You are right.
This is only the case on the Atmel parts, because the lock bits can only be erased or programmed with a parallel programmer.
There are additional lock bits only for code protection on programming over the bootloader.




This is not right on the Atmels.
On the atmels there are 3 registers (BLJB, BSB, SBV) to decide, if the execution starts at the bootloader (0xFC00), at 0x0000 or at the address, pointed by SBV (Software Boot Vector).

But if the hardware condition was meet, always the bootloader at 0xFC00 was started, fully independend of the values on BLJB, BSB and SBV.


Philips P89C668 data sheet:

"If the factory default setting for the Boot Vector (0FCH) is changed, it will no longer point to the ISP masked-ROM boot loader code. If this happens, the only possible way to change the contents of the Boot Vector is through the parallel programming method, provided that the end user application does not contain a customized loader"

If there exist another undocumented way, I would name it a security leak on the philips parts.

Please can you tell us, if your solution was only an assumption or if you have tested it successfully and on which parts.


Peter