Hello,
I want to protect my Arduino Uno code and EEPROM memory from external reading, but I want to be able to upload new HEX files in the future, so what I am looking for is a write-only setting. In my research, I found that it only takes to set the lock bits correctly, but I am not sure how to do it.
Lockbit Byte: (7) -, (6) -, (5) BLB12, (4) BLB11, (3) BLB02, (2) BLB01, (1) LB2, (0) LB1.
If I set it to :11010110 (0xD6) will this do what I am expecting?


To my knowledge you need a programmer and program the 328P via ICSP (the 6-pin header) to set the lock bits. The programmer will also allow you to upload the hex files.
I saw some people saying it's easy to get locked out on our on chip, so we need to be careful when setting lock bits. What I didn't found is some explanation on how to exactly set it.
On the datasheet, we found that the SPM (Store Program Memory) and LPM (Load Program Memory) are or are not allowed accessing the bootloader or application section. Can I understand that as SPM=write and LPM=read?
Reading the datasheet again and thinking the way I said above, I would set BLB0 Mode as 4 (read Application section from Boot Loader section is not allowed) and BLB1 Mode as 4 (reading Boot Loader section from Application section is not allowed).
I am not sure if I am right the way I am thinking, and still very confusing about LB Mode. It says I can only disable further programing and verification of flash memory, there is no option to disable only reading flash memory.