How to uncensor MPC5644A

283230333 — Thu, 24 Sep 2015 02:11:49 GMT

I got a project recently which said it can be uncensor the chip MPC5644A. But when I run the code, it can't be execute the write or read shadow block sequence , and it will be jump to the start position. The code is below. Could someone help me about it?

#include "MPC5644A.h"

uint32_t pas_hi;

uint32_t pas_lo;

void DisableWatchdog(void)

{

SWT.MCR.B.WEN = 0x0;

}

void ShadowFlashReprogram(void)

{

unsigned int i;

//unlock shadow block

FLASH_A.LMLR.R = 0xA1A11111; //unlock register

FLASH_A.LMLR.R = 0x000303FF; //unlock shadow flash

FLASH_A.SLMLR.R = 0xC3C33333; //unlock register

FLASH_A.SLMLR.R = 0x000303FF; //unlock shadow flash

//erase shadow flash

FLASH_A.MCR.B.ERS = 1;

*(unsigned int*)0x00FFC000 = 0xFFFFFFFF; //interlock write - write any address in shadow block

FLASH_A.MCR.B.EHV = 1;

while(FLASH_A.MCR.B.DONE == 0){};

FLASH_A.MCR.B.EHV = 0;

FLASH_A.MCR.B.ERS = 0;

//confirm the shadow flash is erased

for(i=0x00F00000;i<0x00F04000; i=i+4)

{

if(*(unsigned int*)i != 0xFFFFFFFF)

while(1){}; //shadow flash not erased!

}

//base address 0x00FF_C000

//pas_hi = *(unsigned int*)0xFFFDD8;

//pas_lo = *(unsigned int*)0xFFFDDC;

//program shadow flash (restore default password and censoring information)

FLASH_A.MCR.B.PGM = 1;

//program first 128bit page

*(volatile unsigned int*)0xFFFDD8 = 0xFEEDFACE; //write data within 128bit programming page

*(volatile unsigned int*)0xFFFDDC = 0xCAFEBEEF; //write data within 128bit programming page

FLASH_A.MCR.B.EHV = 1; //program page (words that were not written above will have default value 0xFFFF)

while(FLASH_A.MCR.B.DONE == 0){};

FLASH_A.MCR.B.EHV = 0;

FLASH_A.MCR.B.PGM = 0;

//program second 128bit page

FLASH_A.MCR.B.PGM = 1;

*(volatile unsigned int*)0xFFFDE0 = 0x55AA55AA; //write data within 128bit programming page

FLASH_A.MCR.B.EHV = 1; //program page (words that were not written above will have default value 0xFFFF)

while(FLASH_A.MCR.B.DONE == 0){};

FLASH_A.MCR.B.EHV = 0;

//end of program sequence

FLASH_A.MCR.B.PGM = 0;

}

int main(void) {

volatile int i = 0;

//SIU.PCR[84].B.PA = 0x01; //CAN_TX

DisableWatchdog();

ShadowFlashReprogram();

/* Loop forever */

for (;;) {

i++;

}

Re: How to uncensor MPC5644A

283230333 — Thu, 24 Sep 2015 02:14:51 GMT

The code is run in the RAM, and the start position is 4000 0000, the function is __start

Re: How to uncensor MPC5644A

davidtosenovjan — Fri, 25 Sep 2015 14:30:16 GMT

I have just tried it and it works normally to me. Example code attached. Also you can find there several screenshots to see how to enable debug on censored device.

Re: How to uncensor MPC5644A

283230333 — Tue, 20 Oct 2015 09:02:57 GMT

Yes, I tried the project you sent to me recently , but when the code run to the erase the shadow flash , it will be running out . so the code can't run normally. Can you help me ?

MPC5xxxのトピックRe: How to uncensor MPC5644A

How to uncensor MPC5644A

Re: How to uncensor MPC5644A

Re: How to uncensor MPC5644A

Re: How to uncensor MPC5644A