David wrote:
> Many of my applications run solely from 3V supply. Some circuits are 
> very simple and most of the work has gone into the code development.
>
> I would like to provide a level of protection to each application to at 
> least prevent someone directly reading the code via ICSP and then 
> programming their own copy of my unit.
>
> First I was considering placing a code in the serial number part of each 
> micro controller and have my code read and validate the correct code 
> before running the application. (Have not tried it yet).
>
> For the 5V supply projects I could easily just set all the code 
> protection bits and if I needed to reprogram the device I just did a 
> bulk erase and reprogrammed it.
> The problem is that the bulk erase requires 4.5V.
>
> Can I partially protect the code that would prevent all the code being 
> read but still enable me to reprogram the chip if I needed to.
>
>   
You didn't say which chip.

The answer is to go ahead and install raw firmware (with security bit 
set) BEFORE the chip is
installed, NOT via ICSP. Then install new firmware after this through 
the serial port, using a
"bootloader" program. You CAN replace most of the internal firmware 
WITHOUT allowing
someone to see it  at all, but this is not available on all devices. You 
can self-program (erase and
install new firmware) at 3V all day long on some devices, and an 
external programmer cannot read
the data at all. No real need for an ICSP connection at all.

To further make things harder for a potential hacker, you can encrypt 
the data being loaded from
the bootloader; to do this, you might need to write your own bootloader 
rather than use someone's
published design (bootloaders are trivial to write, don't worry). 
Usually, this means that the bits are
sent out of order, or a table of values is added to each word, giving 
each word 65K chances to be
something else entirely. You can also install new firmware into the 
device in a random order, not from
start to end; that makes it inordinately hard to hack when intercepting 
the bootloader string.

The scheme of installing a secret code and reading the firmware  to see 
if it matches is a good idea,
but you must be very careful to  flash  then verify each word  as the 
firmware is changed; sometimes
a word gets corrupted then everything grinds to a halt from which 
recovery is not possible.

Having said all this, you must know that Microchip's security scheme is 
not foolproof, and there are
people that, for a fee, can extract the firmware. But it is destructive 
and usually requires several devices
to be  certain of recovery. In my opinion, unless you are hacking a 
military device, it is not worth the
effort, so most designs are quite secure.

--Bob
-- 
http://www.piclist.com PIC/SX FAQ & list archive
View/change your membership options at
http://mailman.mit.edu/mailman/listinfo/piclist