Read DSP Chip Program out from program memory and data memory, disable the tamper protection mechanism over the DSP chip by Microcontroller cracking technique, and copy the firmware to new DSP Chip;

Read DSP Chip Program out from program memory and data memory, disable the tamper protection mechanism over the DSP chip by Microcontroller cracking technique, and copy the firmware to new DSP Chip;

To achieve the result another trick was used in addition to the power glitch. The threshold voltage of all the floating gate transistors inside the memory array was shifted temporarily by VW = 0.6–0.9 V, so that VTH = K VDD − VW. As a result it became possible to measure the threshold voltage of an erased cell which is close to 0 V. This was achieved by precisely controlling the memory erase operation, thus allowing the substrate and control gates to be precharged and terminating the process before the tunnelling is started.

As a result, the excess charge is trapped in the substrate below the floating gate, and shifts the threshold of the transistor. The process of recombination of the trapped excess charge could take up to one second, which is enough to read the whole memory from the device. This can be repeated for different supply voltages combined with power glitches, in order to estimate the threshold of all the transistors in the memory array.

Comments are closed.