0
\$\begingroup\$

I am reading up on ways to provide security to software images on boot devices. In this regard, I was reading up that if bootloader resides on Flash then using flash memory write protection, the bootloader memory addresses can be prevented from overwritten by malicious software.

However I want to know what is the scope of such protection mechanism? Can someone who has physical access to the flash simply erase/re-flash this region? Thanks

\$\endgroup\$

closed as too broad by Chris Stratton, Elliot Alderson, Voltage Spike, Finbarr, Lior Bilia Mar 10 at 1:42

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 4
    \$\begingroup\$ Welcome to EE.SE Different devices have different mechanisms. Do you have a particular device or family of devices in mind? \$\endgroup\$ – Peter Smith Mar 4 at 10:59
  • \$\begingroup\$ Many lockable flash devices still have an "erase and unlock" mode, which is often preferred even if there is an allegedly permanent lockout as it means the manufacturer could still fix inventory built up with a flaw. Of course unless availability of the silicon is tightly controlled, someone could just change out the MCU or flash chip for a new blank one and load whatever they want. \$\endgroup\$ – Chris Stratton Mar 4 at 15:49
1
\$\begingroup\$

In devices such as the ARV family from Microchip (formerly Atmel) there are Lock Bits that determine how much access to the boot area is available to users. To change the Lock Bits, a chip erase command must be issued first. If one has the chip and a Programmer, one can erase/flash the region - but any code that was on the chip will be lost.

Malicious user code can not rewrite the flash if the lock bits are programmed to not allow that. In the Atmega328P for example, there are 3 pairs of lock bits that protect:

programming of the Flash and EEPROM,

Store Program Memory (SPM) or Load Program Memory (LPM) instruction accessing the application section,

and SPM or LPM accessing the boot loader section.

\$\endgroup\$
1
\$\begingroup\$

I would guess that anyone with physical access to the Flash could erase it using ionizing radiation directed through the memory cells. In the old days we used UV for this purpose, but I suppose the bad guys have better techniques now.

\$\endgroup\$
  • \$\begingroup\$ Flash memory cells are somewhat susceptible to X-ray (bits can get de-programmed) but usually before a significant number are flipped the charge pump gets fried. \$\endgroup\$ – Peter Smith Mar 4 at 15:18

Not the answer you're looking for? Browse other questions tagged or ask your own question.