S12Z unsecure

cancel
Showing results for 
Search instead for 
Did you mean: 

S12Z unsecure

385 Views
charles_wangw
Contributor II

Hello 

I am using an S12Z MCU and meeting an interesting question below need help.

1. After I secure MCU through debug pin to write value below

flash_array[] @0xFFFE00 = {0xAA,0xAA,0xAA,0xAA,0xAA,0xAA,0xAA,0xAA,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xFF,0xBD};

2. Reset though debug and see MCU is locked.

3. Move out debug pin and power off/on

4. Send comment though to let MCU do the config below:

while(FSTAT_CCIF == 0) /*wait if command is in progress*/
FSTAT = 0x30; /*clear ACCERR and PVIOL*/

FCCOBIX = 0x04; /*Reflect parameters needed by the command; varies from command to command.
If not set correctly, ACCERR flag will be set preventing the command from being executed*/
FCCOB0 = 0x0C00; /*Verify Backdoor Access Key Command*/
FCCOB1 = 0xAAAA; /*Key0*/
FCCOB2 = 0xAAAA; /*Key1*/
FCCOB3 = 0xAAAA; /*Key2*/
FCCOB4 = 0xAAAA; /*Key3*/

Seems good. But how can I know if the MCU is unsecured? While I connect debug pin to check if I can debug again. MCU will reset and the "unsecured process" above seems not work.

Thanks

Charles

 

 

Tags (1)
0 Kudos
6 Replies

338 Views
charles_wangw
Contributor II

Hello Radek

 

Could you please help to check again of my test above?

Thanks

 

Charles

0 Kudos

378 Views
RadekS
NXP Employee
NXP Employee

Hello Charles,

regarding "how can I know if the MCU is unsecured?")

Please use Attach instead of Download in debug configuration for MCU reconnection.

Attach.png

After that read FSEC register. MCU load this register from flash during reset sequence.

You may also send FSEC register value via any comm channel like SCI. 

If MCU is secured, the CW automatically offers unsecure procedure. You should refuse it in such case.

If MCU is secured, you should be able to read the register memory area, but not the flash content.

 

I hope it helps you

Best regards

Radek

 

 

 

0 Kudos

370 Views
charles_wangw
Contributor II

Hello Radek

Thank you for your feedback. Seems I can read the register to see it is unlocked. But why I still not dump(save) flash out. They are all 0xEE which seems are still locked.

Thanks

charles_wangw_0-1625709259130.png

 

0 Kudos

299 Views
danielmartynek
NXP TechSupport
NXP TechSupport

Hello @charles_wangw,

I'm sorry for the delayed response,

What IDE and debugger do you use?

 

Thank you,

BR, Daniel

Tags (1)
0 Kudos

294 Views
charles_wangw
Contributor II

Hello Daniel

 

I use WINIDEA with IC5000.

Thanks

 

Charles

0 Kudos

287 Views
danielmartynek
NXP TechSupport
NXP TechSupport

Hello Charles,

 

Thank you,

Can you please contact isystem?

I don't think this is an issue with the MCU itself.

You could test it by reading the FSEC register and the memory location of FSEC (in Flash Configuration Field) by the application code and send the information out via UART or using GPIOs.

 

Regards,

Daniel

 

 

0 Kudos