AnsweredAssumed Answered

Unsecure 9S12T with backdoor key and BDM.

Question asked by Padelis Floudas on Mar 5, 2014
Latest reply on Sep 28, 2016 by Gaowei zheng

Hi,

 

I am trying to unsecure a 9S12 using BDM and backdoor key.

I have previously set the KEYEN bit and the backdoor key locations in the flash.

So i am trying to unlock it using BDM and following the suggestion in the datasheet:

 

  1. Set the KEYACC bit in the Flash Configuration register FCNFG.
  2. Write the first 16-bit word of the backdoor key to $FF00.
  3. Write the second 16-bit word of the backdoor key to $FF02.
  4. Write the third 16-bit word of the backdoor key to $FF04.
  5. Write the fourth 16-bit word of the backdoor key to $FF06.
  6. Clear the KEYACC bit in the Flash Configuration register FCNFG.

 

A couple lines before that it mentions :

 

  • It is not possible to download the backdoor keys using Background Debug Mode.

 

By "download" does it mean that you cant read the keys?

Anyway i am using this to send the keys :

 

uint16_t pass[4] = { 0xAAAA, 0xAAAA, 0xAAAA, 0xAAAA };

error = USBDM_WriteMemory(MS_Word, 4, 0xFF00, (uint8_t*)pass);

 

Any suggestions on how to make it happen? I have no luck till now.

 

Thank you

 

P.S.: I am reseting in normal single chip mode.

Outcomes