EmbeddedRelated.com
Forums

Code Protection

Started by Brian C. Lane February 19, 2004
>64-pin/128-pin LPC2000 devices with a Boot Loader ID >= 1.6 have
>flash Read Protection. Ashling users can can check your device's ID
>using FlashLPC (I think the Philips ISP programmer supports this as
>well). Code read protection is enabled by programming the flash
>address location 0x1FC (User flash sector 0) with value 0x87654321.
>If Read Protection is enabled then the device has to be fully erased
>(thus disabling Read Protection) before it can be re-programmed.
>We're currently adding support for this in our tools; further
>announcements shortly.
>
>BTW, use this information at your own risk. Philips Applications
>will be making "official" announcements shortly.

I guess this kind of protection is quite useless, perhaphs this is
why Philips doen't disclosure the JTAG direct access to Flash
read/write routines, but it's pretty simple to disassemble IAP
bootloader (I've read somewhere on Russian ARM forum that there are
few peoples who are doing this) and to have direct access to Flash
through JTAG instead through IAP
I even read on the same Russian forum that one guy sucessfully
overwrote (by mistake) bootloader Flash when tried to write huge file
through the Philips ISP, thus made the chip absolutely useless
without the bootloader code inside.

Best regards
Tsvetan



An Engineer's Guide to the LPC2100 Series

Message
AFAIK, when read protection is enabled all JTAG access (to flash) is blocked as well as Read/Write/Copy/Go "bootloader" commands.
-----Original Message-----
From: tsvetanusunov [mailto:t...@mail.bg]
Sent: 20 February 2004 10:32
To: l...@yahoogroups.com
Subject: [lpc2000] Re: Code Protection

>64-pin/128-pin LPC2000 devices with a Boot Loader ID >= 1.6 have
>flash Read Protection. Ashling users can can check your device's ID
>using FlashLPC (I think the Philips ISP programmer supports this as
>well). Code read protection is enabled by programming the flash
>address location 0x1FC (User flash sector 0) with value 0x87654321.
>If Read Protection is enabled then the device has to be fully erased
>(thus disabling Read Protection) before it can be re-programmed.
>We're currently adding support for this in our tools; further
>announcements shortly.
>
>BTW, use this information at your own risk. Philips Applications
>will be making "official" announcements shortly.

I guess this kind of protection is quite useless, perhaphs this is
why Philips doen't disclosure the JTAG direct access to Flash
read/write routines, but it's pretty simple to disassemble IAP
bootloader (I've read somewhere on Russian ARM forum that there are
few peoples who are doing this) and to have direct access to Flash
through JTAG instead through IAP
I even read on the same Russian forum that one guy sucessfully
overwrote (by mistake) bootloader Flash when tried to write huge file
through the Philips ISP, thus made the chip absolutely useless
without the bootloader code inside.

Best regards
Tsvetan

Hi Hugh,

Could you explain what you mean by JTAG access to flash - is there a
document on this somewhere?

Regards
Michael Message: 2
Date: Fri, 20 Feb 2004 10:40:07 -0000
From: "Hugh O'Keeffe" <>
Subject: RE: Re: Code Protection

AFAIK, when read protection is enabled all JTAG access (to flash) is
blocked as well as Read/Write/Copy/Go "bootloader" commands.
Hugh @ http://www.ashling.com/support/lpc2100/



Message
Hi Michael,
 
By JTAG access I meant using an external tool (wiggler etc). with a debugger to try to read flash (via the EmbeddedICE/JTAG link). There is no official documentation yet, I believe its WIP and will be released soon
-----Original Message-----
From: Michael Johnson [mailto:m...@rowley.co.uk]
Sent: 20 February 2004 14:34
To: l...@yahoogroups.com
Subject: [lpc2000] Re: code protection

Hi Hugh,

Could you explain what you mean by JTAG access to flash - is there a
document on this somewhere?

Regards
MichaelMessage: 2
   Date: Fri, 20 Feb 2004 10:40:07 -0000
   From: "Hugh O'Keeffe" <h...@ashling.com>
Subject: RE: Re: Code Protection

AFAIK, when read protection is enabled all JTAG access (to flash) is
blocked as well as Read/Write/Copy/Go "bootloader" commands.
Hugh @ http://www.ashling.com/support/lpc2100/
> AFAIK, when read protection is enabled all JTAG access (to flash) is
> blocked as well as Read/Write/Copy/Go "bootloader" commands.
> Hugh @ http://www.ashling.com/support/lpc2100/

That's great to hear Hugh.

Cutting off JTAG pins won't do the trick :-)
I don't know about the US market, but the Australian engineering industry
has notoriously long suffered from massive revenue losses because of
copying product in Asia.
One automotive client of mine once sent a small After Market product to a
Malaysian partner company (based on PIC).
Within SIX weeks a replica of the product was sent back, HW, SW _even_
the case was faithfully reproduced (as an exercise).

Slicon was regularly microprobed to steal the code.
If these people go through the trouble of microprobing, I don't think
partially
cut off pins will stop them :-)
(Providing the design is worth it of course).

Virtually all designs I've done dictated code security as paramount.

-- Kris


> > AFAIK, when read protection is enabled all JTAG access (to flash) is
> > blocked as well as Read/Write/Copy/Go "bootloader" commands.
> > Hugh @ http://www.ashling.com/support/lpc2100/

Once a part is code protected, can it be erased and reprogrammed?



Hi Igor,
 
I have a mate who's raving on about Sharp, have you looked at them ?
They have on-board color-BW LCD controller, PS/2 etc.
 
http://www.sharpsma.com/sma/products/MCUSoC.htm
 
> is very painful, at least it is for me. When compared to Microchip, dealing
> with LPC2k is like doing time in jail. Maybe I'm just spoiled but dealing
> with 240x160x16shades-of-gray graphic LCD, RS485 network, speech
> recognition, IrDA, ultrasonic flow meter, PMR446 radio receiver and all of
Here's an excerpt of the Bluestreak overview :
 
".......
The 16/32 bit BlueStreak MCU/SoCs offer higher performance than ordinary 16-bit MCUs.
Utilizing the ARM7TDMI core with 32KB of on-chip SRAM, Color and grayscale LCD controller,
plus three UARTs, SPI, CAN 2.0B, three 16-bit Counter/Timers, A/D Converter, Watchdog Timer and Low Voltage Detector,
they are an excellent solution to speed-versus-cost concerns.
Applications include GPS, PDA, Printers / Copiers, Security Control Panels, and Smart Appliances.
The 32-bit series of BlueStreak MCU/SoCs begins with the LH79520, which combines a 32-bit ARM7TDMI RISC core
with 8KB Cache, MMU, color LCD controller, and 32KB SRAM. Also included are a number of essential peripherals
such as a DMA Controller, Serial and Parallel Interfaces, Infrared Support, Counter/Timers, Real Time Clock, Watchdog Timer,
Pulse Width Modulators, and an on-chip Phase Lock Loop. For more power, the LH7A400 and LH7A404 SoCs build on this basic
feature set with ARM9 cores and add highly-desired functionality like USB and MMC.
With their high performance and integration, the 32-bit BlueStreak devices are a great choice as a basis for handheld devices
like GPS, Games, PDAs, Pocket PCs, and Media Players.
......"
 
 
Seems they're parts w/o on-board program memory though, I haven't looked
close enough.
 
-- Kris
 


> I have a mate who's raving on about Sharp, have you looked at them ?

I used one recently and it worked great. However, they have no internal
FLASH, and no serial boot capability, so designs using these parts are
generally limited to cumbersome RAM/ROM/uC architectures. But the LCD
capability is really nice.. it's memory mapped and supports everything.


Hi Kris,
 
You probably won't believe me but for this project I checked every ARM7 solution that exists on this planet :)
Data Sheets, Application Notes, User Manuals. Thousands of pages. You name it - I downloaded it. I guess that's what R in R&D is all about :)
 
Including Sharp. Just to mention that Hynix has similar solution. I even checked Aeroflex (military and aerospace solutions)!
 
Thing is that I need speech recognition. I planned to use VA SDK for ARM7, but today, after evaluating 483 pages of VA SDK User Manual, I just realized that VA can't support so called Continuous Listening. It means that I will probably use their RSC4k MCU, which is speech recognition dedicated chip. Tools are free for download (IDE and assembler and many examples) and Evaluation Board is only $150. Problem is that it requires external program memory and at least one serial EEPROM to store recognition patterns. Also, it is $15 device, so I tried to avoid it but with no success.
 
Anyway, now when RSC4k is the only choice, I don't need ARM7 anymore (consumes too much current). I will switch to good old PIC18 core. It has enough processing power to deal with everything (except speech recognition). dsPIC family won't be introduced so soon as I expected so that solution is not appropriate. Also, release date for dsPIC speech recognition library from Microchip is still unknown.
 
When it comes to LCD, we have custom LCD designed for us with integrated LCD driver/controller (on tab) so no problem with that.
 
Everything else is pretty much standard.
 
Thank you for your suggestion.
 
List of all solutions that have integrated any kind of ARM processor can be found here:
http://www.arm.com/support/where_to_buy.html
But there is only link to:
http://www.arm.com/miscPDFs/1668.pdf
 
On the other hand, on ARM's web site you can find this document:
http://www.arm.com/miscPDFs/3858.pdf
Which is more up to date!
I don't remember how I managed to find this 3858.pdf document??? I have it on HD but where it came from??? :))
 
That's what happens after downloading couple hundred mega bytes from Internet :)
 
Regards,
Igor
 
----- Original Message -----
From: microbit
To: l...@yahoogroups.com
Sent: Saturday, February 21, 2004 4:16 PM
Subject: Re: [lpc2000] Re: Code Protection

Hi Igor,
 
I have a mate who's raving on about Sharp, have you looked at them ?
They have on-board color-BW LCD controller, PS/2 etc.
 
http://www.sharpsma.com/sma/products/MCUSoC.htm
 
> is very painful, at least it is for me. When compared to Microchip, dealing
> with LPC2k is like doing time in jail. Maybe I'm just spoiled but dealing
> with 240x160x16shades-of-gray graphic LCD, RS485 network, speech
> recognition, IrDA, ultrasonic flow meter, PMR446 radio receiver and all of
Here's an excerpt of the Bluestreak overview :
 
".......
The 16/32 bit BlueStreak MCU/SoCs offer higher performance than ordinary 16-bit MCUs.
Utilizing the ARM7TDMI core with 32KB of on-chip SRAM, Color and grayscale LCD controller,
plus three UARTs, SPI, CAN 2.0B, three 16-bit Counter/Timers, A/D Converter, Watchdog Timer and Low Voltage Detector,
they are an excellent solution to speed-versus-cost concerns.
Applications include GPS, PDA, Printers / Copiers, Security Control Panels, and Smart Appliances.
The 32-bit series of BlueStreak MCU/SoCs begins with the LH79520, which combines a 32-bit ARM7TDMI RISC core
with 8KB Cache, MMU, color LCD controller, and 32KB SRAM. Also included are a number of essential peripherals
such as a DMA Controller, Serial and Parallel Interfaces, Infrared Support, Counter/Timers, Real Time Clock, Watchdog Timer,
Pulse Width Modulators, and an on-chip Phase Lock Loop. For more power, the LH7A400 and LH7A404 SoCs build on this basic
feature set with ARM9 cores and add highly-desired functionality like USB and MMC.
With their high performance and integration, the 32-bit BlueStreak devices are a great choice as a basis for handheld devices
like GPS, Games, PDAs, Pocket PCs, and Media Players.
......"
 
 
Seems they're parts w/o on-board program memory though, I haven't looked
close enough.
 
-- Kris
 


Hi Igor,

A speech recognition solution that worked out well (you probably know them)
was using Neural Network in an 8 bit, low current.
(Speaker dependent/indepdent).
I can't remember their name though, would have to quickly look it up.
Back in 1997 the problem was that their dev kit cost a load, and training it
for additional
vocabulary was expensive (they did it in-house).
I wonder how that all stands today.
I've played around quite a bit with my own NN SW, but never had proper CPU
power for it
(apart from PC).
ARM would be great to play around again with NN.
I might contact you off-list about code protection and OKI. B regards,
Kris
----- Original Message -----
From: "Igor Janjatovic" <>
To: <>
Sent: Sunday, February 22, 2004 8:50 AM
Subject: Re: [lpc2000] Re: Code Protection Hi Kris,

You probably won't believe me but for this project I checked every ARM7
solution that exists on this planet :)
Data Sheets, Application Notes, User Manuals. Thousands of pages. You name
it - I downloaded it. I guess that's what R in R&D is all about :)

Including Sharp. Just to mention that Hynix has similar solution. I even
checked Aeroflex (military and aerospace solutions)!

Thing is that I need speech recognition. I planned to use VA SDK for ARM7,
but today, after evaluating 483 pages of VA SDK User Manual, I just realized
that VA can't support so called Continuous Listening. It means that I will
probably use their RSC4k MCU, which is speech recognition dedicated chip.
Tools are free for download (IDE and assembler and many examples) and
Evaluation Board is only $150. Problem is that it requires external program
memory and at least one serial EEPROM to store recognition patterns. Also,
it is $15 device, so I tried to avoid it but with no success.

Anyway, now when RSC4k is the only choice, I don't need ARM7 anymore
(consumes too much current). I will switch to good old PIC18 core. It has
enough processing power to deal with everything (except speech recognition).
dsPIC family won't be introduced so soon as I expected so that solution is
not appropriate. Also, release date for dsPIC speech recognition library
from Microchip is still unknown.

When it comes to LCD, we have custom LCD designed for us with integrated LCD
driver/controller (on tab) so no problem with that.

Everything else is pretty much standard.

Thank you for your suggestion.

List of all solutions that have integrated any kind of ARM processor can be
found here:
http://www.arm.com/support/where_to_buy.html
But there is only link to:
http://www.arm.com/miscPDFs/1668.pdf

On the other hand, on ARM's web site you can find this document:
http://www.arm.com/miscPDFs/3858.pdf
Which is more up to date!
I don't remember how I managed to find this 3858.pdf document??? I have it
on HD but where it came from??? :))

That's what happens after downloading couple hundred mega bytes from
Internet :)

Regards,
Igor

----- Original Message -----
From: microbit
To:
Sent: Saturday, February 21, 2004 4:16 PM
Subject: Re: [lpc2000] Re: Code Protection Hi Igor,

I have a mate who's raving on about Sharp, have you looked at them ?
They have on-board color-BW LCD controller, PS/2 etc.

http://www.sharpsma.com/sma/products/MCUSoC.htm

> is very painful, at least it is for me. When compared to Microchip,
dealing
> with LPC2k is like doing time in jail. Maybe I'm just spoiled but
dealing
> with 240x160x16shades-of-gray graphic LCD, RS485 network, speech
> recognition, IrDA, ultrasonic flow meter, PMR446 radio receiver and all
of

Here's an excerpt of the Bluestreak overview :

".......
The 16/32 bit BlueStreak MCU/SoCs offer higher performance than ordinary
16-bit MCUs.
Utilizing the ARM7TDMI core with 32KB of on-chip SRAM, Color and grayscale
LCD controller,
plus three UARTs, SPI, CAN 2.0B, three 16-bit Counter/Timers, A/D
Converter, Watchdog Timer and Low Voltage Detector,
they are an excellent solution to speed-versus-cost concerns.
Applications include GPS, PDA, Printers / Copiers, Security Control
Panels, and Smart Appliances.
The 32-bit series of BlueStreak MCU/SoCs begins with the LH79520, which
combines a 32-bit ARM7TDMI RISC core
with 8KB Cache, MMU, color LCD controller, and 32KB SRAM. Also included
are a number of essential peripherals
such as a DMA Controller, Serial and Parallel Interfaces, Infrared
Support, Counter/Timers, Real Time Clock, Watchdog Timer,
Pulse Width Modulators, and an on-chip Phase Lock Loop. For more power,
the LH7A400 and LH7A404 SoCs build on this basic
feature set with ARM9 cores and add highly-desired functionality like USB
and MMC.
With their high performance and integration, the 32-bit BlueStreak devices
are a great choice as a basis for handheld devices
like GPS, Games, PDAs, Pocket PCs, and Media Players.
......" Seems they're parts w/o on-board program memory though, I haven't looked
close enough.

-- Kris
----
--
Yahoo! Groups Links

a.. To