Unsecuring The Mcu Using Backdoor Key Access - NXP Semiconductors MC9S08SU16 Reference Manual

Functional description
• Unsecuring the MCU using BDM
• Mode and security effects on flash command availability

11.3.8.1 Unsecuring the MCU using backdoor key access

The MCU may be unsecured by using the backdoor key access feature which requires
knowledge of the contents of the backdoor keys, which are four 16-bit words
programmed at addresses 0xFF70–0xFF77. If the KEYEN[1:0] bits are in the enabled
state, the verify backdoor access key command – see
command, allows the user to present four prospective keys for comparison to the keys
stored in the flash memory via the memory controller. If the keys presented in the verify
backdoor access key command match the backdoor keys stored in the flash memory,
FSEC[SEC] will be changed to unsecure the MCU. Key values of 0x0000 and 0xFFFF
are not permitted as backdoor keys. While the Verify Backdoor Access Key command is
active, flash memory will not be available for read access and will return invalid data.
The user code stored in the flash memory must have a method of receiving the backdoor
keys from an external stimulus. This external stimulus would typically be through one of
the on-chip serial ports.
If the KEYEN[1:0] bits are in the enabled state, the MCU can be unsecured by the
backdoor key access sequence described below:
1. Follow the command sequence for the verify backdoor access key command as
explained in Verify backdoor access key
2. If the verify backdoor access key command is successful, the MCU is unsecured and
FSEC[SEC] is forced to the unsecure state of 10.
The verify backdoor access key command is monitored by the memory controller and an
illegal key will prohibit future use of the verify backdoor access key command. A reset of
the MCU is the only method to re-enable the verify backdoor access key command. The
security as defined in the flash security byte is not changed by using the verify backdoor
access key command sequence. The backdoor keys stored in addresses 0xFF70–0xFF77
are unaffected by the verify backdoor access key command sequence. The verify
backdoor access key command sequence has no effect on the program and erase
protections defined in the flash protection register, FPROT.
166
MC9S08SU16 Reference Manual, Rev. 5, 4/2017
Verify backdoor access key
command.
NXP Semiconductors