Interpretation of STM32 MCU: Code to implement PCROP clearing

Preface
STM32  PCROP proprietary code readout protection sets a certain area to only allow execution, which can prevent the code from being illegally read out and modified. The ST website provides free PCROP reference code, but the routine only provides code to set PCROP. To facilitate the development and deployment of intellectual property protection using PCROP, this article provides a method to use code to clear PCROP when the RDP level is set to 1 or 0.

PCROP reference code on the ST website
To learn how to use PCROP, you can download documents and reference code from the ST website. The document has detailed step-by-step instructions. The reference code implements how to set up the compilation development environment to remove the literal pool to avoid the need for read access to the protected area; the reference code also implements how to use code to enable PCROP protection and how to export interface symbols for secondary development.
You can compile and run the PCROP reference code. Once downloaded to the development board and run, sector 2 will automatically be set to PCROP protection. You will not be able to download code to this sector again, nor can you read the contents of this sector. If you want to remove PCROP protection through the STLink tool , the entire Flash will be erased.

Using code to clear PCROP
Based on the familiarity of the PCROP reference code on the ST website, we will discuss how to use code to clear PCROP.

  1. Principle
According to the STM32 user manual , to clear PCROP protection, the read protection RDP level must be set from 1 to 0. That is to say, even if the current RDP level is 0, we have to use code to set it to 1. Then, turn off PCROP and set RDP to 0 at the same time. This also shows that even if it is to clear PCROP protection, our code must add the RDP setting function, and cannot simply modify the status field of PCROP_Enable in the reference code to make it PCROP_Disable.




  2. Material preparation
Development board:  STM32F429I_Discovery
Development tools: STM32Cube_FW_F4 _V1.15.0
                STM32CubeExpansion_AN4701_F4_V1.0.0 (reference code downloaded from ST website)
                STM32  STLink
                IAR/Keil
Note: You can also select other STM32 series that support PCROP, and select the corresponding STM32 development board and STM32 firmware library .

3. Code
 ● Set RDP to level 1
This function must be used when the RDP level is 0 if you need to clear PCROP.

 ●Set RDP to level 0
This function is not called directly in the code that clears PCROP protection. The reference manual mentions that clearing PCROP must happen at the same time as RDP goes from 1 to 0, and the following RDP_Disable function is completely independent and cannot be operated at the same time as the Option bytes of PCROP. However, the middle part of this code, which is the actual functional part, will be reused when clearing PCROP.

 ●Clear PCROP
The following code clears PCROP. It is rewritten based on the PCROP_Enable function in the reference code. First, it sets RDP to 1 through RDP_Enable. Note that you should not set RDP to 2 in the experiment, otherwise all Option bytes will no longer be allowed to be modified. Then, after setting both RDP and PCROP, call HAL_FLASH_OB_Launch once to set RDP to 1 and clear PCROP protection at the same time.

4. Run
in the main function and call PCROP_Disable to remove the PCROP protection. After RDP_Enable, you need to turn off the power, restart, and then run the system normally to remove the PCROP protection. After removing the protection, you can confirm that the PCROP Option bytes have been restored through STLink, and you can also see that the entire Flash content has been erased.

Conclusion
This article discusses the setting and clearing of PCROP completely controlled by code. It can be used in the development and deployment stage of PCROP code protection.