Hello @Dthum.1 ,
i would like to clarify some point about RDP and PCROP because the case you are describing in 1) shouldn't be unavailable after RDP level 1.
In fact, Readout protection is a global Flash memory protection allowing the embedded firmware code to be protected against copy, reverse engineering, dumping, using debug tools or code injection in SRAM.
in RDP level 1 :
If boot mode = user Flash and no debugger access is detected, then
• R/W/Erase possible on Flash memory, SRAM* and Backup registers*.
• Option bytes change possible
If boot mode ≠ user Flash or debugger access is detected, then
• R/W/Erase to Flash memory, SRAM* (family dependent), and Backup registers are blocked (hard fault generated).
• Option bytes change possible.
On a consumer product, the RDP must always be set at least at level 1. This prevents basic attacks through
the debug port or through the bootloader. However, in RDP level 1, there is a risk of service denial caused by a
flash memory mass erase, following a return to RDP level 0.
PCROP in the other hand
• This feature set a memory area in flash defined by user in execute only mode
• The CPU can only jump to a PCROP area but cannot read or write it.
• This region can’t be read via debugging link.
check this Introduction to security for STM32 MCUs - Application note for more details.
you can also thru the labs on YouTube to further help you understand the usage of these features:
Security Part3 - STM32 Security features - 07 - PCROP lab (youtube.com)
Security Part3 - STM32 Security features - 09 - Readout protection lab (youtube.com)
Regards
In order to give better visibility on the answered topics, please click on Accept as Solution on the reply which solved your issue or answered your question.
