Break IC, Recover MCU, Microcontroller Reverse Engineering

Posts Tagged ‘read cpld chip embeded firmware’

Read CPLD Chip Microcontroller IC JED File out from CPLD chip memory, copy JED file to new CPLD chip which can provide the same functions as original one after reset the status of CPLD by Microcontroller unlock skill;

Read CPLD Chip Microcontroller IC JED File out from CPLD chip memory, copy JED file to new CPLD chip which can provide the same functions as original one after reset the status of CPLD by Microcontroller unlock skill

Our next experiment was done to the PIC16F84A microcontroller which has Flash program memory and EEPROM data memory. A similar test sequence was applied with the only difference that electrical erasing was used. A huge difference in the memory behaviour can be observed. The memory erase starts 65 µs after the ‘chip erase’ command was received and by 75 µs the memory is erased.

However, this time changes if the temperature or the supply voltage is changed. For example, if the chip is heated to 35°C the memory erase starts at 60 µs and is finished by 70 µs. The security fuse requires at least 125 µs to be erased giving at least five times excess for reliable memory erase. Reducing the power supply voltage increases the erase time for both the memory and the fuse erase, so that the ratio remains practically the same.

It should be mentioned that unless terminated by the hardware reset, the chip erase operation lasts for at least 1 ms. Both this fact and the fast erase time give an impression that EEPROM and Flash memories have fewer problems with data remanence and therefore should offer better security protection. We decided to investigate whether this is true or not.