Break IC, Recover MCU, Microcontroller Reverse Engineering

Archive for February, 2012

We can reverse engineering microchip mcu TS87C58X2 locked eeprom, please view the microchip mcu TS87C58X2 features for your reference:
The comparator output is read through CMCON0 register. This bit is read-only. The comparator output may also be used internally, see Figure 8-1.The comparator wake-up flag is set whenever all of the following conditions are met:
· CWU = 0 (CMCON0<0>)
· CMCON0 has been read to latch the last known state of the CMPOUT bit (MOVF CMCON0, W)
· Device is in Sleep
· The output of the comparator has changed state The wake-up flag may be cleared in locked eeprom or by another device Reset.
When the comparator is active and the device is placed in Sleep mode, the comparator remains active. While the comparator is powered-up, higher Sleep currents than shown in the power-down current specification will occur after Reverse Engineering Microchip MCU TS87C58X2 Locked Eeprom.
To minimize power consumption while in Sleep mode, turn off the comparator before entering Sleep. A Power-on Reset (POR) forces the CMCON0 register to its Reset state. This forces the Comparator module to be in the comparator Reset mode.
This ensures that all potential inputs are analog inputs. Device current is minimized when analog inputs are present at Reset time.
The comparator will be powered-down during the reset interval. A simplified circuit for an analog input is shown in Figure 8-3.
Since the analog pins are connected to a digital output, they have reverse biased diodes to VDD and VSS. The analog input therefore, must be between VSS and VDD.
If the input voltage deviates from this range by more than 0.6V in either direction, one of the diodes is forward biased and a latch-up may occur.
A maximum source impedance of 10 kÙ is recommended for the analog sources. Any external component connected to an analog input pin, such as a capacitor or a Zener diode, should have very little leakage current if Reverse Engineering Microchip MCU TS87C58X2 Locked Eeprom.

We can duplicate avr microprocessor ATMEGA8PA protected firmware, please view the avr microprocessor ATMEGA8PA features for your reference:

The ATMEGA8PA devices are offered with Internal Oscillator mode only when duplicate avr microprocessor ATMEGA8PA.
· INTOSC: Internal 4 MHz Oscillator
The internal oscillator provides a 4 MHz (nominal) system clock (see Section 12.0 “Electrical Characteristics” for information on variation over voltage and temperature).
In addition, a calibration instruction is programmed into the last address of memory, which contains the calibration value for the internal oscillator.
This location is always uncode protected, regardless of the code-protect settings. This value is programmed as a MOVLW xx instruction where xx is the calibration value and is placed at the Reset vector if Duplicate AVR Microprocessor ATmega8PA Protected Firmware.
This will load the W register with the calibration value upon Reset and the PC will then roll over to the users program at address 0x000.
The user then has the option of writing the value to the OSCCAL Register (05h) or ignoring it. OSCCAL, when written to with the calibration value, will “trim” the internal oscillator to remove process variation from the oscillator frequency.
The device differentiates between various kinds of Reset:
· Power-on Reset (POR)
· MCLR Reset during normal operation
· MCLR Reset during Sleep
· WDT time-out Reset during normal operation
· WDT time-out Reset during Sleep
Wake-up from Sleep on pin change
Wake-up from Sleep on comparator change if Duplicate AVR Microprocessor ATmega8PA Protected Firmware
Some registers are not reset in any way, they are unknown on POR and unchanged in any other Reset.
Most other registers are reset to “Reset state” on Power-on Reset (POR), MCLR, WDT or Wake-up on pin change Reset during normal operation. They are not affected by a WDT Reset during Sleep or MCLR Reset during Sleep, since these Resets are viewed as resumption of normal operation.
The exceptions to this are TO, PD, GPWUF and CWUF bits. They are set or cleared differently in different Reset situations. These bits are used in software to determine the nature of Reset.
See Table 9-1 for a full description of Reset states of all registers if BREAK IC.

We can read atmel IC ATMEGA16A locked code, please view the atmel IC ATMEGA16A features for your reference:
The atmel IC ATMEGA16A devices incorporate an on-chip Power-on Reset (POR) circuitry, which provides an internal chip Reset for most power-up situations.
The on-chip POR circuit holds the chip in Reset until VDD has reached a high enough level for proper operation. To take advantage of the internal POR, program the GP3/MCLR/VPP pin as MCLR and tie through a resistor to VDD, or program the pin as GP3.
An internal weak pull-up resistor is implemented using a transistor (refer to Table 12-2 for the pull-up resistor ranges). This will eliminate external RC components usually needed to create a Power-on Reset. A maximum rise time for VDD is specified.
See Section 12.0 “Electrical Characteristics” for details. When the devices start normal operation (exit the Reset condition), device operating parameters (voltage, frequency, temperature,…) must be met to ensure operation after Read Atmel IC ATmega16A Locked Code.
If these conditions are not met, the devices must be held in Reset until the operating parameters are met. A simplified block diagram of the on-chip Power-on Reset circuit. The Power-on Reset circuit and the Device Reset Timer (see Section 9.5 “Device Reset Timer (DRT)”) circuit are closely related. On power-up, the Reset latch is set and the DRT is reset. The DRT timer begins counting once it detects MCLR to be high.
After the time-out period, which is typically 18 ms, it will reset the Reset latch and thus end the on-chip Reset signal. A power-up example where MCLR is held low is shown in Figure 9-3. VDD is allowed to rise and stabilize before bringing MCLR high.
The chip will actually come out of Reset TDRT msec after MCLR goes high. In Figure 9-4, the on-chip Power-on Reset feature is being used (MCLR and VDD are tied together or the pin is programmed to be GP3) when Read Atmel IC ATmega16A Locked Code.
The VDD is stable before the Start-up Timer times out and there is no problem in getting a proper Reset. However, Figure 9-5 depicts a problem situation where VDD rises too slowly. The time between when the DRT senses that MCLR is high and when MCLR and VDD actually reach their full value, is too long. In this situation, when the Start-up Timer times out, VDD has not reached the VDD (min) value and the chip may not function correctly. For such situations, we recommend that external RC circuits be used to achieve longer POR delay times if RECOVER MCU.

We can extract atmel microprocessor ATMEGA16PA firmware, please view the atmel microprocessor ATMEGA16PA features for your reference:
The TO, PD, GPWUF and CWUF bits in the STATUS register can be tested to determine if a Reset condition has been caused by a power-up condition, a MCLR, Watchdog Timer (WDT) Reset, wake-up on comparator change or wake-up on pin change.
A Brown-out Reset is a condition where device power (VDD) dips below its minimum value, but not to zero, and then recovers. The device should be reset in the event of a brown-out when extract atmel microprocessor.
To reset ATmega16pa devices when a Brown-out Reset occurs, external brown-out protection circuits may be built if Extract Atmel Microprocessor ATmega16PA Firmware.
A device may be powered down (Sleep) and later powered up (wake-up from Sleep). The Power-Down mode is entered by executing a SLEEP instruction.

If enabled, the Watchdog Timer will be cleared but keeps running, the TO bit (STATUS<4>) is set, the PD bit (STATUS<3>) is cleared and the oscillator driver is turned off after extract atmel microprocessor.
The I/O ports maintain the status they had before the SLEEP instruction was executed (driving high, driving low or high-impedance).

For lowest current consumption while powered down, the T0CKI input should be at VDD or VSS and the GP3/ MCLR/VPP pin must be at a logic high level if MCLR is enabled.
The device can wake-up from Sleep through one of the following events:
An external Reset input on GP3/MCLR/VPP pin, when configured as MCLR.
A Watchdog Timer time-out Reset (if WDT was enabled).
A change on input pin GP0, GP1 or GP3 when wake-up on change is enabled.

A comparator output change has occurred when wake-up on comparator change is enabled when Extract Atmel Microprocessor ATmega16PA Firmware.

These events cause a device Reset. The TO, PD GPWUF and CWUF bits can be used to determine the cause of device Reset. The TO bit is cleared if a WDT time-out occurred (and caused wake-up) if extract atmel microprocessor.
The PD bit, which is set on power-up, is cleared when SLEEP is invoked. The GPWUF bit indicates a change in state while in Sleep at pins GP0, GP1 or GP3 (since the last file or bit operation on GP port) after EXTRACT IC.

The CWUF bit indicates a change in the state while in Sleep of the comparator output.