NRF52 How to erase a protected firmware program (knowing the protected password)

Question

I'm trying to deploy a new firmware to my hardware device but I get the following error in the nrf Connect (v3.6.1) Programmer (v1.4.8):

• 16:47:36.937 Error when getting device info: Error: Error: Error occured when get device info. Errorcode: CouldNotCallFunction (0x9) Lowlevel error: NOT_AVAILABLE_BECAUSE_PROTECTION (ffffffa6)
• 16:47:36.937 Could not fetch memory size of target devkit: Cannot read property 'family' of undefined

I cannot read nor erase from the device through the programmer because of this error.

I assume this is because the device is password protected. I know this password, is there a way to erase the device's current firmware?

(I'm using the NRF52-DK to connect/program with it, and the pins are accessible, which is how I'm connecting and I know the chipset is a nrf52840) Wiring now is as followed:

So I'm currently not using the debug output to connect with the device

I've provided power to the custom device by batteries now, no change in the result.

Answer 1

It's unclear what you mean by a "device password" for the nRF52840.

NOT_AVAILABLE_BECAUSE_PROTECTION occurs when the APPROTECT register has been enabled. According to the nRF52840 product spec

Access port protection is disabled by issuing an ERASEALL command via CTRL-AP

Alternatively, if you are using pynrfjprog, the recover() method removes the protection.

No matter what, flash will always be erased when clearing APPROTECT (unless utilizing the APPROTECT power glitch, but that's another topic)

Answer 2

Using OpenOCD 0.11.0 (binaries available from https://github.com/xpack-dev-tools/openocd-xpack/releases/tag/v0.11.0-1/ )

The following commands will remove the chip protection and reprogram the chip (with the lp.hex program)

bin\openocd -f interface/cmsis-dap.cfg -f target/nrf52.cfg -c "telnet_port pipe;tcl_port disabled;gdb_port disabled;log_output 
reset init
nrf52_recover
flash write_image s132_nrf52_2.0.1_softdevice.hex
flash write_image lp.hex
reset

This works for all versions fo the chips including the later versions (build Gxx and later) which automatically re-apply chip protection on reset.

For those of you using Arduino, my Very Low Power BLE <20uA project automates this process in the Arduino sketch upload.

Also see https://devzone.nordicsemi.com/nordic/nordic-blog/b/blog/posts/working-with-the-nrf52-series-improved-approtect