How to read protect STM32 microcontrollers

Pretty much all that is needed to enable RDP (read protection) is to enable level 1 of the protection by writing values between 0xAA - 0xCC to a specific register.  

If you are using the STM32 HAL library you can check my integration as part of the function FlashAdapter_setReadProtection and function ActivateProtection.

	bool
	FlashAdapter_setReadProtection(bool enable) {
	bool success = false;
	#ifdef STM32H7xx
	FLASH_OBProgramInitTypeDef ob_sturct = {0};
	HAL_StatusTypeDef status = HAL_ERROR;
	HAL_FLASHEx_OBGetConfig(&ob_sturct);
	if (enable && ob_sturct.RDPLevel == OB_RDP_LEVEL_0) {
	ob_sturct.RDPLevel = OB_RDP_LEVEL_1;
	status = ActivateProtection(&ob_sturct, 0, 0);
	} else {
	ob_sturct.RDPLevel = OB_RDP_LEVEL_0;
	status = ActivateProtection(&ob_sturct, 0, 0);
	}
	if (status == HAL_OK) {
	success = true;
	}
	#endif //STM32H7xx
	return success;
	}

view raw FlashAdapter_setReadProtection.c hosted with ❤ by GitHub

	HAL_StatusTypeDef
	ActivateProtection(FLASH_OBProgramInitTypeDef* ob_sturct, uint32_t protect_address_start, uint32_t protect_address_end) {
	HAL_StatusTypeDef status = HAL_ERROR;
	#ifdef STM32H7xx
	/* Bank 1 */
	ob_sturct->Banks = FLASH_BANK_1;
	ob_sturct->PCROPConfig = OB_PCROP_RDP_ERASE;
	ob_sturct->PCROPStartAddr = protect_address_start;
	ob_sturct->PCROPEndAddr = protect_address_end;
	status = HAL_FLASH_Unlock();
	status |= HAL_FLASH_OB_Unlock();
	if (status == HAL_OK) {
	status = HAL_FLASHEx_OBProgram(ob_sturct);
	}
	if (status == HAL_OK) {
	status = HAL_FLASH_OB_Launch();
	}
	if (status == HAL_OK) {
	HAL_FLASH_OB_Lock();
	}
	#endif //STM32H7xx
	return status;
	}

view raw ActivateProtection.c hosted with ❤ by GitHub

After enabling RDP level 1 the whole flash will be read-protected. Once you decide to disable it the whole flash will be wiped out and no one will be able to read your binary.

This is now part of the IMBootlaoder code.
Once when you enable RDP protection all code is protected. The cool thing you can still update your firmware code by using the IMFlahser application, without disabling RDP. 

You can ignore PCROP (Proprietary code readout protection). It is a cool feature that SMT32 also has, but I'll cover this in some future posts.