F28M35H52C: microcontroller flash memory analysis

Tomas,

If the device is not secured, you can connect to CCS and read the Flash memory.  Did you try that?

Thanks and regards,
Vamsi

I tried to load only the symbols of a known software to a microprocessor that has this same software loaded in the flash memory. After doing it I was able to  copy the flash memory regions I wanted. It works perfectly fine.

However, I would like to copy or at least take a look at the memory regions of a microprocessor with an unknown software. Basically I want to know if a control board has something programed in the flash memory. Is it possible to do it the same way with an empty software project?

Best regards,

Tomàs

Hi Vamsi,

Thanks for your help. I didn't know this tool existed.

I successfully copied the memory regions I wanted to check. However, I found something that I cannot understand. If I read initially the C28 flash memory regions I can read the values loaded in it without any problem. Later, I can read the M3 flash memory regions also without problem. But, if after reading the M3 memory regions I try to read again the C28 memory regions in all of them the value is 0? If I restart the control board and try it again with a new session, the values of the C28 flash memory are not 0 anymore, but the values measured initially.

Do you have any idea on what might be happening?

Finally, one last thing. I receive the e-mails of your answers to an e-mail account that is no longer in use. I checked it and everything is up to date in the configuration of my TI account, I don't understand why I still receive e-mails in my old e-mail address.

Best regards,

Tomàs

Tomas,

Did you get any ECC errors when you read M3 Flash?  Wondering if there is a busfault due to ECC error causing a reset and device lock.

I can loop our security expert based on your answer.

Regarding your email notification question: I can check with our E2E web team and let you know.

Thanks and regards,
Vamsi

No errors at all. The only thing I noticed is that both processors are suspended after reading the M3 memory region, but nothing else.

Best regards,

Tomàs

Tomas,

I will assign this to our security expert to help you further.

Thanks and regards,
Vamsi

OK,

Thanks for your help!

Tomàs

Hi Tomas,

Sorry for late reply. Are you still having this issue ?

If yes, please let me know below.

I successfully copied the memory regions I wanted to check. However, I found something that I cannot understand. If I read initially the C28 flash memory regions I can read the values loaded in it without any problem. Later, I can read the M3 flash memory regions also without problem. But, if after reading the M3 memory regions I try to read again the C28 memory regions in all of them the value is 0? If I restart the control board and try it again with a new session, the values of the C28 flash memory are not 0 anymore, but the values measured initially.

What is the memory address range  you are dumping? Also instead of restart, if you just issue debug reset on M3, do you see the values again in CCS memory watch window ?

Regards,

Vivek Singh

Hi,

I will take a look at you suggestions and I'll let you know. However, I am not using CCS, I am using Uniflash to read the memmory regions.

I am reading all the flash memories in the M3 and C28.

Best regards,

Tomàs

Tomas,

Were you able to check on this ?

Regards,

Vivek Singh