the PC updater flashes both components individually with the wheelbase acting as a passthrough.

Understanding the exact process likely requires analyzing the updater program itself, which is currently beyond the available knowledge.

Open Questions

  • Is the wheel firmware updated during official updates?
  • What role does PA14 play during flashing?
  • Is there a custom bootloader on the wheel MCU?
  • Does the wheelbase validate firmware integrity?
  • Is encryption or signature verification used?

Read Next

For protocol-level behavior, see:

For hardware pin mapping, see:

Clone this wiki locally