Monday, February 11, 2008

Erik's Backdoor method ( P89C51RD2 )


The Philips P89C51Rx2 and P89C66x both have a modifiable “boot vector”.

This is a problem in the case where the bootvector (accidentially) get changed because changing the bootvector makes it impossible to do IAP (in application programming)


This article covers providing a back door for IAP when the boot vector is lost (I still consider it the only bad thing about these chips that the vector is not fixed)

NOTE:

nothing here will work after the fact, this MUST be done before you lose the bootvector.


The page numbers refer to AN461 2002 jun 24.


The NoTouch should still be included as described in my article for regular program maintenance; however, to be able to rescue the chip when a mistake in the just uploaded code does not allow the program to get to the NoTouch upload an emergency exit should be provided. This "emergency exit" also allow you to lose the boot vector and still provide ISP.

To provide this "emergency exit" include the following the very first time you boot, after that you can forget about bootvectors and the other stuff



where your program looks like


org 0



ljmp xxxyyy

...

xxxyyy:

change to



org 0



ljmp bootck





bootck:



jb P3.1,xxxyyy ;TxD always high without cliplead



mov AUXR1,#020h
;enable boot



!!insert parametres for set boot
vector as in AN 461 pg 14



call 0fff0h



!! insert parametres for set
status byte as in AN 461 pg 14



call 0fff0h



jmp $
;wait for reset





xxxyyy: as in your original code





Now when emergency strikes, just use a cliplead to hold TxD to ground, reset, remove the

cliplead, reset again and you are booting.



Of course, this only works if you have Vpp at +5 (where it should be as !EA anyhow) and P2.6, P2.7 allowed high.


My NoTouch document is available <a href="http://www.8052.com/users/erikm/notouch.doc">here</a>.





Powered by ScribeFire.

No comments: