Two MinIMU-9 v2 with LPCxpresso, or Arduino Uno/Mega

From what i gather the AES key is loaded into the chip. And also there may be a CR232 check on the firmware as well or OTP fuses set

source

Supports un-secure boot from UART and USB (DFU class) interfaces during development. Once the AES key is programmed in the OTP, only secure boot is allowed through UART and USB.

This doesn't mean it cant be hacked, if you put the time into it. I would check to see if the JTAG pins have been disabled and start from there.

some interesting statements from the user guide

7.1 Production line use case At the NXP production line the OTP will be tested and programmed using JTAG. In test mode, the fuse block itself will be accessed directly. During programming the VPP will need a higher voltage than in the application use case. Written data is checked afterwards by reading out the fuses (using a low voltage on VPP) The customer will also program the OTP only at the production line, here DFU programming will be used. An image for programming customer-selected bits can be loaded into the device via USB.

7.2 Application use case nitially it is important to make sure that the data_15 register is updated early during the initialization (by boot-code) this will set the security level. Four levels of security are implemented in the design:

• Level 0: nothing is protected.

• Level 1: password protected. In this level, JTAG can be enabled by software after password sequence (depends on customer application) by setting the sticky bit 'JTAG_EN' in OTP_con register.

• Level 2: In this level, JTAG access can be enabled using special test equipment. Used by NXP for Returned Material Analysis only.

• Level 3: JTAG is completely disabled and hence the chip is virtually locked.

The customer can program the security level of the chip. For level 1, fuse-bit 509 should be set. For level 2, fuse-bits 509 and 510 are set. For level 3, fuse-bits 509, 510 and 511 are programmed. A special case will be for the customer to disable writing to the fuses, but since in application a low voltage (for reading) will be connected to the VPP, writing will not be possible anyway. During normal application, the fuses will already have been programmed on the production line. So three options remain: copying the fuse data into the data registers, reading this data, and setting the read protection. The boot code will copy the fuse data into the data registers because this is needed for security and DRM. After this, the data can be read from the data registers via the APB0 bus (according to the read protection settings).

Edit: If the key is truly loaded, you will only be able to load custom firmware if you have the key.

The LPC11C24 requires an additional 5V supply to operate the on-chip CAN transceiver. When powering the LPCXpresso board through the USB debug port only, the transceiver does not receive the full 5V. The +5VIN pin only reads 1.3V, so the transceiver does not operate correctly. I have found 2 ways to resolve this:

1. Use an external 5V regulated supply, connected through the +5VIN pin.
2. Connect the LPCXpresso to the Embedded Artists LPCXpresso Base Board.

The Base Board requires that the +5V is supplied through the USB-to-UART main power source port in addition to the debug port.