Preventing reprogramming an nrf52832

[Rolf]

I can see that we can use APPROTECT to disable reading of the flash.   

This seems to be reversible using: nrfjprog -f NRF52 --recover, which will erase the flash and allow reprogramming.

This protects the original code from being discovered but does not prevent malicious reprogramming.

Is there no way to prevent reprogramming the device with arbitrary code once in the field?

[SRA]

I can’t think of any. Almost all cortex M parts that “disable JTAG/SW” do so for debug read/write commands but you could still recover/reset the chip with an erase. I have yet to see a Cortex M part with a lifecycle implementation.

Are you just being overly concerned about your physical device that could surely be cloned?

if I was tasked to do this, I guess I would program the firmware off the board, then solder the chip on to a board with internally shorted SW pins. That way the only access to program would DFU or desolder. 

[Turbo J]

NXP LPC176x has a "magic" value in flash that can disable both ROM bootloader and JTAG/SWD. The chip is locked for good unless there is a way to erase/flash in the customers firmware.

[SRA]

Yea, and it doesn’t actually work that well. Plus the serial bootloader stays on and can’t be turned off.