How to uncensor MPC5644A

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

How to uncensor MPC5644A

905 Views
283230333
Contributor III

I got a project recently which said  it can be uncensor the chip MPC5644A. But  when I run the code, it can't be execute the write or read shadow block sequence , and it will be jump to the start position. The code is below. Could someone help me about it?

 

 

#include "MPC5644A.h"

 

 

uint32_t pas_hi;

uint32_t pas_lo;

 

void DisableWatchdog(void)

{

    SWT.MCR.B.WEN = 0x0;

}

 

 

void ShadowFlashReprogram(void)

{

unsigned int i;

 

 

//unlock shadow block

FLASH_A.LMLR.R = 0xA1A11111; //unlock register

FLASH_A.LMLR.R = 0x000303FF; //unlock shadow flash

 

 

FLASH_A.SLMLR.R = 0xC3C33333; //unlock register

FLASH_A.SLMLR.R = 0x000303FF; //unlock shadow flash

 

 

//erase shadow flash

FLASH_A.MCR.B.ERS = 1;

*(unsigned int*)0x00FFC000 = 0xFFFFFFFF; //interlock write - write any address in shadow block

FLASH_A.MCR.B.EHV = 1;

while(FLASH_A.MCR.B.DONE == 0){};

FLASH_A.MCR.B.EHV = 0;

FLASH_A.MCR.B.ERS = 0;

 

 

//confirm the shadow flash is erased

for(i=0x00F00000;i<0x00F04000; i=i+4)

{

if(*(unsigned int*)i != 0xFFFFFFFF)

while(1){}; //shadow flash not erased!

}

 

 

//base address 0x00FF_C000

 

 

//pas_hi = *(unsigned int*)0xFFFDD8;

//pas_lo = *(unsigned int*)0xFFFDDC;

//program shadow flash (restore default password and censoring information)

FLASH_A.MCR.B.PGM = 1;

//program first 128bit page

*(volatile unsigned int*)0xFFFDD8 = 0xFEEDFACE; //write data within 128bit programming page

*(volatile unsigned int*)0xFFFDDC = 0xCAFEBEEF; //write data within 128bit programming page

FLASH_A.MCR.B.EHV = 1; //program page (words that were not written above will have default value 0xFFFF)

while(FLASH_A.MCR.B.DONE == 0){};

FLASH_A.MCR.B.EHV = 0;

FLASH_A.MCR.B.PGM = 0;

//program second 128bit page

FLASH_A.MCR.B.PGM = 1;

*(volatile unsigned int*)0xFFFDE0 = 0x55AA55AA; //write data within 128bit programming page

FLASH_A.MCR.B.EHV = 1; //program page (words that were not written above will have default value 0xFFFF)

while(FLASH_A.MCR.B.DONE == 0){};

FLASH_A.MCR.B.EHV = 0;

//end of program sequence

FLASH_A.MCR.B.PGM = 0;

}

 

 

int main(void) {

  volatile int i = 0;

 

  //SIU.PCR[84].B.PA = 0x01;  //CAN_TX

 

  DisableWatchdog();

  ShadowFlashReprogram();

 

 

 

  /* Loop forever */

  for (;;) {

    i++;

  }

}

Labels (1)
0 Kudos
3 Replies

623 Views
davidtosenovjan
NXP TechSupport
NXP TechSupport

I have just tried it and it works normally to me. Example code attached. Also you can find there several screenshots to see how to enable debug on censored device.

0 Kudos

623 Views
283230333
Contributor III

Yes, I tried the project you sent to me recently , but when the code run to the erase the shadow flash , it will be running out . so the code can't run normally. Can you help me ?

0 Kudos

623 Views
283230333
Contributor III

The code is run in the RAM, and the start position is 4000 0000, the function is __start

0 Kudos