Helppp!Seek a 9S12XPE100 program to encrypt chip,and then can't read PartID.

[帅哥谢]

Seek a 9S12XEP100 program (.S19), when the program is burned into the 9S12XEP100, the chip will be encrypted and cannot read Part ID.

Thank You !

[ZhangJennie]

Hi

In order to secure the flash of the device, an appropriate value has to be written into the Flash Security Register (FSEC register).   Writing to the FSEC register is actually something that is done by the MCU itself, automatically after RESET, and not by the user.

What the user has to do, is to store the value to be written in a parrticular  Non-Volatile location. This is a special address in Flash memory  and everytime the MCU comes out of RESET, the value at this flash address is automatically loaded into the Flash Security register.

The address in Flash where you have to store this value is typically 0xFF0F. You can check this by consulting your Flash Module chapter in your device's datasheet.

What the user has to do is to declare a constant value and make sure it is included into the S19 and programmed at that address. To know the value to write, again please check the FSEC register description in your datasheet. Typically, the two least significant bits in this register determine whether the MCU is secured or not.  These bits are called SEC1 and SEC0 and securing your device is equivalent to writing a good value into these bits.  What is a good value? One thing to know is that, whatever value you write, the BDM programmer will automatically unsecure your device. This is necessary for the BDM to erase and program your device's Flash. Of the 4 possible combinations of SEC1 and SEC0, only one represents an unsecure state. So the BDM will wite this value, which is value 1-0.  SEC1 = 1. SEC0 = 0.

After this is done, your S19 will be programmed, and eventually whatever value you wrote will be written again into SEC1, SEC0.  Because SEC0 is already at value zero, the other securing value that does not conflict with this is to set SEC1=0, SEC0=0.  (a bit already set to zero cannot be set back to one, the inverse, however, is possible)  So I do recommend that you use the value SEC1=0 SEC0=0 to secure your device.  A resulting useful value for the register is FSEC= 0xF0.

To declare such a value, in your code you have to declare a constant. Under CodeWarror, the syntax would be :

const unsigned char myvalue@0xFF0F = 0xF0;

For more information, I suggest you refer reference manual, search  “Flash Security Register(FSEC)”

if you want to use back door key, please refer an2880

https://www.nxp.com/docs/en/application-note/AN2880.pdf

the demo code an2880sw

software for AN2880 

Have a great day,
Jennie Zhang

-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------

[帅哥谢]

hi ZhangJennie,

Thank you for your reply!

But what you said just seems to show how to encrypt the chip,I want to let the chip can't read Part ID in security.

I found some 9S12XEP100 chip can't read out the Part ID in security.I have encrypted the chip,but it can still read out the Part ID.

Look forward your reply if you know something about that.

Best regards,

帅哥 谢

[ZhangJennie]

you mentioned  ".I have encrypted the chip,but it can still read out the Part ID.". How did you read it out?

can you please specify?

[帅哥谢]

Thank you for paying attention my to my problem.

I am making a program to read and write the memory of the chip.

MC9S12 series have a BDM(Background Debug Mode) interface.The chip can read out the memory of the chip by this interface include chip Part ID, even if the chip was in security.But I have encountered some unknown cases and I can't read out the Part ID success(The chip is secure).But it can read out the Part ID want the chip out of security.I want to know why.

Best regards.

[kef2]

Hi, 帅哥 谢 

Perhaps bad shot, but are you resetting target MCU to special single chip mode before reading PARTID? If not, and your target keeps running, then readability of anything can be affected by wait and stop modes. Also bus clock may be too high for your BDM tool.

Regards

Edward

[帅哥谢]

HI, Edward

I am sure the process of reset will make the normol MCU enter the special single chip mode,but the state of the MCU i had described above.

But you words reminded me,Is it possible that is the program inside of MCU control chip can't into special single chip mode normal?

Best regards.

帅哥 谢

[ZhangJennie]

Please send us your demo project, and mention how to reproduce your problem step by step with it. Thanks.

Jennie.

[帅哥谢]

Sorry,my expression is wrong.It was "I am making a programmer",not "program".

The process is:

First      : let the chip into special single chip mode by BDM reset;

Second : send the read common and the addr of the Part ID to chip.

Then,the normol chip will respond the Part ID(e.g. 0xcc94).And the chip i has described above will respond the wrong Part ID(e.g. 0xffff).

Best regards.

[kef2]

Hi 帅哥 谢 ,

• First      : let the chip into special single chip mode by BDM reset;

Could you please explain what "BDM reset" is? If it's pull BKGD low -> pulse /RESET low -> release BKGD, then answer to your previous question ..

• I am sure the process of reset will make the normol MCU enter the special single chip mode,but the state of the MCU i had described above.
• But you words reminded me,Is it possible that is the program inside of MCU control chip can't into special single chip mode normal?

... is no, program inside of MCU can't disable BDM, at least using all available means documented in public released datasheets. Perhaps there's something documented in secret datasheets, I don't know.

Regards,

Edward