cancel
Showing results for 
Search instead for 
Did you mean: 

Is there a way to unlock STM32H563 if wrong obk file provisioned?

Konstantin_Z
Associate

Hello!
I a new in this.
I have two sets of DA files: for password access and for access via certificate.
I've tried to flash a NS-firmware, provision a password.obk, then change Product state to Provisioned/closed. 
Thas was successful. I can perform a regression from this state.
But i also tried to open a debug session. Without success. CubeProgrammer says, that I am able to make full regression only, while Cube IDE asks for certificate DA.
I know, that certificate auth method is valid with TZEN=1 only, but I tried to provision that obk with TZEN=0.

As a result, I Have this:

Screenshot 2025-09-17 174213.png

The default ST password from CubeProgrammer's folder is not working,

I tried to provide all-zeros and all-FF password without success.
But maybe I need to change something in the header. Or change a password length.

Konstantin_Z_0-1758116631152.png


So, 3 questions:
1. Is this device totally bricked, or I can some-how calculate a password.bin
2. How to perform debug in closed product state on STM32H563 if TZEN=0 ?
3. How to perform debug of the the secured firmware when TZEN=1

Can somebody clarify the boot/DA process when TZ=1.
As I can understand, If the TZEN=1, MCU boots from 0x0C000000. And If I want to have ability to perform a regression or debug, I need a code on this address, that can receive user credentials and open debug. Right?
Or this auth functionality is done with RSS from system memory, without touching flash?

Thanks!

0 REPLIES 0