nRF52840 - securing the device against firmware read, erase, and re-program

RE: nRF52840 - securing the device against firmware read, erase, and re-program

Mr. Broshar — Tue, 10 Jan 2023 19:17:24 GMT

First call enables config write access.

Second call disables config write access.

RE: nRF52840 - securing the device against firmware read, erase, and re-program

manoj12345 — Thu, 02 Jan 2020 13:55:58 GMT

why NRF_NVMC->CONFIG used for two times?

RE: nRF52840 - securing the device against firmware read, erase, and re-program

Garrett — Wed, 17 Jul 2019 18:26:10 GMT

I say this in jest but, they might be able to use the following NRF52840 errata

RE: nRF52840 - securing the device against firmware read, erase, and re-program

AmbystomaLabs — Tue, 18 Sep 2018 18:23:05 GMT

As far as I know you can't protect against ERASEALL.

You use the APPROTECT UICR register to protect against SWD read/write memory access and access to the processor registers. The ERASEALL command clears the entire chip including UICR. Even with APPROTECT UICR set you can still do OTA/DFU if you implement it.

You can set APPROTECT either through command line and SWD or you can set it in software.

Currently I set it in main for our products. But there are good reasons for doing it at command line.

This is how you do it in code:

if (NRF_UICR->APPROTECT != 0x0)
{
NRF_NVMC->CONFIG = 0x1;
NRF_UICR->APPROTECT = 0x0;
NRF_NVMC->CONFIG = 0x0;
}

It writes same way as flash, so erase is all 1's and set is 0's.