Secured MCU Breaker Experts!

Archive for the ‘Recover MCU’ Category

We can reverse engineering chip ATMEGA640 flash, please view the chip ATMEGA640 features for your reference:
The interconnection between master and slave CPUs with SPI is shown in the following figure. The SCK pin is the clock output in the master mode but is the clock input in the slave mode when reverse engineering chip flash.
Writing to the SPI data register of the master CPU starts the SPI clock generator, and the data written shifts out of the MOSI pin and into the MOSI pin of the slave CPU. After shifting one byte, the SPI clock generator stops, setting the end of transmission flag (SPIF) if reverse engineering chip flash.
If both the SPI interrupt enable bit (SPIE) and the serial port interrupt enable bit (ES) are set, an interrupt is requested. The Slave Select input, SS/P1.4, is set low to select an individual SPI devchipe as a slave. When SS/P1.4 is set high, the SPI port is deactivated and the MOSI/P1.5 pin can be used as an input.
There are four combinations of SCK phase and polarity with respect to serial data, whchiph are determined by control bits CPHA and CPOL. The SPI data transfer formats.
The AT89S53 has a total of six interrupt vectors: two external interrupts (INT0 and INT1), three timer interrupts (Timers 0, 1, and 2), and the serial port interrupt when reverse engineering chip flash.
Each of these interrupt sources can be individually enabled or disabled by setting or clearing a bit in Special Function Register IE. IE also contains a global disable bit, EA, whchiph disables all interrupts at once.
Note that Table 10 shows that bit position IE.6 is unimplemented. In the AT89C51, bit position IE.5 is also unimplemented. User software should not write 1s to these bit positions, since they may be used in future AT89 products. Timer 2 interrupt is generated by the logchipal OR of bits TF2 and EXF2 in register T2CON before reverse engineering chip flash.
Neither of these flags is cleared by hardware when the servchipe routine is vectored
In fact, the servchipe routine may have to determine whether it was TF2 or EXF2 that generated the interrupt, and that bit will have to be cleared in software.
The Timer 0 and Timer 1 flags, TF0 and TF1, are set at S5P2 of the cycle in whchiph the timers overflow. The values are then polled by the circuitry in the next cycle. However, the Timer 2 flag, TF2, is set at S2P2 and is polled in the same cycle in whchiph the timer overflows after REVERSE ENGINEERING MICROCONTROLLER.

Reverse Engineering Microcomputer ATmega2560 internal memory, and extract MCU ATmega2560 Program out from flash memory, crack Microcontroller ATmega2560 security fuse bit by focus ion beam technique;

Reverse Engineering Microcomputer ATmega2560 internal memory, and extract MCU ATmega2560 Program out from flash memory, crack Microcontroller ATmega2560 security fuse bit by focus ion beam technique

If lock bits LB1 and LB2 have not been programmed, the programmed Code can be read back via the address and data lines for verification. The state of the lock bits can also be verified directly in the parallel programming mode when copying infineon saf-xc888cm-8ffi binary.

In the serial programming mode, the state of the lock bits can only be verified indirectly by observing that the lock bit features are enabled. In the parallel programming mode, Microcomputer erase is initiated by using the proper combination of control signals and by holding ALE/PROG low for 10 ms.
The Code array is written with all “1”s in the Microcomputer Erase operation. In the serial programming mode, a Microcomputer erase operation is initiated by issuing the Microcomputer Erase instruction. In this mode, Microcomputer erase is self-timed and takes about 16 ms.
During Microcomputer erase, a serial read from any address location will return 00H at the data outputs. A programmable fuse is available to disable Serial Programming if the user needs maximum system security after recover Microcomputer C8051F340 firmware.
The Serial Programming Fuse can only be programmed or erased in the Parallel Programming Mode. The AT89S53 is shipped with the Serial Programming Mode enabled.

Reading the Signature Bytes: The signature bytes are read by the same procedure as a normal verification of locations 030H and 031H, except that P3.6 and P3.7 must be pulled to a logic low. The values returned are as follows:
(030H) = 1EH indicates manufactured by Atmel
(031H) = 53H indicates 89S53
Every code byte in the program array can be written, and the entire array can be erased, by using the appropriate combination of control signals. The write operation cycle is self-timed and once initiated, will automatically time itself to completion.
All major programming vendors offer worldwide support for the Atmel microcontroller series. Please contact your local programming vendor for the appropriate software revision.

Manufacturers often protect their devices by securing the source code, binary files, or EEPROM data within the chip. This prevents competitors from copying or duplicating their designs. However, there are legitimate reasons to restore an IC’s program, such as:

• Recovering lost firmware from a damaged MCU

• Repairing devices with corrupted flash memory

• Analyzing secured code for security research

• Cloning legacy systems where original files are no longer available

Para chips altamente protegidos, o desencapsulamento envolve a abertura física do CI para acessar o chip de silício. Usando microprobes, os especialistas podem despejar os dados hexagonais diretamente das células de memória. Este método é frequentemente usado em engenharia reversa para recuperar firmware de MCUs obsoletos ou bloqueados. Alguns chips podem ser atacados usando análise de energia ou ataques de temporização para descriptografar dados protegidos. Ao monitorar flutuações de energia ou tempos de execução, os pesquisadores podem decodificar o firmware criptografado sem precisar da chave original. Muitos microcontroladores têm portas de depuração ocultas (JTAG, SWD) que permitem acesso direto à memória flash. Se essas interfaces não forem desabilitadas, os invasores podem despejar o arquivo binário inteiro e restaurá-lo em outro chip. Se o MCU armazenar seu programa em uma EEPROM externa ou memória flash, o chip pode ser dessoldado e lido usando um programador. Este método é comum para replicar ou clonar firmware de dispositivos mais antigos. Para firmware criptografado, ataques de força bruta ou falhas de voltagem (injeção de falha) podem ser usados ​​para contornar a segurança e extrair o código-fonte.

Methods to Extract and Restore IC Data

To break or hack into a secured chip, engineers use various techniques:

1. Decapsulation and Microprobing

For highly protected chips, decapsulation involves physically opening the IC to access the silicon die. Using microprobes, experts can dump the heximal data directly from the memory cells. This method is often used in reverse engineering to recover firmware from obsolete or locked MCUs.

2. Side-Channel Attacks

Some chips can be attacked using power analysis or timing attacks to decrypt secured data. By monitoring power fluctuations or execution times, researchers can decode the encrypted firmware without needing the original key.

3. Firmware Dumping via Debug Interfaces

Many microcontrollers have hidden debug ports (JTAG, SWD) that allow direct access to the flash memory. If these interfaces are not disabled, attackers can dump the entire binary file and restore it to another chip.

4. EEPROM/Flash Chip Removal

If the MCU stores its program in an external EEPROM or flash memory, the chip can be desoldered and read using a programmer. This method is common for replicating or cloning firmware from older devices.

Đối với các chip được bảo vệ cao, quá trình tách vỏ liên quan đến việc mở IC vật lý để truy cập vào khuôn silicon. Sử dụng các đầu dò vi mô, các chuyên gia có thể đổ dữ liệu hex trực tiếp từ các ô nhớ. Phương pháp này thường được sử dụng trong kỹ thuật đảo ngược để khôi phục chương trình cơ sở từ các MCU đã lỗi thời hoặc bị khóa. Một số chip có thể bị tấn công bằng cách sử dụng phân tích công suất hoặc tấn công thời gian để giải mã dữ liệu được bảo mật. Bằng cách theo dõi các biến động công suất hoặc thời gian thực hiện, các nhà nghiên cứu có thể giải mã chương trình cơ sở được mã hóa mà không cần khóa gốc. Nhiều bộ vi điều khiển có các cổng gỡ lỗi ẩn (JTAG, SWD) cho phép truy cập trực tiếp vào bộ nhớ flash. Nếu các giao diện này không bị vô hiệu hóa, kẻ tấn công có thể dump toàn bộ tệp nhị phân và khôi phục nó vào một chip khác. Nếu MCU lưu trữ chương trình của mình trong EEPROM hoặc bộ nhớ flash bên ngoài, chip có thể được hàn lại và đọc bằng một bộ lập trình. Phương pháp này phổ biến để sao chép hoặc nhân bản chương trình cơ sở từ các thiết bị cũ hơn. Đối với chương trình cơ sở được mã hóa, có thể sử dụng các cuộc tấn công bằng vũ lực hoặc lỗi điện áp (tiêm lỗi) để bỏ qua bảo mật và trích xuất mã nguồn.

5. Brute-Force and Fault Injection

For encrypted firmware, brute-force attacks or voltage glitching (fault injection) can be used to bypass security and extract the source code.

Restore IC Program from its embedded flash memory and eeprom memory has to change the status of Microcontroller from encrypted to un-encrypted, then readout code from MCU memory with universal programmer;

Restore IC Program from its embedded flash memory and eeprom memory has to change the status of Microcontroller from encrypted to un-encrypted, then readout code from MCU memory with universal programmer

Semiconductor manufacturers offer valuable customers an easy way to increase the protection of their products: IC chips with custom marking on the packages instead of standard chip names. That gives the impression that the final product was designed using ASICs or full custom ICs.

‘Everyone knows’ that ASICs offer very good protection against different sorts of ic attacks and only well equipped and highly skilled ic crackers could succeed with br restore IC program from them. This may stop many potential mcu attackers fiddling with the product.

However, a determined mcu cracker could try an easy way to check whether this chip was actually an ASIC. The easy way is to note which pins are connected to power supply, ground, clock, reset, serial, and other interfaces, and to compare all this information with the database of suspect microcontrollers or other ICs.

Для высокозащищенных чипов декапсуляция подразумевает физическое открытие ИС для доступа к кремниевому кристаллу. Используя микрозонды, эксперты могут выгружать шестнадцатеричные данные непосредственно из ячеек памяти. Этот метод часто используется при обратном проектировании для восстановления прошивки устаревших или заблокированных микроконтроллеров. Некоторые чипы можно атаковать с помощью анализа питания или атак по времени для расшифровки защищенных данных. Отслеживая колебания питания или время выполнения, исследователи могут расшифровать зашифрованную прошивку без необходимости использования оригинального ключа. Многие микроконтроллеры имеют скрытые отладочные порты (JTAG, SWD), которые обеспечивают прямой доступ к флэш-памяти. Если эти интерфейсы не отключены, злоумышленники могут сбросить весь двоичный файл и восстановить его на другой чип. Если микроконтроллер хранит свою программу во внешней EEPROM или флэш-памяти, чип можно выпаять и прочитать с помощью программатора. Этот метод распространен для копирования или клонирования прошивок со старых устройств. Для зашифрованной прошивки можно использовать атаки методом подбора или сбой напряжения (внедрение неисправностей), чтобы обойти защиту и извлечь исходный код.

This works very reliably, as each microcontroller family has its own characteristic pinout. Once similarities are found the suspected microcontroller could be verified by placing it into a programming device or universal programmer and trying to read it.

Decrypt Microprocessor ATmega2561 memory and extract dump from flash memory and eeprom memory, the content include program and data which will be presented in the format of binary or heximal;

Decrypt Microprocessor ATmega2561 memory and extract dump from flash memory and eeprom memory, the content include program and data which will be presented in the format of binary or heximal

The ATmega2561 AVR is supported with a full suite of program and system development tools including: C compilers, macro assemblers, program debugger/simulators, in-circuit emulators, and evaluation kits. Each device in the ATmega2561 family differs only in memory size and number of pins. Table 1 summarizes the different configurations for the six devices.
Port A is an 8-bit bi-directional I/O port with internal pull-up resistors (selected for each bit). The Port A output buffers have symmetrical drive characteristics with both high sink and source capability before decrypt copy microcontroller P87C51X2BBD binary.
As inputs, Port A pins that are externally pulled low will source current if the pull-up resistors are activated. The Port A pins are tri-stated when a reset condition becomes active, even if the clock is not running. Port B is an 8-bit bi-directional I/O port with internal pull-up resistors (selected for each bit).

The Port B output buffers have symmetrical drive characteristics with both high sink and source capability. As inputs, Port B pins that are externally pulled low will source current if the pull-up resistors are activated when recovery Microprocessor AT89C4051 heximal.
The Port B pins are tri-stated when a reset condition becomes active, even if the clock is not running. Port B has better driving capabilities than the other ports.
Port C is an 8-bit bi-directional I/O port with internal pull-up resistors (selected for each bit). The Port C output buffers have symmetrical drive characteristics with both high sink and source capability. As inputs, Port C pins that are externally pulled low will source current if the pull-up resistors are activated. The Port C pins are tri-stated when a reset condition becomes active, even if the clock is not running.
Port D is an 8-bit bi-directional I/O port with internal pull-up resistors (selected for each bit). The Port D output buffers have symmetrical drive characteristics with both high sink and source capability.
As inputs, Port D pins that are externally pulled low will source current if the pull-up resistors are activated. The Port D pins are tri-stated when a reset condition becomes active, even if the clock is not running.

Reverse Engineering MCU ATtiny48V Eeprom physical structure in the reverse order of microcontroller ATtiny48v manufacturing, security fuse bit can be located and crack microcontroller‘s bit, so the firmware can be readout from MCU memory;

This section discusses the AVR core architecture in general. The main function of the CPU core is to ensure correct program execution. The CPU must therefore be able to access memories, perform calculations, control peripherals, and handle interrupts. In order to maximize performance and parallelism, the AVR uses a Harvard architecture – with separate memories and buses for program and data. Instructions in the program memory are executed with a single level pipelining.

While one instruction is being executed, the next instruction is pre-fetched from the program memory. This concept enables instructions to be executed in every clock cycle. The program memory is In System Reprogrammable eeprom memory. The fast-access Register File contains 32 x 8-bit general purpose working registers with a single clock cycle access time.

This allows single-cycle Arithmetic Logic Unit (ALU) operation.
In a typMCUal ALU operation, two operands are output from the Register File, the operation is executed, and the result is stored back in the Register File – in one clock cycle. Six of the 32 registers can be used as three 16-bit indirect address register pointers for Data Space addressing – enabling effMCUient address calculations.

One of the these address pointers can also be used as an address pointer for look up tables in eeprom program memory. These added function registers are the 16-bit X-, Y-, and Z-register, described later in this section.
The ALU supports arithmet and logic operations between registers or between a constant and a register. Single register operations can also be executed in the ALU. After an arithmetic operation, the Status Register is updated to reflect information about the result of the operation.
Program flow is provided by conditional and unconditional jump and call instructions, able to directly address the whole address space. Most AVR instructions have a single 16-bit word format. Every program memory address contains a 16- or 32-bit instruction after REVERSE ENGINEERING MICROCONTROLLER.

Reverse Engineering MCU ATmega324PV to extract microcontroller ATmega324PV scheme, locate the fuse bit and crack MCU’s memory for Heximal reading;

These options should only be used when not operating close to the maximum frequency of the device, and only if frequency stability at start-up is not important for the application. These options are not suitable for crystals.
These options are intended for use with ceramic resonators and will ensure frequency stability at start-up. They can also be used with crystals when not operating close to the maximum frequency of the device, and if frequency stability at start-up is not important for the application if copy chip at89s8252 flash.
The device can utilize a 32.768 kHz watch crystal as clock source by a dedicated Low Frequency Crystal Oscillator. The crystal should be connected as shown in Figure 22. When this Oscillator is selected, start-up times are determined by the SUT Fuses and CKSEL0.

The calibrated internal RC Oscillator by default provides a 8.0 MHz clock. The frequency is nominal value at 3V and 25°C. The device is shipped with the CKDIV8 Fuse programmed. See “System Clock Prescaler” on page 48 for more details. This clock may be selected as the system clock by programming the CKSEL Fuses as shown in Table.

If selected, it will operate with no external components. During reset, hardware loads the calibration byte into the OSCCAL Register and thereby automatically calibrates the RC Oscillator. At 3V and 25°C, this calibration gives a frequency of 8 MHz ± 1%.

The oscillator can be calibrated to any frequency in the range 7.3 – 8.1 MHz within ±1% accuracy, by changing the OSCCAL register. When this Oscillator is used as the MCU clock, the Watchdog Oscillator will still be used for the Watchdog Timer and for the Reset Time-out. For more information on the pre-programmed calibration value when Recover chip pic16f913 binary.
The device is shipped with this option selected.
The frequency ranges are preliminary values. Actual values are TBD.
If 8 MHz frequency exceeds the specification of the device (depends on VCC), the CKDIV8 Fuse can be programmed in order to divide the internal frequency by 8. When this Oscillator is selected, start-up times are determined by the SUT Fuses.
The Oscillator Calibration Register is used to trim the Calibrated Internal RC Oscillator to remove process variations from the oscillator frequency. The factory-calibrated value is automatically written to this register during MCU reset, giving an oscillator frequency of 8.0 MHz at 25°C.
The application software can write this register to change the oscillator frequency. The oscillator can be calibrated to any frequency in the range 7.3 – 8.1 MHz within ±1% accuracy. Calibration outside that range is not guaranteed.

Reverse Engineering Chip ATmega644A and extract microcontroller scheme to locate the security fuse bit of embedded flash, cut it off by breaking MCU technique, read processor atmega644a code and make new microprocessor cloning;

When the SM2..0 bits are written to 000, the SLEEP instruction makes the Chip enter Idle mode, stopping the CPU but allowing the SPI, USART, Analog Comparator, ADC, 2-wire Serial Interface, Timer/Counters, Watchdog, and the interrupt system to continue operating. This sleep mode basically halts clkCPU and clkFLASH, while allowing the other clocks to run. Idle mode enables the Chip to wake up from external triggered interrupts as well as internal ones like the Timer Overflow and USART Transmit Complete interrupts.
If wake-up from the Analog Comparator interrupt is not required, the Analog Comparator can be powered down by setting the ACD bit in the Analog Comparator Control and Status Register – ACSR. This will reduce power consumption in Idle mode. If the ADC is enabled, a conversion starts automatically when this mode is entered before attack mcu protection.
When the SM2..0 bits are written to 001, the SLEEP instruction makes the Chip enter ADC Noise Reduction mode, stopping the CPU but allowing the ADC, the external interrupts, 2-wire Serial Interface address match, Timer/Counter2 and the Watchdog to continue operating (if enabled). This sleep mode basically halts clkI/O, clkCPU, and clk-FLASH, while allowing the other clocks to run.

This improves the noise environment for the ADC, enabling higher resolution measurements. If the ADC is enabled, a conversion starts automatically when this mode is entered when Reverse Engineering Chip code.
Apart form the ADC Conversion Complete interrupt, only an External Reset, a Watchdog System Reset, a Watchdog interrupt, a Brown-out Reset, a 2-wire serial interface interrupt, a Timer/Counter2 interrupt, an SPM/EEPROM ready interrupt, an external level interrupt on INT7:4 or a pin change interrupt can wakeup the Chip from ADC Noise Reduction mode.

When the SM2..0 bits are written to 010, the SLEEP instruction makes the Chip enter Power-down mode. In this mode, the external Oscillator is stopped, while the external interrupts, the 2-wire Serial Interface, and the Watchdog continue operating (if enabled).
Only an External Reset, a Watchdog Reset, a Brown-out Reset, 2-wire Serial Interface address match, an external level interrupt on INT7:4, an external interrupt on INT3:0, or a pin change interrupt can wake up the Chip. This sleep mode basically halts all generated clocks, allowing operation of asynchronous modules only after Reverse Engineering MICROCONTROLLER.

We can reverse engineering Microcontroller AVR ATXMEGA128A1 Heximal, please view the Microcontroller AVR ATXMEGA128A1 features for your reference:
The External Bus Interface (EBI) is the interface for connecting external peripheral and memory to the data memory space. The XMEGA A1 has 3 ports that can be used for the EBI. It can interface external SRAM, SDRAM, and/or peripherals such as LCD displays and other memory mapped devices if the heximal of microcontroller can be reverse engineeringed.
The address space, and the number of pins used, for the external memory is selectable from 256 bytes (8-bit) and up to 16M bytes (24-bit). Various multiplexing modes for address and data lines can be selected for optimal use of pins when more or less pins is available for the EBI when REVERSE ENGINEERING MICROCONTROLLER.
Each of the four chip selects has seperate configuration, and can be configured for SRAM, SRAM Low Pin Count (LPC) or SDRAM. The data memory address space associated for each chip select is decided by a configurable base address and address size for each chip celect.
For SDRAM both 4-bit SDRAM is supported, and SDRAM configurations such as CAS Latency and Refresh rate is configurable in software. The EBI is clocked from the Peripheral 2x Clock, running up to two times faster than the CPU and supporting speeds of up to 64 MHz.
The Calibration Row is a seperate memory section for factory programmed data. It contains calibration data for functions such as oscillators, device ID, and a factory programmed serial number that is unique for each device. The device ID for the available XMEGA A1 devices is shown in Table 7-1 on page 13. Some of the calibration values will be automatically loaded to the corresponding module or peripheral unit during reset. The Calibration Row can not be written or erased. It can be read from application software and external programming from reverse engineering the heximal out of microcontroller.

We can restore Atmel controller ATMEGA88P source code, please view the Atmel controller ATMEGA88P features for your reference:
The interrupt execution response for all the enabled AVR interrupts is four clock cycles minimum. After four clock cycles the source code vector address for the actual interrupt handling routine is executed. During this four clock cycle period, the source code Counter is pushed onto the Stack.
The vector is normally a jump to the interrupt routine, and this jump takes three clock cycles. If an interrupt occurs during execution of a multi-cycle instruction, this instruction is completed before the interrupt is served. If an interrupt occurs when the MCU is in sleep mode, the interrupt execution response time is increased by four clock cycles if Restore Atmel Controller ATmega88P Source Code.
This increase comes in addition to the start-up time from the selected sleep mode. A return from an interrupt handling routine takes four clock cycles. During these four clock cycles, the source code Counter (two bytes) is popped back from the Stack, the Stack Pointer is incremented by two, and the I-bit in SREG is set.
The ATmega48/88/168 contains 4/8/16K bytes On-Atmel controller In-System Resource codemable Flash memory for source code storage. Since all AVR instructions are 16 or 32 bits wide, the Flash is organized as 2/4/8K x 16. For software security, the Flash source code memory space is divided into two sections, Boot Loader Section and Application source code Section in ATmega88.
ATmega48 does not have separate Boot Loader and Application source code sections, and the SPM instruction can be executed from the entire Flash. The Flash memory has an endurance of at least 10,000 write/erase cycles. The ATmega48/88/168 source code Counter (PC) is 11/12/13 bits wide, thus addressing the 2/4/8K source code memory locations. The operation of Boot source code section and associated Boot Lock bits when Restore Atmel Controller ATmega88P Source Code.
The ATmega48/88/168 is a complex microcontroller with more peripheral units than can be supported within the 64 locations reserved in the Opcode for the IN and OUT instructions. For the Extended I/O space from 0x60 – 0xFF in SRAM, only the ST/STS/STD and LD/LDS/LDD instructions can be used.
The lower 768/1280/1280 data memory locations address both the Register File, the I/O memory, Extended I/O memory, and the internal data SRAM. The first 32 locations address the Register File, the next 64 location the standard I/O memory, then 160 locations of Extended I/O memory, and the next 512/1024/1024 locations address the internal data SRAM before Restore Atmel Controller ATmega88P Source Code.
The five different addressing modes for the data memory cover: Direct, Indirect with Displacement, Indirect, Indirect with Pre-decrement, and Indirect with Post-increment. In the Register File, registers R26 to R31 feature the indirect addressing pointer registers.
The direct addressing reaches the entire data space. The Indirect with Displacement mode reaches 63 address locations from the base address given by the Y- or Z-register. When using register indirect addressing modes with automatic pre-decrement and post-increment, the address registers X, Y, and Z are decremented or incremented. The 32 general purpose working registers, 64 I/O Registers, 160 Extended I/O Registers, and the 512/1024/1024 bytes of internal data SRAM in the ATmega48/88/168 when RECOVER MCU.

decrypt embedded microcontroller eeprom memory, as we mentioned above, embedded microcontroller decrypter can use laser scanning to read the status of transistors. And just embedded microcontroller decrypter expected, laser can scan the P and N type transistor’s source in the embedded microcontroller memorizer as well as the photocurrent generated from the drain electrode, un-transparent metal wire can be use to treat the lowest photocurrent.
The result of laser scanning can see the photocurrent in the inverse switch status of SRAM unit obviously whembedded microcontrollerh can be used to assure the embedded microcontroller memorizer status after decrypting it. In order to explain the result for the purpose of pursuit more proper scanning parameters, use DIODE-2D present the laser impulse to two dimension of reversor after Decrypt Embedded Microcontroller Eeprom Memory.

The length of narrow channel is assumed to be 1 micron, laser radiation strength is 1.104W/cm2. Other parameters, such as mixed density, P and N channel depth, use the standard 1 micron N type base CMOS technology parameter of embedded microcontroller.

Embedded microcontroller decrypter has simulate the two status of reversor, the laser with different wavelength on the various locations, their relationship with the power supply current can reveal that the current of transistor in the turn off exposure status could be much bigger than the current in the turn on exposure status when Decrypt Embedded Microcontroller Eeprom Memory. Turn up the shutdown transistor channel can increase the total current and its increasing amount is much bigger than the slightly decrease the open channel resistor slight.