topic Re: Securing & Unsecuring HCS12 (E256) Flash, using AN2880SW in S12 / MagniV Microcontrollers

Securing & Unsecuring HCS12 (E256) Flash, using AN2880SW

MaxY — Tue, 22 May 2007 14:01:42 GMT

Hi all,
I'm trying to AN2880SW, it's for DP256 series, and I revised it that can be adapted for E256 serise.
But there is a question I need to clarify.
Does E256 support function of unsecuring Flash via backdoor key?
If yes, AN2880 doesn't seem to work.

I've traced source code, named an2720.asm. When program runs into this section and set KEYACC,
KEYACC is still 0. That will casue unsecuring to be failed.
Did I lose something?

Re: Securing & Unsecuring HCS12 (E256) Flash, using AN2880SW

kef — Tue, 22 May 2007 21:03:55 GMT

MaxY,

I tried this AN2880SW and found two bugs and something surprising. Results:

1) First of all there are at least two bugs in the code.

1.1) First problem (a bug) is in main.c at line 50:

const unsigned int keys [] = {0x1111, 0x2222, 0x3333, 0x4444}; /* Backdoor keys */

This looks nice but const in this CW project means flash. Ant DoOnStack routine can't read these values from flash because at the time flash is "disconnected" (KEYACC is set). I tried to step through code and found that my D64 (I modified just PRM file) returns zeros from keys[] when stepping through DoOnStack.

1.2) 2nd bug is in AN2720.asm file:

;; 130:      *(unsigned int *)(0xBF00) = keys[0];     /* Write key 1 */
LDX   keys
STX   $BF00
;; 131:      *(unsigned int *)(0xBF02) = keys[1];     /* Write key 2 */
LDY   keys + 1
STY   $BF02
;; 132:      *(unsigned int *)(0xBF04) = keys[2];   /* Write key 3 */
LDD   keys + 2
STD   $BF04
;; 133:      *(unsigned int *)(0xBF06) = keys[3];   /* Write key 4 */
LDD   keys + 3
STD   $BF06

Keys is array of ints, not chars so there must be keys+2 instead of keys+1, keys+4 instead of keys+2 etc:

;; 130:      *(unsigned int *)(0xBF00) = keys[0];     /* Write key 1 */
LDX   keys
STX   $BF00
;; 131:      *(unsigned int *)(0xBF02) = keys[1];     /* Write key 2 */
LDY   keys + 2
STY   $BF02
;; 132:      *(unsigned int *)(0xBF04) = keys[2];   /* Write key 3 */
LDD   keys + 4
STD   $BF04
;; 133:      *(unsigned int *)(0xBF06) = keys[3];   /* Write key 4 */
LDD   keys + 6
STD   $BF06

2) What's interesting - unmodified code (except PRM) was working on D64! After I moved keys[] from flash to RAM program started to say "Cannot unsecure". And after second fix it started to work again.

It seems that D64 2L86D and 0M89C masksets do accept zeros as backdoor keys!

I tried the same with DG128, it refused zeros as backdoor keys. Maybe at the time of writing this appnote author had buggy Dx256 that was also accepting zeros as backdoor keys?

Re: Securing & Unsecuring HCS12 (E256) Flash, using AN2880SW

MaxY — Wed, 23 May 2007 14:12:18 GMT

Hi kef,
How touched! It works.
I followed the steps you mentioned and runs on E64 & E256 successfully.
Thank you so much.

Re: Securing & Unsecuring HCS12 (E256) Flash, using AN2880SW

kef — Thu, 24 May 2007 16:30:37 GMT

Hi, MaxY

Thanks for feedback. I want to add some cents.

I think that AN2880 doesn't match E and other families, especially newer masksets well. I haven't worked with DP256 but IIRC there was an errata that flash couldn't be reprogrammed until unsecured. So if one wanted to debug in special mode, then he had to reflash security byte and the top most flash sector. But to reflash it one had to backdoor unsecure first. I guess that using E-fam and others without such an errata, you don't have to backdoor unsecure, just reflash the top most sector with security byte set to off.

Also, if you want to unsecure temporarily without reset (to gain BDM debugger access in so called "hot-plug" mode) then you don't have to reflash the security byte. AN2880 first backdoor unsecures the part, then it reflashes the sector to make security permanently off. These both actions are to much for normal parts.

And regarding D64 undocumented errata. I found that D64 accepts not only all 0-s as backdoor keys but also all 1-s. Backdoor keys in flash are any but backdoor unsecure procedure succeeds when I try to get in whith all 0-s or all 1-s. Docs say that 0-s and 1-s should fail even if backdoor keys in flash are the same. Ooops 0-s or 1-s break any key...

It made me bit paranoic :smileyhappy: and I tried it also with C32, and DG128. Only D64's I have are defective. And hopefully only program running in MCU can backdoor unsecure. So workaround would be to check if external key isn't all 0's or all 1's and only then continue with backdoor unsecure.

Regards