How to reset sbsfu or unlock my flash memory??

[yolominwoo]

I'm porting my project(sbsfu Nucleo-h753zi to Nucleo-h745zi-q)

and i checked protection my board, but i can't full chip erase.

./STM32_Programmer_CLI.exe -c port=swd mode=UR -ob PROT_AREA_START1=0xFF PROT_AREA_END1=0 RDP=0xAA

-------------------------------------------------------------------
STM32CubeProgrammer v2.16.0
-------------------------------------------------------------------

ST-LINK SN : 003900363137511039383538
ST-LINK FW : V3J14M5
Board : NUCLEO-H745ZI-Q
Voltage : 3.27V
SWD freq : 8000 KHz
Connect mode: Under Reset
Reset mode : Hardware reset
Device ID : 0x450
Revision ID : Rev V
Device name : STM32H7xx
Flash size : 2 MBytes
Start Address : 8000000
Device type : MCU
Device CPU : Cortex-M7/M4
BL Version : 0x90

UPLOADING OPTION BYTES DATA ...

Bank : 0x00
Address : 0x5200201c
Size : 308 Bytes

栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢 100%

PROGRAMMING OPTION BYTES AREA ...
Warning: Option Byte: rdp, value: 0xAA, was not modified.

Bank : 0x00
Address : 0x5200201c
Size : 308 Bytes

栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢 100%

UPLOADING OPTION BYTES DATA ...

Bank : 0x00
Address : 0x5200201c
Size : 308 Bytes

栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢 100%

OPTION BYTE PROGRAMMING VERIFICATION:

Error: Expected value for Option Byte "prot_area_end1": 0x0, found: 0x8
Error: Expected value for Option Byte "prot_area_start1": 0xFF, found: 0x6
Error: Option Byte Programming failed Or modified by application after OB_LAUNCH

and when i send UserApp.sfb using ymodem. stoped the 1024kb

[yolominwoo]

sudo ./STM32_Programmer_CLI.exe -c port=swd -ob displ

-------------------------------------------------------------------
STM32CubeProgrammer v2.16.0
-------------------------------------------------------------------

ST-LINK SN : 003900363137511039383538
ST-LINK FW : V3J14M5
Board : NUCLEO-H745ZI-Q
Voltage : 3.28V
SWD freq : 8000 KHz
Connect mode: Normal
Reset mode : Software reset
Device ID : 0x450
Revision ID : Rev V
Device name : STM32H7xx
Flash size : 2 MBytes
Start Address : 8000000
Device type : MCU
Device CPU : Cortex-M7/M4
BL Version : 0x90

UPLOADING OPTION BYTES DATA ...

Bank : 0x00
Address : 0x5200201c
Size : 308 Bytes

栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢栢 100%

OPTION BYTES BANK: 0

Read Out Protection:

RDP : 0xAA (Level 0, no protection)

BOR Level:

BOR_LEV : 0x0 (reset level is set to VBOR0)

User Configuration:

IWDG1_SW : 0x1 (Independent watchdog is controlled by software)
IWDG2_SW : 0x1 (Independent watchdog is controlled by software)
NRST_STOP_D1 : 0x1 (STOP mode on Domain 1 is entering without reset)
NRST_STBY_D1 : 0x1 (STANDBY mode on Domain 1 is entering without reset)
FZ_IWDG_STOP : 0x1 (Independent watchdog is running in STOP mode)
FZ_IWDG_SDBY : 0x1 (Independent watchdog is running in STANDBY mode)
BCM4 : 0x0 (CM4 boot disabled)
BCM7 : 0x1 (CM7 boot enabled)
NRST_STOP_D2 : 0x1 (STOP mode on Domain 2 is entering without reset)
NRST_STBY_D2 : 0x1 (STANDBY mode on Domain 2 is entering without reset)
SWAP_BANK : 0x0 (after boot loading, no swap for user sectors)
IO_HSLV : 0x0 (Product working in the full voltage range, I/O speed optimization at low-voltage disabled)

Boot address Option Bytes:

BOOT_CM7_ADD0: 0x800 (0x8000000)
BOOT_CM7_ADD1: 0x1FF0 (0x1FF00000)
BOOT_CM4_ADD0: 0x810 (0x8100000)
BOOT_CM4_ADD1: 0x1000 (0x10000000)

PCROP Protection:

PROT_AREA_START1: 0x6 (0x8000600)
PROT_AREA_END1: 0x8 (0x80008FF)
DMEP1 : 0x1 (Flash Bank 1 PCROP zone is erased when RDP level regression (change from level 1 to 0) occurs)
PROT_AREA_START2: 0xFF (0x810FF00)
PROT_AREA_END2: 0x0 (0x81000FF)
DMEP2 : 0x1 (Flash Bank 2 PCROP zone is erased when RDP level regression (change from level 1 to 0) occurs)

DTCM RAM Protection:

ST_RAM_SIZE : 0x0 (2 KB)

Write Protection:

nWRP0 : 0x1 (Write protection not active on this sector)
nWRP1 : 0x1 (Write protection not active on this sector)
nWRP2 : 0x1 (Write protection not active on this sector)
nWRP3 : 0x1 (Write protection not active on this sector)
nWRP4 : 0x1 (Write protection not active on this sector)
nWRP5 : 0x1 (Write protection not active on this sector)
nWRP6 : 0x1 (Write protection not active on this sector)
nWRP7 : 0x1 (Write protection not active on this sector)
nWRP8 : 0x1 (Write protection not active on this sector)
nWRP9 : 0x1 (Write protection not active on this sector)
nWRP10 : 0x1 (Write protection not active on this sector)
nWRP11 : 0x1 (Write protection not active on this sector)
nWRP12 : 0x1 (Write protection not active on this sector)
nWRP13 : 0x1 (Write protection not active on this sector)
nWRP14 : 0x1 (Write protection not active on this sector)
nWRP15 : 0x1 (Write protection not active on this sector)

[Bubbles]

Hi @yolominwoo,

to remove the PCROP protection, you need to perform regression from RDP 1 to RDP0.

Program the RDP to 0xBB, then program the new (empty) PCROP along with 0xAA to RDP (both simultaneously). What you encountered is normal part of the PCROP protection, protecting the hidden code even in RDP0.

BR,

J