topic Re: S32K146 Unsecuring Problem in S32K

S32K146 Unsecuring Problem

wane — Sat, 11 Jan 2025 05:02:18 GMT

Hello.

Can anyone help for unsecure my board?

I had erased all flash blocks using SDK driver function FLASH_DRV_EraseAllBlock().

After this job, I can't access to MCU resources using JTAG connection.

Hence I tried to mass erase using MDM-AP as follows but I didn't get success.

1) MDM-AP Status Read after power on reset

Two values of 0x34 and 0x36 are repeated. It seems the Flash Memory Ready bit is changing.

2) MDM-AP Status Read after mass erase request

Two values of 0x35 and 0x37 are repeated. It also seems the Flash Memory Ready bit is changing.

3) Mass Erase Step

- WHILE (Data.Long(EDBG:0x40000100)&0x02)!=0x02 {} // wait flash ready

- Data.Set EDBG:0x40000104 %long 0x1 // mass erase

- WHILE (Data.Long(EDBG:0x40000104)&0x01)==0x01 {} // wait mass erade done

- Data.Set EDBG:0x40000104 %long 0x18 // system reset

4) Test of Mass Erase on normal unsecured board

I have checked upper 3) Mass Erase Step works well.

Best Regards,

J.W.Park

Re: S32K146 Unsecuring Problem

danielmartynek — Mon, 13 Jan 2025 09:46:50 GMT

Hi @wane,

The FLASH_DRV_EraseAllBlock() always puts the MCU in the secure state. The flash operation could have failed and it could left the flash in an undefined state with ECC errors.

In case the FlexNVM was partitioned with CSEC keys allocated, the Mass erase will be blocked by the engine regardless of the MDM-AP Status[Flash ready].

Have you tried erasing the MCU while it is in reset? After power-on reset keep PTA5 (reset_b) connected to the ground externaly? If this does not resolve it, I'm afraid there is nothing we can do.

Regards,

Daniel

Re: S32K146 Unsecuring Problem

wane — Mon, 13 Jan 2025 20:39:50 GMT

Hi Daniel,

Thanks for your information.

I'll try again with your suggestion.

Regards,