Break IC, Recover MCU, Microcontroller Reverse Engineering

Posts Tagged ‘flash eeprom’

Read MCU Code out from embedded and secured flash memory and eeprom memory can help to recover the content from master microcontroller;

Another memory type used in all Microcontroller MCUs (mainly as a register file memory and operational memory) is SRAM. It is also used in secure microcontroller MCUs such as the Dallas DS5002FP and JAVA iButtons where the information should disappear quickly if atampering attempt is sensed. An SRAM memory cell consists of six transistors, four of which create a flip-flop while the other two are used for accessing the cell inside the array.

SRAM memory offers very good security protection, as the information from it can be easily erased by disconnecting the power supply if the alarm is triggered. Performing invasive or semi-invasive MCU Crack is very problematic because any attempt to extract microcontroller code surface would very likely destroy the data. For example, decapsulation requires very strong acids to be used which a

re conductive and cannot be used on a powered up chip. Even if chip atmega2561v attacker manages to access the die, the state of its transistors cannot be observed optically. Microprobing is difficult because the internal wires are buried under top metal bit-lines, ground and power supply wires. The only practical way to access the memory is from the rear side of the chip die, but this requires more expensive equipment and a highly skilled IC Attacker.

Meantime, there are some semi-invasive techniques that allow observation of the memory state, but require special laser scanning microscopes. At the same time non-invasive mcu attacks can be used to exploit any problems that might exist in the memory interface, as happened with the Dallas Semiconductor secure microcontrolle. 

Data remanence could cause some problems to SRAM security as well. At temperatures below 0˚C some samples of the SRAM chips retain information for hours. But, in general, SRAM memory offers a very good level of protection and low-temperature attacks can be avoided by placing temperature sensors into the secure module enclosure as in the IBM 4758 cryptoprocessor.