Is it possible to permanently secure one MC9S12XE microcontroler ?

[marcseninge]

According to §9.1.7 in MC9S12XEP100 reference manual Rev1.23,

the microcontroler can be unsecured by erasing the entire EEPROM and FLASH memory.

I guess this is done by my "HC12MultilinkCyclonePro"->"Unsecure" menu from the CodeWarrior real-time debugger

and its "P&E_Multilink_USB_Erase_unsecure_hcs12xe.cmd" command file.

The "P&E_Multilink_USB_Erase_unsecure_hcs12xe.cmd" command file uses the "Erase All Blocks" flash command 0x8

to mass erase the microcontroler,

but according to table 29-31 in §29.4.1.4 this command is not possible when FPROT or EPROT protect flash sectors.

Is the microcontroler permanently secured, with no way to unsecure it,

when no back door key is defined and FPROT ou EPROT protect at least one sector ?

Is there any other way to permanently secure the microcontroler ?

[marcseninge]

Thanks for your answer,

I do not find any "0x104" in my "P&E_Multilink_USB_Erase_unsecure_hcs12xe.cmd" but I guess it is an old one.

[RadekS]

Hi marc,

You are right, I looked at the wrong file. It was from the unsecure file for older S12(X) families (built on 250nm technology).

So, we could modify unsecure command file for S12XE. For example:

…

WB 0x100 FCLKDIV // clock divider

WB 0x108 0xFF  // disable protection in the P-Flash memory

WB 0x109 0xFF  // disable protection in the D-Flash memory

WB 0x106 0x30  // clear any error flags

…

I hope it helps you.

Have a great day,
RadekS

-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------

[RadekS · Accepted solution]

Hi marc,

Yes, the "HC12MultilinkCyclonePro"->"Unsecure" menu from the CodeWarrior will execute the "P&E_Multilink_USB_Erase_unsecure_hcs12xe.cmd" command file.

If you look into this file, you could see commands like:

wb 0x104 0xFF    // FPROT all protection disabled

wb 0x114 0xFF    // EPROT all protection disabled

Since MCU is in special mode, debugger could modify FPROT and EPROT registers directly and disable protection prior execute mass erase command.

So, MCU could be fully erased and this way also unsecured.

Note: If I remember correctly, there was one erratum for one of very old S12UF32 masksets. These MCUs were not possible to unsecured by mass erase. However this is already deep history.

Another option for unsecure is using Unsecure12 tool from P&E:

http://www.pemicro.com/downloads/download_file.cfm?download_id=16

Unsecure_12 Help Files:

http://www.pemicro.com/downloads/download_file.cfm?download_id=14

Note: For downloading is necessary registration. This tool could be used only for PEmicro and OSBDM  BDM interfaces.

I am afraid that I am not aware of any special way, how to permanently secure the microcontroller.

I hope it helps you.

Have a great day,
RadekS

-----------------------------------------------------------------------------------------------------------------------
Note: If this post answers your question, please click the Correct Answer button. Thank you!
-----------------------------------------------------------------------------------------------------------------------