Breaking copy protection in MCUs: then and now

Posted on Friday, June 24th, 2011 in Chips, encryption, how-to, security by the machinegeek

When you decide to copy protect the firmware on your MCU, how effective are efforts such as setting a lock bit or enabling chip erase modes?

Sergei P. Skorobogatov’s article provides an overview of the methods he’s tried against MCUs from various manufacturers. He outlines both invasive and non-invasive techniques such as chip depackaging, microprobing and fault generation.

This document is somewhat historical in nature, covering techniques developed between 1996-2000. Nevertheless it is regarded as one of the foundational works on this aspect of hardware hacking.

Sergei has updated this information with his PhD thesis from 2004.

This entry was posted on Friday, June 24th, 2011 at 4:00 pm and is filed under Chips, encryption, how-to, security. You can follow any responses to this entry through the RSS 2.0 feed. You can skip to the end and leave a response. Pinging is currently not allowed.

4 Responses to “Breaking copy protection in MCUs: then and now”

  1. J. Peterson says:

    There’s also a nice write-up by bunnie on how he hacks into a PIC18F using electrical tape, tweezers and a UV lamp.

  2. Hollie says:

    Never would have thunk I would find this so insdpinesable.

  3. mohammad says:

    i have ic micro with this number
    can you unlock or break for me
    i have: atmega8- atmega32- atmega64- atmega90can128-
    please send a email about subject
    my mail:

    hi my dears
    i have company in the iran
    i have some ic micro until is lock.
    can you unlock or break this ic for me
    my ic list:

    im going to go to china to shenzhen city for break my ic.
    how long do you need for break this ic.becuse i want take wisa for china.
    please help me about this subject.
    my mobile number: 00989133252783

  4. exerion says:

    Try to work hard, being inventive and don’t fuck the other’s work. Knowledge is not reached copying…

Leave a Reply

Notify me of followup comments via e-mail. You can also subscribe without commenting.

Recent Comments

  • KH: IMHO PCA9685 is not a really good part for this application. It's a PWM LED driver for goodness' sake. NXP _does_not_ mention servos in the...
  • KH: So it's a servo library designed by a software guy, or a library targeted at embedded newbies, or a learner bike. Given the design of...
  • Max: A thing I wish I knew getting into Arduino-controlled servos is that the typical "180 degrees" servos DO NOT move 180 degrees for the standard...
  • Max: I have certainly noticed certain suppliers (like Adafruit, Pololu) being... "western-facing" - which is another way to say their prices definitely aren't Eastern Europe compatible,...
  • Shawn: Hello