Write verification operation failed flash memory Adesto AT45DB641E

[MazingerZ]

For STM32xx can use ST-LINK programmer from ST to communicate with it, but probably uC will be read protected.

I have said STLINK V3-SET programmer, I use it with Ubuntu through commands, I managed to get to connect to the microcontroller, but from there, I don't know the commands to use to read it. Although for now this is not what I think that brings us to the case of the Adesto AT45DB641E flash memory.

You need to read security register on both original chips to check if there is additional information stored in OTP area user bytes and if there are differences between these 2 devices. You can read it with custom script tool: viewtopic.php?f=32&t=280
I can help you prepare proper scripts - if you will need such help please let me know.

I don't know how to use that script tool, if necessary I will ask you for help, thank you very much for offering to help me ArT.
What I will try first is to have the reading of both flash memories (the normal one and the blocked one) and verify the differences of bytes, until next Monday I cannot do it.
If I have good results, I'll let you know. I forgot to tell you that in addition to the serial number, there are 2 checksum digits for that serial number, so when I can read both flash drives and see the differences, I'll try to find the checksum.
In case of not being able to have good results, we try to check if there is additional information stored in the user bytes of the OTP area (in that aspect I have no idea how to do it).

I'll report to you next week as soon as I can have new tests.

All the best

Sorry my english, I use translator

[ArT]

For ST-LINK there is windows application with easy GUI interface, it's called STM32 ST-LINK Utility

Please confirm me results of 2 easy tests to confirm that issue is with s/n or in information stored in OTP registers:
1. when you read working flash, erase it, and write back (without modification) to the same flash - does it work?
2. write it back to factory new AT45 - does it work?

Goodluck and keep in touch!

[MazingerZ]

For ST-LINK there is windows application with easy GUI interface, it's called STM32 ST-LINK Utility

Please confirm me results of 2 easy tests to confirm that issue is with s/n or in information stored in OTP registers:
1. when you read working flash, erase it, and write back (without modification) to the same flash - does it work?
2. write it back to factory new AT45 - does it work?

Goodluck and keep in touch!

Hello ArT,

Sorry for the delay in answering, in both cases of which you comment the alarm performs the boot correctly.

In addition, I have made a reset of the alarm system to leave it in factory securities, I have read the flash memory, I have changed the Locking parameters by Hexadecimal FF (Delete), I have written it in the flash memory and the alarm performs the boot correctly.

But, if I do not perform the reset of the alarm system to leave it in factory securities, I have read the flash memory, I have changed the blocking parameters by hexadecimal data FF (erased), I have written it in the flash memory and the alarm does not perform startup.

Can there be hidden records?

thank you

[ArT]

Seems like alarm's locking parameters are backed up also to different place in memory after configuration. If you reset it to factory, erase lockig parameters and it's working then it's not using any OTP registers of memory (because OTP registers once programmed can not be erased or overwritten). It's probably also not using ID of memory becuase in such case swapping flash will not work. So in my opinion it's stored only in FLASH area but it has be backup (maybe encoded) in different place.

You can read security register in both cases and see if there are any differences for the same device:

Code: Select all

#SCRIPT HEADER;
SCRIPT:v1.8.5;
#HARDWARE SETTINGS;
HW:SPI-AT,3.3V,SLOW;

// Read Security Register (64bytes OTP + 64bytes Adesto SN) for AT45DBxx chips
#OPERATION;
SW:0,0,1,127,5,5,10,0,100,500;
INSTR:77,A5,A5,A5;


[MazingerZ]

Seems like alarm's locking parameters are backed up also to different place in memory after configuration. If you reset it to factory, erase lockig parameters and it's working then it's not using any OTP registers of memory (because OTP registers once programmed can not be erased or overwritten). It's probably also not using ID of memory becuase in such case swapping flash will not work. So in my opinion it's stored only in FLASH area but it has be backup (maybe encoded) in different place.

You can read security register in both cases and see if there are any differences for the same device:

Code: Select all

#SCRIPT HEADER;
SCRIPT:v1.8.5;
#HARDWARE SETTINGS;
HW:SPI-AT,3.3V,SLOW;

// Read Security Register (64bytes OTP + 64bytes Adesto SN) for AT45DBxx chips
#OPERATION;
SW:0,0,1,127,5,5,10,0,100,500;
INSTR:77,A5,A5,A5;


Hi Art,
First of all, if I use a different flash memory to program it, that is, read the flash memory of the alarm system, and then program the data in another flash memory, the alarm does not boot.

When I run the script:
#SCRIPTHEADER;
SCRIPT:v1.8.5;
#HARDWARESETTINGS;
HW:I2C,3.3V,SLOW;
// Add operations (please use script maker)
// Read Security Register (64bytes OTP + 64bytes Adesto SN) for AT45DBxx chips
#OPERATION;
SW:0,0,1,127,5,5,10,0,100,500;
INSTR:77,A5,A5,A5;

I get the following error log:
19:07.640: Executing script started.
19:07.683: Setting hardware (I2C 3.3V SLOW)...success
19:07.854: Executing operation 1/1...fail
4 bytes instr , 128 bytes read , 0 bytes write
BOD 5ms, DAI 5ms, DAW 10ms, DAO 0ms
BSYO 100 ms , TOUT 500 ms
INSTR: 77 A5 A5 A5
DATA: NULL
19:08.359: Script execution cancelled.
19:08.380: PC TIMEOUT

and a popup: "Timeout error (operation1/1)"

[MazingerZ]

I have managed to execute the script, look at the data that appears.

[ArT]

Ok so we can see that there is no additional data stored in OTP (first 64 bytes which may be programmed by user are empty). The remaining 64 bytes of the register are factory programmed by Adesto and will contain a unique value for each device. The factory
programmed data is fixed and cannot be changed.

You can check if this S/N (or part of it) is used somewhere in FLASH in working device (maybe it copies the value after first initialization run). Definitely your alarm system has some kind of clonning protection and now you need to guess how it's implemented and this is not easy task..

[MazingerZ]

Ok so we can see that there is no additional data stored in OTP (first 64 bytes which may be programmed by user are empty). The remaining 64 bytes of the register are factory programmed by Adesto and will contain a unique value for each device. The factory
programmed data is fixed and cannot be changed.

You can check if this S/N (or part of it) is used somewhere in FLASH in working device (maybe it copies the value after first initialization run). Definitely your alarm system has some kind of clonning protection and now you need to guess how it's implemented and this is not easy task..

Hi Art,
I enclose an image where you can see the blocked data, all the changes by FF hexadecimal value, with which I can delete them, write the flash memory and the alarm starts correctly, canceling the block. The s/n is right there, but it does not coincide with the reading using the script that we have carried out.
I have read with the script to another flash memory of another alarm (attached image), and the values change, I have also tried to write them but it cannot be modified as you comment.
My goal is to be able to read a flash drive, perform the unlock, and be able to write to a new flash drive.

[MazingerZ]

From what I read in Adesto AT45DBxxx series datasheet, the security log can only be written once, so how could I write all the data and also the security log? I don't know if what I'm saying would be the solution.

[MazingerZ]

I have found the commands.

#SCRIPTHEADER;
SCRIPT:v1.8.1;
#HARDWARESETTINGS;
HW:SPI-AT,3.3V,SLOW;

// Write Security Register (64bytes OTP) for AT45DBxx chips
// PLEASE NOTE! It's one time programmable register (OTP)
// when once programmed - it can not be changed!
// please fill 64 bytes of DATA below carefully!
#OPERATION;
SW:1,63,0,0,100,0,100,0,100,500;
INSTR:9B,00,00,00;
DATA:00,01,02,03,04,05,06,07,08,09,0A,0B,0C,0D,0E,0F,10,11,12,13,14,15,16,17, 18,19,1A,1B,1C,1D,1E,1F,20,21,22,23,24,25,26,27,28,29,2A,2B,2C,2D,2E,2F,30, 31,32,33,34,35,36,37,38,39,3A,3B,3C,3D,3E,3F;

// Read Security Register (64bytes OTP + 64bytes Adesto SN) for AT45DBxx chips
#OPERATION;
SW:0,0,1,127,100,0,0,0,100,500;
INSTR:77,A5,A5,A5;

Where "DATA" is the data to be modified in the OTP register of the flash memory.
Are the data to be modified those that go from address 00000040 to 00000070?
Attached image.