crp3 reset chip help

[lpcware]

Content originally posted in LPCWare by justjames on Wed Oct 14 05:15:00 MST 2015
Hi all
we have an issue at college that a student who has been expelled has locked 10 dev boards fitted with the lpc2478 chip into crp3 before he left.
We have read many forums and tried flashmagic isp and the known codes we have but had no joy
All we need to do is erase all on the chip, we can then reprogram as we have the files we need for the flash

I have read different things on different forums and manuals as to how this can be done, or can not be done so I thought I best ask here as the manufacturers support is going to be the best reply

thanks in advance
James

[lpcware]

Content originally posted in LPCWare by EhsanDaneshvar on Sun Nov 22 07:25:45 MST 2015
i must add this solution is useful for your next CRP3 tries ... and i have no idea for your locked MCUs.  :)

[lpcware]

Content originally posted in LPCWare by EhsanDaneshvar on Sun Nov 22 07:23:36 MST 2015
there is a way to do that ...

you must have a program inside of your LPC device that can erase itself ...
it not complex

inside of LPC device you can find some library that uses for ISP and the only thing you want is a pointer function to recall them and a secure way to call it from outside of your device

for example you can embed a switch and in your main procedure check it .. if it's pressed for 5 second after reset program will recall the erase chip function of LPC ROM.
you can find extra information in LPC user manual and IAP ( In Application Programming) part.

best regards.

[lpcware]

Content originally posted in LPCWare by mc on Wed Oct 14 18:28:00 MST 2015
Hi,
As mentioned by others, you did not implement Re-invoke ISP  command in the code, so you can not update the firmware.
This is the highest level of CRP protection and unfortunately used in your code without firmware update option.

You may want to replace the device.

[lpcware]

Content originally posted in LPCWare by mysepp on Wed Oct 14 08:20:40 MST 2015
I assume you must de-solder the broken chip and solder a new (empty) one...

[lpcware]

Content originally posted in LPCWare by justjames on Wed Oct 14 06:52:50 MST 2015

---

Quote: bavarian
Yes, that's exactly the point. You can't initiate an ISP mode from the outside when you have CRP3.
If you are inside, then you can do that. You could have any type of proprietary verification procedure in your code which decides if access is given or not.
The appnote does not give you instructions how to hack a CRP3 protected chip ;-)

Regards,
Bavarian.

---

Hi Bavarian

If I understand then we do not have the re invoke, we have never had it in our school so its not in any code that could have been in existence. We assume the student just added crp3 to cause havoc
Is it possible to hack the chip? p2.10 hasnt helped unless we are doing something wrong

Thanks
James

[lpcware]

Content originally posted in LPCWare by bavarian on Wed Oct 14 06:30:56 MST 2015
Yes, that's exactly the point. You can't initiate an ISP mode from the outside when you have CRP3.
If you are inside, then you can do that. You could have any type of proprietary verification procedure in your code which decides if access is given or not.
The appnote does not give you instructions how to hack a CRP3 protected chip ;-)

Regards,
Bavarian.

[lpcware]

Content originally posted in LPCWare by R2D2 on Wed Oct 14 05:45:58 MST 2015

---

Quote: justjames
Because in the manual it also says:

When we use Re-Invoke ISP...

---

And how do you reinvoke ISP ?

[lpcware]

Content originally posted in LPCWare by justjames on Wed Oct 14 05:43:58 MST 2015
Because in the manual it also says:

When we use Re-Invoke ISP, we are breaking CRP3 protection, which ultimately means we are downgrading to level CRP2. Although in this level we can’t read the flash, we can download a new code.

http://www.nxp.com/documents/application_note/AN10851.pdf

[azzurrodante]

hello this link is obsolete
http://www.nxp.com/documents/application_note/AN10851.pdf
there is new link to show app note AN10851 ?

[lpcware]

Content originally posted in LPCWare by R2D2 on Wed Oct 14 05:33:26 MST 2015

---

Quote: justjames
I have read different things on different forums and manuals as to how this can be done, or can not be done

---

Datasheet:

---

Quote:

Running an application with level CRP3 selected fully disables any access to chip via the JTAG pins and the ISP. This mode effectively disables ISP override using P2[10] pin, too. It is up to the user’s application to provide (if needed) flash update mechanism using IAP calls or a call to reinvoke the ISP command to enable flash update via UART0.

---

So what's not clear there  :quest: