Break IC, Recover MCU, Microcontroller Reverse Engineering

Archive for February, 2014

Reverse Engineering IC Embedded Memory need to experience a series of complicate process, and there are a lot of methods to reverse engineering IC embedded memory, and faulty injection technology can be used to analyze the IC, because this technology can help to locate the security fuse.

Although through this reverse engineering IC technology can’t locate the exact locations of security fuse, especially when using the flash light to inject the faulty, but it is no necessary to find out its exact locations, because security fuse can be shielded after the vulnerability point being found.

The facility is very similar to the laser scanning, the only different point is the facility is flash lamp instead of laser, de-capsulate the IC and places it on the test socket of electrical automatic platform.

Expose part of IC under the flash lamp, and then test the security fuse status, and then the location of photo-sensitivity can be found, in where the security fuse can be found too. Not only the security fuse, include all of the control circuit can be sensible to the faulty injection when reverse engineering IC embedded memory which could be more difficult to locate the security fuse.

But from the perspective, it has nothing to do about it, the security evaluation can be instructed by using the same procedures from the vulnerable IC point on the channel, if then each point on the surface of IC can be used to locate the security fuse and confirm if it can be shielded under the exposure of flash lamp within a short period of time.

Through the two time scanning on the PIC16F84 microcontroller IC from microchip, the result of comparison when reverse engineering IC can find the transistors embedded in the security fuse. Although the result can be obtained within a short period of time, but there is one point need to illustrate, it has smaller effect on the small features IC and modern microcontroller IC with multilayer top metal layers. One of the optional method is through backside laser scanning which need more precise and more expensive facilities since there are more noises in the Microcontroller reverse engineering.