Unsecure ms9s12p128

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Unsecure ms9s12p128

Jump to solution
2,407 Views
MUXU
Contributor II

I have set the backdoor access key for mc9sp128 and configured the security state.

Now I want to read the flash content. How can I unlock it?

Labels (1)
0 Kudos
Reply
1 Solution
2,260 Views
MUXU
Contributor II

void Verity_BackdoorKey(void)

while((FSTAT&0X80) == 0){
if(FSEC&0X03)!=0X02 && (FSEC&0XC0) == 0X80) {

FSTAT=0X30;

FCC0BIX=0X00;FCCOB=0X0C00;

FCC0BIX=0X01;FCCOB=0X1234;

FCC0BIX=0X02;FCCOB=0X4567;

FCC0BIX=0X03;FCCOB=0X89AB;

FCC0BIX=0X04;FCCOB=0XCDEF;

Disable_Interrupt();

FlashOperateRun;

Enable_Interrupt();

}

}

View solution in original post

0 Kudos
Reply
3 Replies
2,261 Views
MUXU
Contributor II

void Verity_BackdoorKey(void)

while((FSTAT&0X80) == 0){
if(FSEC&0X03)!=0X02 && (FSEC&0XC0) == 0X80) {

FSTAT=0X30;

FCC0BIX=0X00;FCCOB=0X0C00;

FCC0BIX=0X01;FCCOB=0X1234;

FCC0BIX=0X02;FCCOB=0X4567;

FCC0BIX=0X03;FCCOB=0X89AB;

FCC0BIX=0X04;FCCOB=0XCDEF;

Disable_Interrupt();

FlashOperateRun;

Enable_Interrupt();

}

}

0 Kudos
Reply
2,385 Views
danielmartynek
NXP TechSupport
NXP TechSupport

HI @MUXU,

Refer to this document:
https://community.nxp.com/t5/S12-MagniV-Microcontrollers/S12-X-MCU-Security/ta-p/1111118

Once the MCU is unlocked via the backdoor key, you need to attach the debugger without resetting the MCU, any reset would lock the MCU again.

 

Regards,

Daniel

 

0 Kudos
Reply
2,326 Views
MUXU
Contributor II

First of all,thank you for your help.

I saw that there is a example in AN2880.pdf,but I couldn't find the AN2880SW.zip file.

Could you please assist me with this? 

0 Kudos
Reply
%3CLINGO-SUB%20id%3D%22lingo-sub-2250856%22%20slang%3D%22en-US%22%20mode%3D%22CREATE%22%3EUnsecure%20ms9s12p128%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2250856%22%20slang%3D%22en-US%22%20mode%3D%22CREATE%22%3E%3CP%3EI%20have%20set%20the%20backdoor%20access%20key%20for%20mc9sp128%20and%20configured%20the%20security%20state.%3C%2FP%3E%3CP%3ENow%20I%20want%20to%20read%20the%20flash%20content.%20How%20can%20I%20unlock%20it%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-2250856%22%20slang%3D%22en-US%22%20mode%3D%22CREATE%22%3E%3CLINGO-LABEL%3ESecurity(Edgelock%20%7C%20secure%20boot%20%7C%20OTP)%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2251741%22%20slang%3D%22en-US%22%20mode%3D%22CREATE%22%20translate%3D%22no%22%3E%E5%9B%9E%E5%A4%8D%EF%BC%9A%20Unsecure%20ms9s12p128%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2251741%22%20slang%3D%22en-US%22%20mode%3D%22CREATE%22%3E%3CP%3Evoid%20Verity_BackdoorKey%EF%BC%88void%EF%BC%89%3C%2FP%3E%3CP%3E%EF%BD%9B%3C%2FP%3E%3CP%3Ewhile%EF%BC%88%EF%BC%88FSTAT%26amp%3B0X80)%20%3D%3D%200)%7B%3CBR%20%2F%3Eif(FSEC%26amp%3B0X03)!%3D0X02%20%26amp%3B%26amp%3B%20(FSEC%26amp%3B0XC0)%20%3D%3D%200X80)%20%7B%3C%2FP%3E%3CP%3EFSTAT%3D0X30%3B%3C%2FP%3E%3CP%3EFCC0BIX%3D0X00%3BFCCOB%3D0X0C00%3B%3C%2FP%3E%3CP%3EFCC0BIX%3D0X01%3BFCCOB%3D0X1234%3B%3C%2FP%3E%3CP%3EFCC0BIX%3D0X02%3BFCCOB%3D0X4567%3B%3C%2FP%3E%3CP%3EFCC0BIX%3D0X03%3BFCCOB%3D0X89AB%3B%3C%2FP%3E%3CP%3EFCC0BIX%3D0X04%3BFCCOB%3D0XCDEF%3B%3C%2FP%3E%3CP%3EDisable_Interrupt()%3B%3C%2FP%3E%3CP%3EFlashOperateRun%3B%3C%2FP%3E%3CP%3EEnable_Interrupt()%3B%3C%2FP%3E%3CP%3E%7D%3C%2FP%3E%3CP%3E%7D%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2251445%22%20slang%3D%22en-US%22%20mode%3D%22CREATE%22%20translate%3D%22no%22%3ERe%3A%20Unsecure%20ms9s12p128%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2251445%22%20slang%3D%22en-US%22%20mode%3D%22CREATE%22%3E%3CP%3EFirst%20of%20all%2Cthank%20you%20for%20your%20help.%3C%2FP%3E%3CP%3EI%20saw%20that%20there%20is%20a%20example%20in%20AN2880.pdf%2Cbut%20I%20couldn't%20find%20the%20AN2880SW.zip%20file.%3C%2FP%3E%3CP%3ECould%20you%20please%20assist%20me%20with%20this%3F%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2250977%22%20slang%3D%22en-US%22%20mode%3D%22CREATE%22%20translate%3D%22no%22%3ERe%3A%20Unsecure%20ms9s12p128%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2250977%22%20slang%3D%22en-US%22%20mode%3D%22CREATE%22%3E%3CP%3EHI%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Fcommunity.nxp.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F199597%22%20target%3D%22_blank%22%3E%40MUXU%3C%2FA%3E%2C%3C%2FP%3E%0A%3CP%3ERefer%20to%20this%20document%3A%3CBR%20%2F%3E%3CA%20href%3D%22https%3A%2F%2Fcommunity.nxp.com%2Ft5%2FS12-MagniV-Microcontrollers%2FS12-X-MCU-Security%2Fta-p%2F1111118%22%20target%3D%22_blank%22%3Ehttps%3A%2F%2Fcommunity.nxp.com%2Ft5%2FS12-MagniV-Microcontrollers%2FS12-X-MCU-Security%2Fta-p%2F1111118%3C%2FA%3E%3C%2FP%3E%0A%3CP%3EOnce%20the%20MCU%20is%20unlocked%20via%20the%20backdoor%20key%2C%20you%20need%20to%20attach%20the%20debugger%20without%20resetting%20the%20MCU%2C%20any%20reset%20would%20lock%20the%20MCU%20again.%3C%2FP%3E%0A%3CBR%20%2F%3E%0A%3CP%3ERegards%2C%3C%2FP%3E%0A%3CP%3EDaniel%3C%2FP%3E%0A%3CBR%20%2F%3E%3C%2FLINGO-BODY%3E