Secured MCU Breaker Experts!

Archive for the ‘Break IC’ Category

Some of the old and out of date devices need to be repaired while the head of the device: Microcontroller has burned out and unable to be used anymore, at this time engineer need to get microcontroller replaced so Retrieve Nuvoton Microcontroller W77E54 Program become a necessary step to proceed with, today we would like to introduce how the W77E54 is working, start from the general introduction and main features:

The W77E54 is an 8-bit microcontroller which can accommodate a wider frequency range with low power consumption. The instruction set for the W77E54 is fully compatible with the standard 8051. The W77E54 contains an 4K bytes Flash EPROM; a 128 bytes RAM; four 8-bit bi-directional and bit-addressable I/O ports; an additional 4-bit I/O port P4; two 16-bit timer/counters when Retrieve Nuvoton Microcontroller W77E54 Program; a hardware watchdog timer and a serial port. These peripherals are supported by seven sources two-level interrupt capability. To facilitate programming and verification, the Flash EPROM inside the W77E54 allows the program memory to be programmed and read electronically. Once the code is confirmed, the user can protect the code for security.

The W77E54 microcontroller has two power reduction modes, idle mode and power-down mode, both of which are software selectable. The idle mode turns off the processor clock but allows for continued peripheral operation. The power-down mode stops the crystal oscillator for minimum power consumption. The external clock can be stopped at any time and in any state without affecting the processor after Retrieve Nuvoton Microcontroller W77E54 Program.

Break Locked MCU W77E51 Eeprom Memory and extract its heximal out from it is a commonly requirement especially for those repairing companies with some obselete devices which use microcontroller W77E51, hereby we would like to introduce the composition of W77E51 on chip ROM:

The W77E51 has several modes to program the on-chip Flash EPROM. All these operations are configured by the pins RST, ALE, PSEN , A9CTRL(P3.0), A13CTRL(P3.1), A14CTRL(P3.2), OECTRL(P3.3), CE (P3.6), OE (P3.7), A0(P1.0) and VPP( EA ). Moreover, the A15A0(P2.7P2.0, P1.7P1.0) and the D7D0(P0.7P0.0) serve as the address and data bus respectively for these operations.

Read Operation
This operation is supported for customer to read their code and the Security bits. The data will not be valid if the Lock bit is programmed to low when Break Locked MCU W77E51 Eeprom Memory.

Output Disable Condition
When the OE is set to high, no data output appears on the D7..D0.

Program Operation
This operation is used to program the data to ROM and the security bits. Program operation is done when the VPP is reach to VCP (12.5V) level, CE set to low, and OE set to high.

Program Verify Operation
All the programming data must be checked after program operations. This operation should be performed after each byte is programmed; it will ensure a substantial program margin.

Erase Operation
An erase operation is the only way to change data from 0 to 1. This operation will erase all the ROM cells and the security bits from 0 to 1. This erase operation is done when the VPP is reach to VEP level, CE set to low, and OE set to high after Break Locked MCU W77E51 Eeprom Memory.

Erase Verify Operation
After an erase operation, all of the bytes in the chip must be verified to check whether they have been successfully erased to 1 or not. The erase verify operation automatically ensures a substantial erase margin. This operation will be done after the erase operation if VPP = VEP (14.5V), CE is high and  OE is low if BREAK IC.

When we try to Break WINBOND MCU W78E516 Eeprom Memory, there is an issue which is unable to avoid which is called EMI emission, and engineer need to figure out the way to reduce this Electro-magnetic emission interference. below we are going to introduce the cause of this interference and the way to reduce it:

Because of on-chip Flash EPROM, when a program is running in internal ROM space, the ALE will be unused. The transition of ALE will cause noise, so it can be turned off to reduce the EMI emission if it is useless. Turning off the ALE signal transition only requires setting the bit 0 of the AUXR SFR, which is located at 08Eh.

When ALE is turned off, it will be reactivated when the program accesses external ROM/RAM data or jumps to execute an external ROM code. The ALE signal will turn off again after it has been completely accessed or the program returns to internal ROM code space. The AO bit in the AUXR register, when set, disables the ALE output.

In order to reduce EMI emission from oscillation circuitry, W78E51B allows user to diminish the gain of on-chip oscillator amplifiers by using programmer to clear the B7 bit of security register. Once B7 is set to 0, a half of gain will be decreased after Break WINBOND MCU W78E516 Eeprom Memory.

Care must be taken if user attempts to diminish the gain of oscillator amplifier, reducing a half of gain may effect to external crystal operating improperly at high frequency above 24 MHz. The value of R and C1, C2 may need adjustment while running at lower gain before BREAK IC.

Clock-signal glitches are currently the simplest and most practical ones. In real application glitches are normally used to replace conditional jump instructions and test instructions preceding them. They create a window of vulnerability in the processing stages of many security cryptographic barriers by simply preventing the execution of the code that detects an unsuccessful authentication attempt. Instruction glitches can also be used to extend the runtime of loops, for example, in serial port output routines to see more of the memory after the output buffer, or to reduce the number of loops in cryptographic operation to transform the cipher into a weak one.

To perform a glitch, the clock frequency should be temporarily increased for one or more half cycles so that some flip-flops sample their input before the new state has reached them. As clock glitches are normally aimed at CPU instruction flow, they are not very effective for devices with hardware implementations of security protection. Therefore it is practical to use clock glitches only when attacking microcontrollers with software programming interfaces or some smartcards.

We can break atmel avr mcu ATMEGA8535L heximal, please view the atmel avr mcu ATMEGA8535L features for your reference:
The ATmega8535 provides all the features of the ATmega8535L. In addition, several new features are added. The ATmega8535 is backward compatible with ATmega8535L in most cases. However, some incompatibilities between the two atmel avr mcus exist.

To solve this problem, an ATmega8535L compatibility mode can be selected by programming the S8535C fuse. ATmega8535 is pin compatible with ATmega8535L, and can replace the AT90S8535 on current Printed Circuit Boards. However, the location of fuse bits and the electrical characteristics differs between the two devices.

Port A serves as the analog inputs to the A/D Converter. Port A also serves as an 8-bit bi-directional I/O port, if the A/D Converter is not used. Port pins can provide internal pull-up resistors (selected for each bit). The Port A output buffers have symmetrical drive characteristics with both high sink and source capability before break atmel avr mcu.
When pins PA0 to PA7 are used as inputs and are externally pulled low, they will source current if the internal pull-up resistors are activated.

The Port A pins are tri-stated when a reset condition becomes active, even if the clock is not running. Port B is an 8-bit bi-directional I/O port with internal pull-up resistors (selected for each bit). The Port B output buffers have symmetrical drive characteristics with both high sink and source capability after Break Atmel AVR MCU ATmega8535L Heximal.
As inputs, Port B pins that are externally pulled low will source current if the pull-up resistors are activated. The Port B pins are tri-stated when a reset condition becomes active, even if the clock is not running. Port C is an 8-bit bi-directional I/O port with internal pull-up resistors (selected for each bit). The Port C output buffers have symmetrical drive characteristics with both high sink and source capability.

As inputs, Port C pins that are externally pulled low will source current if the pull-up resistors are activated. The Port C pins are tri-stated when a reset condition becomes active, even if the clock is not running. Port D is an 8-bit bi-directional I/O port with internal pull-up resistors (selected for each bit). The Port D output buffers have symmetrical drive characteristics with both high sink and source capability when Break Atmel AVR MCU ATmega8535L Heximal.
As inputs, Port D pins that are externally pulled low will source current if the pull-up resistors are activated. The Port D pins are tri-stated when a reset condition becomes active, even if the clock is not running before break IC.

Every transistor and its connection paths acts like an RC element with a characteristic time delay. The maximum usable clock frequency of a processor is determined by the maximum delay among its elements. Similarly, every flip-flop has a characteristic time window (of a few picoseconds) during which it samples its input voltage and changes its output accordingly. This window can be anywhere inside the specified setup cycle of the flip-flop, but is quite fixed for an individual device at a given voltage and temperature. So if we apply a clock glitch (a clock pulse much shorter than normal) or a power glitch (a rapid transient in supply voltage) this will affect only some transistors in the chip and cause one or more flip-flops to adopt the wrong state. By varying the parameters, the CPU can be made to execute a number of completely different wrong instructions, sometimes including instructions that are not even supported by the microcode. Although we do not know in advance which glitch will cause which wrong instruction in which chip, it can be fairly simple to conduct a systematic search.

IC break Methods

IC break can be diversify as three different ways like semi-invasive break IC, un-invasive IC break, invasive break IC. And ultra-violet radiation break IC is the most ancient way of this industry. In the middle of 1970 attacker use this way to IC break and it has been viewed as the invasive attack, but it need to decapsulate the package of IC, and surely it will classify semi-invasive IC break. But it works on most of the OTP and UV EPROM microcontrollers. These MCU IC can fend off the low cost and low level IC break.
Ultra-Violet IC break can be separated into two steps: the first one is locate the security fuse of IC, and then use ultra-violet radiation to reset the IC to un-protection states. Normally the design of security fuse in the IC later than IC memorizer but ultra-violet radiation can cover the whole IC.
Circuit Engineering Company Limited continues to be recognized as the Southern China Leader in Services for IC breakion service. With the advancement of today’s modern circuit board technology, it is more important than ever to have specialists available to help you at a moment’s notice. Our engineering and commercial teams collectively have a vast amount of electronic experience covering field include Consumer Electronics, Industrial Automation Electronics, Wireless Communication Electronics., etc. For more information please contact us through email.

Glitch attacks are fast changes in the signals supplied to the device and designed to affect its normal operation. Usually glitches are inserted in power supply and clock signals, but a glitch could be an external electric field transient or an electro-magnetic pulse. two metal needles might be placed on a smartcard within a few hundred micrometers away from the chip surface. Then by applying a spike of a few hundred volts for less than a microsecond on these needles, an electric field in the silicon substrate of sufficient strength to temporarily shift the threshold voltages of nearby transistors will be induced. One modification of the above proposal was suggested recently: using a miniature inductor consisting of several hundred turns of fine wire around the tip of a microprobe needle. A current injected into this coil will create a magnetic field, and the needle will concentrate the field lines.