This thread has been locked.

If you have a related question, please click the "Ask a related question" button in the top right corner. The newly created question will be automatically linked to this question.

Keep same BSL password throughout reversions with ISR re-jump table

Other Parts Discussed in Thread: MSP430G2553

Just an example for a G2553, in theory you could skip all the ORG as all unused ISR slots are used up with password enhancers.
As you never know if you later use unused_isr, don't put a reti there but jump (Branch) to a reti to keep same instructions length.
A brute force attack would only take hrs, but they would had to know you use a table.
You could replace nmi_jmp with another a DB 'XY' to make it harder, as that IRQ is least likely that you would later change to being used.
Put some other data you have interleaved with BR table, should make it even harder. don't always use 0xFFA0, ±6 to make it harder.

A virgin chip does not have 0x0000 at 0xFFDE, so always try 0xff,0xff,0xff,0xff... password first so it does not erase infoA
Having your program trying multiple passwords without checking if true is OK. As once in, it stays command unlocked until next reset.

  ASEG 0xFFA0           ; shuffle this section once if you want added security
PORT1_JMP	           BR	#PORT1_ISR
PORT2_JMP		       BR	#PORT2_ISR
ADC10_JMP		       BR	#ADC10_ISR
USCIAB0TX_JMP		   BR	#USCIAB0TX_ISR
USCIAB0RX_JMP		   BR	#USCIAB0RX_ISR
TIMER0_A1_JMP		   BR	#TIMER0_A1_ISR
TIMER0_A0_JMP		   BR	#TIMER0_A0_ISR
WDT_JMP		           BR	#not_used_ISR
COMPARATORA_JMP        BR	#not_used_ISR
TIMER1_A1_JMP		   BR	#TIMER1_A1_ISR
TIMER1_A0_JMP		   BR	#not_used_ISR
NMI_JMP		           BR	#not_used_ISR
RESET_JMP		       BR	#main
  ASEG 0xFFDC  
  DB	0x1,0x20	; reversion for internal use
  DW	0x0000   	; zero disables the erasure of the flash if an invalid password is supplied during BSL.
  
  COMMON	INTVEC 			        /* Interrupt Vector base 0xFFE0 */
  DB		'PASW'				  /* not used, so use it as password enhancer */
  ORG		PORT1_VECTOR			/* 0xFFE4 Port 1 */
  DW		PORT1_JMP
  ORG		PORT2_VECTOR			/* 0xFFE6 Port 2 */
  DW		PORT2_JMP
  DB		'RD'				   /* not used, so use it as password enhancer */
  ORG		ADC10_VECTOR			/* 0xFFEA ADC10 */
  DW		ADC10_JMP
  ORG		USCIAB0TX_VECTOR		/* 0xFFEC USCI A0/B0 Transmit */
  DW		USCIAB0TX_JMP
  ORG		USCIAB0RX_VECTOR		/* 0xFFEE USCI A0/B0 Receive */
  DW		USCIAB0RX_JMP
  ORG		TIMER0_A1_VECTOR		/* 0xFFF0 Timer0)A CC1, TA0 */
  DW		TIMER0_A1_JMP
  ORG		TIMER0_A0_VECTOR		/* 0xFFF2 Timer0_A CC0 */
  DW		TIMER0_A0_JMP
  ORG		WDT_VECTOR	          	/* 0xFFF4 Watchdog Timer */
  DW		WDT_JMP
  ORG		COMPARATORA_VECTOR		/* 0xFFF6 Comparator A */
  DW		COMPARATORA_JMP
  ORG		TIMER1_A1_VECTOR		/* 0xFFF8 Timer1_A CC1-4, TA1 */
  DW		TIMER1_A1_JMP
  ORG		TIMER1_A0_VECTOR		/* 0xFFFA Timer1_A CC0 */
  DW		TIMER1_A0_JMP
  ORG		NMI_VECTOR		 	    /* 0xFFFC Non-maskable */
  DW		NMI_JMP
  ORG		RESET_VECTOR			/* 0xFFFE Reset [Highest Priority] */
  DW		RESET_JMP
  END

  • Tony,
    Very cool and thanks for posting. I've seen a lot of threads lately that ask for ways to use up unused vectors to strengthen passwords, so this is definitely something that's been much-requested.
    -Katie
  • If you open your msp430g2553.h file you can see what your unused hardware slots are and you could add: PASSWORD1 PASSWORD2.... 
    For higher security:
    You could use 'random' numbers to what is for you unused ISR, but if you later change your code to now use it you would get a new BSL password.

    /************************************************************
    * Interrupt Vectors (offset from 0xFFE0)
    ************************************************************/
    #define PASSWORD1           (0 * 2u)  /* 0xFFE0 empty slot */
    #define PASSWORD2           (1 * 2u)  /* 0xFFE2 empty slot */
    #define PORT1_VECTOR        (2 * 2u)  /* 0xFFE4 Port 1 */
    #define PORT2_VECTOR        (3 * 2u)  /* 0xFFE6 Port 2 */
    #define PASSWORD3           (4 * 2u)  /* 0xFFE8 empty slot */
    #define ADC10_VECTOR        (5 * 2u)  /* 0xFFEA ADC10 */
    #define USCIAB0TX_VECTOR    (6 * 2u)  /* 0xFFEC USCI A0/B0 Transmit */
    #define USCIAB0RX_VECTOR    (7 * 2u)  /* 0xFFEE USCI A0/B0 Receive */
    #define TIMER0_A1_VECTOR    (8 * 2u)  /* 0xFFF0 Timer0)A CC1, TA0 */
    #define TIMER0_A0_VECTOR    (9 * 2u)  /* 0xFFF2 Timer0_A CC0 */
    #define WDT_VECTOR          (10 * 2u) /* 0xFFF4 Watchdog Timer */
    #define COMPARATORA_VECTOR  (11 * 2u) /* 0xFFF6 Comparator A */
    #define TIMER1_A1_VECTOR    (12 * 2u) /* 0xFFF8 Timer1_A CC1-4, TA1 */
    #define TIMER1_A0_VECTOR    (13 * 2u) /* 0xFFFA Timer1_A CC0 */
    #define NMI_VECTOR          (14 * 2u) /* 0xFFFC Non-maskable */
    #define RESET_VECTOR        (15 * 2u) /* 0xFFFE Reset [Highest Priority] */

**Attention** This is a public forum