AN2398 Freescale Semiconductor / Motorola, AN2398 Datasheet - Page 4

• Manufacturer Part Number: AN2398
• Description: In-Circuit Programming of FLASH Memory via the Universal Serial Bus for the MC68HC908JB8
• Manufacturer: Freescale Semiconductor / Motorola

AN2398/D
Security Against
Unauthorized
Access
Protection Against
Power Failure
During ICP
The ICP_FLAG
4
In-Circuit Programming of FLASH Memory via the USB for the MC68HC908JB8
The contents of the 8 bytes, $FFF6 to $FFFD, are used as a passcode for entry
into JB8’s monitor mode, where the monitoring software can have full access
of the device FLASH memory, and thus allowing code dumps. Normally, this
8-byte passcode is virtually impossible to guess, as the starting address of
these interrupt service routines are buried inside the user code.
If all eight pseudo vectors were fixed locations, say in an array from $F7E6 to
$F7FD (3 bytes each), it would be quite easy to guess the 8-byte passcode.
One way to make the guessing harder is to alter the sequence of the pseudo
vectors in the array. The guessing is made even harder by shifting the array by
one or two addresses, or by inserting blank slots in the array. The entire array
can even be anywhere within the user code. The scheme implemented here is
by embedding the critical 8 bytes randomly in the user code (the addresses Aw,
Ax, Ay, and Az in
The ICP scheme must be designed to take into account of possible power
failure during an ICP routine in progress. The command handler must be able
to recover and complete the ICP routine. The ICP_FLAG word used for this
purpose.
After reset, the ICP_FLAG word is read to determine whether the JB8 should
enter normal operating mode or ICP mode. This word is at $F7FE, and is at the
last two bytes in the user code area. This use of the ICP_FLAG is explained in
the subsequent sections.
1. The addresses of these pseudo vectors are selected randomly for security reasons. See
Freescale Semiconductor, Inc.
Vector Address
the following section on security against unauthorized access.
$FFFC : $FFFD
$FFFA : $FFFB
$FFFE : $FFFF
$FFF0 : $FFF1
$FFF2 : $FFF3
$FFF4 : $FFF5
$FFF6 : $FFF7
$FFF8 : $FFF9
For More Information On This Product,
Go to: www.freescale.com
Table
Table 1. Vector Addresses
1).
Pseudo Vector Address
$F7FC : $F7FD
$F7F9 : $F7FA
$F7F3 : $F7F4
$F7F6 : $F7F7
Aw : Aw+1
Ax : Ax+1
Az : Az+1
Ay : Ay+1
(1)
(1)
(1)
(1)
Keyboard Interrupt
TIM Overflow
TIM Channel 1
Reset
TIM Channel 0
IRQ
USB
SWI
Interrupt
MOTOROLA