From f478815cde1fe3f6455ac7473d9e8202a2314ca2 Mon Sep 17 00:00:00 2001
From: jhchun <jh.chun@medithings.co.kr>
Date: Tue, 14 Jul 2026 17:38:14 +0900
Subject: [PATCH] =?UTF-8?q?=EC=A0=84=EC=B2=B4=20=EC=82=AD=EC=A0=9C=20+=20A?=
 =?UTF-8?q?PPROTECT=20=EC=9E=A0=EA=B8=88=20=ED=94=8C=EB=9E=98=EC=8B=9C=20?=
 =?UTF-8?q?=EC=8A=A4=ED=81=AC=EB=A6=BD=ED=8A=B8=20=EC=B6=94=EA=B0=80(?=
 =?UTF-8?q?=EC=96=91=EC=82=B0=EC=9A=A9)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- chiperase + program + verify 후 nrfjprog --rbp ALL로 SWD 디버그 포트 잠금
- VS Code Run Task에 "Flash + Lock" 항목 추가(tasks.json)
- 해제: nrfjprog --recover
---
 .vscode/tasks.json              | 12 +++++++++++
 tools/flash_full_erase_lock.ps1 | 35 +++++++++++++++++++++++++++++++++
 2 files changed, 47 insertions(+)
 create mode 100644 tools/flash_full_erase_lock.ps1

diff --git a/.vscode/tasks.json b/.vscode/tasks.json
index 0c989f9..2d8a120 100644
--- a/.vscode/tasks.json
+++ b/.vscode/tasks.json
@@ -24,6 +24,18 @@
                 "${workspaceFolder}\\tools\\flash_preserve_settings.ps1"
             ],
             "problemMatcher": []
+        },
+        {
+            "label": "Flash + Lock (full erase + APPROTECT)",
+            "type": "shell",
+            "command": "powershell",
+            "args": [
+                "-ExecutionPolicy",
+                "Bypass",
+                "-File",
+                "${workspaceFolder}\\tools\\flash_full_erase_lock.ps1"
+            ],
+            "problemMatcher": []
         }
     ]
 }
diff --git a/tools/flash_full_erase_lock.ps1 b/tools/flash_full_erase_lock.ps1
new file mode 100644
index 0000000..ecd915c
--- /dev/null
+++ b/tools/flash_full_erase_lock.ps1
@@ -0,0 +1,35 @@
+param(
+    [string]$Hex = "build\merged.hex"
+)
+
+Set-StrictMode -Version Latest
+$ErrorActionPreference = "Stop"
+
+$RepoRoot = Split-Path -Parent $PSScriptRoot
+$HexPath = Join-Path $RepoRoot $Hex
+
+if (-not (Test-Path -LiteralPath $HexPath)) {
+    throw "Hex file not found: $HexPath. Build the project first."
+}
+
+Write-Host "[FLASH] FULL ERASE + APPROTECT LOCK mode (production)"
+Write-Host "[FLASH] This wipes application flash, NVS/settings, and BLE bonds."
+Write-Host "[FLASH] After locking, SWD debug read/write is disabled permanently."
+Write-Host "[FLASH] To unlock later you MUST run 'nrfjprog --recover', which mass-erases the chip."
+Write-Host "[FLASH] DFU(SMP) over BLE still works after locking."
+Write-Host "[FLASH] Programming: $HexPath"
+
+# 1) 전체 지우고 서명된 펌웨어 프로그램
+Write-Host "[FLASH] Step 1/3: chip erase + program + verify"
+nrfjprog --program $HexPath --chiperase --verify --reset
+
+# 2) UICR.APPROTECT 잠금 (SWD 디버그 포트 차단)
+Write-Host "[FLASH] Step 2/3: enabling APPROTECT (readback protection)"
+nrfjprog --rbp ALL
+
+# 3) APPROTECT는 파워사이클/핀리셋 후 실제 적용됨
+Write-Host "[FLASH] Step 3/3: pin reset to apply protection"
+nrfjprog --pinreset
+
+Write-Host "[FLASH] Done. POWER-CYCLE the device to fully latch APPROTECT."
+Write-Host "[FLASH] Verify lock: 'nrfjprog --memrd 0x0' should now FAIL."