Un-securing the MCU using backdoor key access

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Un-securing the MCU using backdoor key access

1,288 Views
David_Estevez
Contributor I

Hi,

I'm working with S32K116 microcontrollers, trying to set the MCU in secure mode and later switch it to unsecure mode using the backdoor key, as described in the S32K Reference Manual in section 36.5.12.2.1. To do this, I have a code where the first step is modifying the startup_S32K116.S file by adding the backdoor key in the flash configuration section and setting the FSEC to 0xF instead of 0xE at the end, to put the MCU in secure mode. Here's an example in the following image:

David_Estevez_1-1732179692459.png

Then, I create a function to update the FCCOB register, as described in the manual, to check if the key is correct and switch the MCU back to unsecure mode:

David_Estevez_2-1732181448718.png

Finally, in my main function, I ensure that a message is sent via UART at the start of the program, indicating that the MCU is in secure mode. Then, it calls the key verification function and sends another UART message showing the current status.

David_Estevez_3-1732181673341.png

I first flashed the program in unsecure mode to verify that it worked and sent the messages via UART. Then, I flashed it in secure mode, but nothing happened, and I could no longer flash the MCU again.

 

Why isn't it working?

Best regards, and thank you in advance.

 

0 Kudos
Reply
4 Replies

1,268 Views
David_Estevez
Contributor I

Thw problem with UART is solved, it is working properly and show that when the program starts the mcu is secure and after the backdoor_key_verify is unsecured

David_Estevez_0-1732191671285.png

But even if the secure mode is unlocked, it still doesn't let me reflash the microcontroller.

0 Kudos
Reply

1,254 Views
danielmartynek
NXP TechSupport
NXP TechSupport

Hi @David_Estevez,

The MCU goes back to the secure state after a system reset.

The debugger/programmer must not reset the MCU before the MCU is erased/reprogrammed.

 

Regards,

Daniel

 

 

0 Kudos
Reply

1,246 Views
David_Estevez
Contributor I

To reprogram without resetting the MCU, what options do I have to disable in debug configurations? because it's not working for me. I am using a PE micro multilink.

Regards.

0 Kudos
Reply

1,242 Views
danielmartynek
NXP TechSupport
NXP TechSupport

The PE Micro plugin in S32DS IDE allows the Multilink to be attached to the MCU without reset:

danielmartynek_1-1732279035140.png

Once attached, you can halt the core and debug the MCU.

 

To erase the MCU after that, you would need a script, I guess.

Please contact PE Micro support.

danielmartynek_2-1732279156876.png

 

Regards,

Daniel

 

0 Kudos
Reply