0
\$\begingroup\$

I am reading up on ways to provide security to software images on boot devices. In this regard, I was reading up that if bootloader resides on Flash then using flash memory write protection, the bootloader memory addresses can be prevented from overwritten by malicious software.

However I want to know what is the scope of such protection mechanism? Can someone who has physical access to the flash simply erase/re-flash this region? Thanks

\$\endgroup\$
  • 4
    \$\begingroup\$ Welcome to EE.SE Different devices have different mechanisms. Do you have a particular device or family of devices in mind? \$\endgroup\$ – Peter Smith Mar 4 at 10:59
  • \$\begingroup\$ Many lockable flash devices still have an "erase and unlock" mode, which is often preferred even if there is an allegedly permanent lockout as it means the manufacturer could still fix inventory built up with a flaw. Of course unless availability of the silicon is tightly controlled, someone could just change out the MCU or flash chip for a new blank one and load whatever they want. \$\endgroup\$ – Chris Stratton Mar 4 at 15:49
1
\$\begingroup\$

In devices such as the ARV family from Microchip (formerly Atmel) there are Lock Bits that determine how much access to the boot area is available to users. To change the Lock Bits, a chip erase command must be issued first. If one has the chip and a Programmer, one can erase/flash the region - but any code that was on the chip will be lost.

Malicious user code can not rewrite the flash if the lock bits are programmed to not allow that. In the Atmega328P for example, there are 3 pairs of lock bits that protect:

programming of the Flash and EEPROM,

Store Program Memory (SPM) or Load Program Memory (LPM) instruction accessing the application section,

and SPM or LPM accessing the boot loader section.

\$\endgroup\$
1
\$\begingroup\$

I would guess that anyone with physical access to the Flash could erase it using ionizing radiation directed through the memory cells. In the old days we used UV for this purpose, but I suppose the bad guys have better techniques now.

\$\endgroup\$
  • \$\begingroup\$ Flash memory cells are somewhat susceptible to X-ray (bits can get de-programmed) but usually before a significant number are flipped the charge pump gets fried. \$\endgroup\$ – Peter Smith Mar 4 at 15:18

Not the answer you're looking for? Browse other questions tagged or ask your own question.