From 36c8958e03a9e670ad1628344736158dabe3ab89 Mon Sep 17 00:00:00 2001
From: jhchun <jh.chun@medithings.co.kr>
Date: Tue, 14 Jul 2026 17:41:43 +0900
Subject: [PATCH] =?UTF-8?q?=EB=B9=8C=EB=93=9C=20=ED=8F=AC=ED=95=A8=20?=
 =?UTF-8?q?=EC=A0=84=EC=B2=B4=20=EC=82=AD=EC=A0=9C=20+=20APPROTECT=20?=
 =?UTF-8?q?=EC=9E=A0=EA=B8=88=20=EB=B0=B0=EC=B9=98=20=ED=8C=8C=EC=9D=BC=20?=
 =?UTF-8?q?=EC=83=9D=EC=84=B1(=EC=96=91=EC=82=B0=EC=9A=A9)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- 배치 내부에서 cmake --build로 merged.hex 갱신
- chiperase + program + verify 후 nrfjprog --rbp ALL로 SWD 디버그 포트 잠금
---
 tools/build_flash_erase_lock.bat | 61 ++++++++++++++++++++++++++++++++
 1 file changed, 61 insertions(+)
 create mode 100644 tools/build_flash_erase_lock.bat

diff --git a/tools/build_flash_erase_lock.bat b/tools/build_flash_erase_lock.bat
new file mode 100644
index 0000000..0019148
--- /dev/null
+++ b/tools/build_flash_erase_lock.bat
@@ -0,0 +1,61 @@
+@echo off
+setlocal enabledelayedexpansion
+
+REM ==============================================================
+REM  Build + Flash + APPROTECT lock  (PRODUCTION ONLY)
+REM  - Rebuilds so build\merged.hex is up to date, then flashes.
+REM  - Do NOT run on development boards (locking needs --recover).
+REM ==============================================================
+
+set "REPO=%~dp0.."
+set "BUILDDIR=%REPO%\build"
+set "HEX=%BUILDDIR%\merged.hex"
+
+REM cmake from the nRF Connect toolchain, fallback to PATH
+set "CMAKE=C:\ncs\toolchains\fd21892d0f\opt\bin\cmake.exe"
+if not exist "%CMAKE%" set "CMAKE=cmake"
+
+echo [FLASH] FULL ERASE + APPROTECT LOCK mode (production)
+echo [FLASH] This wipes application flash, NVS/settings, and BLE bonds.
+echo [FLASH] After locking, SWD debug read/write is disabled.
+echo [FLASH] To unlock later: nrfjprog --recover (mass-erases the chip).
+echo [FLASH] DFU(SMP) over BLE still works after locking.
+echo.
+
+REM --- Step 1: build (updates merged.hex) ---
+echo [FLASH] Step 1/4: build (update merged.hex)
+"%CMAKE%" --build "%BUILDDIR%"
+if errorlevel 1 (
+    echo [FLASH] Build FAILED. Aborting.
+    exit /b 1
+)
+
+if not exist "%HEX%" (
+    echo [FLASH] merged.hex not found: %HEX%
+    echo [FLASH] Build the project first.
+    exit /b 1
+)
+echo [FLASH] Using: %HEX%
+echo.
+
+REM --- Step 2: chip erase + program + verify ---
+echo [FLASH] Step 2/4: chip erase + program + verify
+nrfjprog --program "%HEX%" --chiperase --verify --reset
+if errorlevel 1 (
+    echo [FLASH] Program FAILED. Aborting before lock.
+    exit /b 1
+)
+
+REM --- Step 3: enable APPROTECT ---
+echo [FLASH] Step 3/4: enabling APPROTECT (readback protection)
+nrfjprog --rbp ALL
+
+REM --- Step 4: pin reset to apply protection ---
+echo [FLASH] Step 4/4: pin reset
+nrfjprog --pinreset
+
+echo.
+echo [FLASH] Done. POWER-CYCLE the device to fully latch APPROTECT.
+echo [FLASH] Verify lock: nrfjprog --memrd 0x0  should now FAIL.
+endlocal
+pause