Break IC, Recover MCU, Microcontroller Reverse Engineering

Posts Tagged ‘chip breaking embedded firmware’

We can Break Chip PIC12HV609 Binary, please view the Chip PIC12HV609 features for your reference:

The PIC12F609/615/617/12HV609/615 has a 13-bit program counter capable of addressing an 8K x 14 program memory space. Only the first 1K x 14 (0000h-03FFh) for the PIC12F609/615/12HV609/615 is physically implemented. For the PIC12F617, the first 2K x 14 (0000h-07FFh) is physically implemented.

Accessing a location above these boundaries will cause a wrap-around within the first 1K x 14 space for PIC12F609/615/12HV609/615 devices, and within the first 2K x 14 space for the PIC12F617 device. The Reset vector is at 0000h and the interrupt vector is at 0004h (see Figure 2-1). The data memory (see Figure 2-3) is partitioned into two banks, which contain the General Purpose Registers (GPR) and the Special Function Registers (SFR).

Special Function Registers are located in the first 32 locations of each bank. Register locations 40h-7Fh in Bank 0 are General Purpose Registers, implemented as static RAM. For the PIC12F617, the register locations 20h-7Fh in Bank 0 and

A0h-EFh in Bank 1 are general purpose registers implemented as Static RAM. Register locations F0h-FFh in Bank 1 point to addresses 70h-7Fh if Break Chip

On-chip Program Memory in Bank 0. All other RAM is unimplemented and returns ‘0’ when read. The RP0 bit of the STATUS register is the bank select bit. The register file is organized as 64 x 8 in the PIC12F609/615/12HV609/615, and as 128 x 8 in the PIC12F617. Each register is accessed, either directly or indirectly, through the File Select Register (FSR) (see Section 2.4 “Indirect Addressing, INDF and FSR Registers”).

The Special Function Registers are registers used by the CPU and peripheral functions for controlling the desired operation of the device (see Table 2-1). These registers are static RAM. The special registers can be classified into two sets: core and peripheral. The Special Function Registers associated with the “core” are described in this section when Break IC.

Those related to the operation of the peripheral features are described in the section of that peripheral feature. The STATUS register, shown in Register 2-1, contains:

· the arithmetic status of the ALU

· the Reset status

· the bank select bits for data memory (RAM)

The STATUS register can be the destination for any instruction, like any other register. If the STATUS register is the destination for an instruction that affects the Z, DC or C bits, then the write to these three bits is disabled. These bits are set or cleared according to the device logic.

Furthermore, the TO and PD bits are not writable. Therefore, the result of an instruction with the STATUS register as destination may be different than intended.

For example, CLRF STATUS, will clear the upper three bits and set the Z bit. This leaves the STATUS register as ‘000u u1uu’ (where u = unchanged).