Attack MCU PIC16F630 Firmware

Attack MCU PIC16F630 Firmware from its memory needs to take off the protection fuse bits of MCU and then set the status of MCU into unlocking, below its PIC16F630 features:

High Performance RISC CPU:

· Only 35 instructions to learn

– All single cycle instructions except branches

· Operating speed:

– DC – 20 MHz oscillator/clock input

– DC – 200 ns instruction cycle

· Interrupt capability

· 8-level deep hardware stack

· Direct, Indirect, and Relative Addressing modes

Special Microcontroller Features:

· Internal and external oscillator options

– Precision Internal 4 MHz oscillator factory calibrated to ±1%

– External Oscillator support for crystals and resonators

– 5 µs wake-up from SLEEP, 3.0V, typical

· Power saving SLEEP mode

· Wide operating voltage range – 2.0V to 5.5V

· Industrial and Extended temperature range

· Low power Power-on Reset (POR)

· Power-up Timer (PWRT) and Oscillator Start-up Timer (OST)

· Brown-out Detect (BOD)

· Watchdog Timer (WDT) with independent oscillator for reliable operation from CRACK MCU

· Multiplexed MCLR/Input-pin

· Interrupt-on-pin change

· Individual programmable weak pull-ups

· Programmable code protection

· High Endurance FLASH/EEPROM Cell

– 100,000 write FLASH endurance

– 1,000,000 write EEPROM endurance

– FLASH/Data EEPROM Retention: > 40 years

 

Low Power Features:

· Standby Current:

– 1 nA @ 2.0V, typical

· Operating Current:

– 8.5 µA @ 32 kHz, 2.0V, typical

– 100 µA @ 1 MHz, 2.0V, typical

· Watchdog Timer Current

– 300 nA @ 2.0V, typical

· Timer1 oscillator current:

– 4 µA @ 32 kHz, 2.0V, typical Peripheral Features

· 12 I/O pins with individual direction control

· High current sink/source for direct LED drive

· Analog comparator module with:

– One analog comparator

– Programmable on-chip comparator voltage reference (CVREF) module

– Programmable input multiplexing from device inputs

– Comparator output is externally accessible

· Analog-to-Digital Converter module (PIC16F676):

– 10-bit resolution

– Programmable 8-channel input

– Voltage reference input

· Timer0: 8-bit timer/counter with 8-bit programmable prescaler

· Enhanced Timer1:

– 16-bit timer/counter with prescaler

– External Gate Input mode

– Option to use OSC1 and OSC2 in LP mode as Timer1 oscillator, if INTOSC mode selected

· In-Circuit Serial ProgrammingTM (ICSPTM) via two pins

Attack MCU PIC12F675 Binary

This document contains device specific information for the PIC12F675. Additional information may be found in the PIC® Mid-Range Reference Manual (DS33023) from Attack MCU PIC12F675 Binary, which may be obtained from your local Microchip Sales Representative or downloaded from the Microchip web site.

The Reference Manual should be considered a complementary document to this Data  Sheet, and is highly recommended reading for a better understanding of the device architecture and operation of the peripheral modules.

The PIC12F629 and PIC12F675 devices are covered by this Data Sheet. They are identical, except the PIC12F675 has a 10-bit A/D converter. They come in 8-pin PDIP, SOIC, MLF-S and DFN packages. Figure 1-1 shows a block diagram of the PIC12F675 devices. Below Table shows the pinout description.

The PIC12F675 devices have a 13-bit program counter capable of addressing an 8K x 14 program memory space. Only the first 1K x 14 (0000h-03FFh) for the PIC12F629/675 devices is physically implemented. Accessing a location above these boundaries will cause a wrap-around within the first 1K x 14 space from UNLOCK MICROCONTROLLER.

The Reset vector is at 0000h and the interrupt vector is at 0004h.

The data memory (see Figure 2-2) is partitioned into two banks, which contain the General Purpose locations of each bank. Register locations 20h-5Fh are General Purpose Registers, implemented as static RAM and are mapped across both banks. All other RAM is unimplemented and returns ‘0’ when read. RP0 (STATUS<5>) is the bank select bit.

Registers and the Special Function Registers. The Special Function Registers are located in the first 32 locations of each bank. Register locations 20h-5Fh are General Purpose Registers, implemented as static RAM and are mapped across both banks. All other RAM is unimplemented and returns ‘0’ when read. RP0 (STATUS<5>) is the bank select bit.

Break IC PIC12F629 Program

Break IC PIC12F629 Program from its memory needs to decapsulate its silicon layer as well as metal layer, use probe to get access to the internal wafer die for databus probing:

High-Performance RISC CPU:

· Only 35 Instructions to Learn

– All single-cycle instructions except branches

· Operating Speed:

– DC – 20 MHz oscillator/clock input

– DC – 200 ns instruction cycle

· Interrupt Capability

· 8-Level Deep Hardware Stack

· Direct, Indirect, and Relative Addressing modes

Special Microcontroller Features:

· Internal and External Oscillator Options

– Precision Internal 4 MHz oscillator factory calibrated to ±1%

– External Oscillator support for crystals and resonators

– 5 ms wake-up from Sleep, 3.0V, typical

· Power-Saving Sleep mode

· Wide Operating Voltage Range – 2.0V to 5.5V

· Industrial and Extended Temperature Range

· Low-Power Power-on Reset (POR)

· Power-up Timer (PWRT) and Oscillator Start-up Timer (OST)

· Brown-out Detect (BOD)

· Watchdog Timer (WDT) with Independent Oscillator for Reliable Operation

· Multiplexed MCLR/Input Pin

· Interrupt-on-Pin Change

· Individual Programmable Weak Pull-ups

· Programmable Code Protection

· High Endurance Flash/EEPROM Cell

– 100,000 write Flash endurance

– 1,000,000 write EEPROM endurance

– Flash/Data EEPROM Retention: > 40 years

 

Low-Power Features:

· Standby Current:

– 1 nA @ 2.0V, typical

· Operating Current:

– 8.5 mA @ 32 kHz, 2.0V, typical

– 100 mA @ 1 MHz, 2.0V, typical

· Watchdog Timer Current

– 300 nA @ 2.0V, typical

· Timer1 Oscillator Current:

– 4 mA @ 32 kHz, 2.0V, typical

 

Peripheral Features:

· 6 I/O Pins with Individual Direction Control

· High Current Sink/Source for Direct LED Drive

· Analog Comparator module with:

– One analog comparator

– Programmable on-chip comparator voltage reference (CVREF) module

– Programmable input multiplexing from device inputs

– Comparator output is externally accessible

· Analog-to-Digital Converter module (PIC12F675):

– 10-bit resolution

– Programmable 4-channel input

– Voltage reference input

· Timer0: 8-Bit Timer/Counter with 8-Bit Programmable Prescaler

· Enhanced Timer1:

– 16-bit timer/counter with prescaler

– External Gate Input mode

– Option to use OSC1 and OSC2 in LP mode as Timer1 oscillator, if INTOSC mode selected

· In-Circuit Serial ProgrammingTM (ICSPTM) via two pins through CRACK MCU

Break IC PIC12F639 Heximal

Break IC PIC12F639 Heximal from its memory needs to know its memory organization

PROGRAM MEMORY ORGANIZATION

The PIC16F639 devices have a 13-bit program counter capable of addressing an 8K x 14 program memory space. Only the first 1K x 14 (0000h-03FFh, for the PIC12F635) and 2K x 14 (0000h-07FFh, for the PIC16F636/639) is physically implemented. Accessing a location above these boundaries will cause a wrap around within the first 2K x 14 space. The Reset vector is at 0000h and the interrupt vector is at 0004h.

DATA MEMORY ORGANIZATION

The data memory (see below Figure) is partitioned into two banks, which contain the General Purpose Registers (GPR) and the Special Function Registers (SFR).

 

The Special Function Registers are located in the first 32 locations of each bank. Register locations 20h-7Fh in Bank 0 and A0h-BFh in Bank 1 are GPRs, implemented as static RAM for the PIC16F639.For the PIC12F635, register locations 40h through 7Fh are GPRs implemented as static RAM. Register locations F0h-FFh in Bank 1 point to addresses 70h-7Fh in Bank 0. All other RAM is unimplemented and returns ‘0’ when read. RP0 (STATUS<5>) is the bank select bit.

GENERAL PURPOSE REGISTER

The register file is organized as 64 x 8 for the PIC12F635 and 128 x 8 for the PIC16F636/639. Each register is accessed, either directly or indirectly, through the File Select Register;

SPECIAL FUNCTION REGISTERS

The Special Function Registers (SFRs) are registers used by the CPU and peripheral functions for controlling the desired operation of the device. These registers are static RAM. The special registers can be classified into two sets: core and peripheral. The Special Function Registers associated with the “core” are described in this section. Those related to the operation of the peripheral features are described in the section of that peripheral feature from MCU CRACK.

Break IC PIC12F636 Code

it is also critical to know the peripheral features of PIC12F636 i the process of Break IC PIC12F636 Code:

Peripheral Features:

· 6/12 I/O pins with individual direction control:

– High-current source/sink for direct LED drive

– Interrupt-on-pin change

– Individually programmable weak pull-ups/pull-downs

– Ultra Low-Power Wake-up

· Analog comparator module with:

– Up to two analog comparators

– Programmable on-chip voltage reference (CVREF) module (% of VDD)

– Comparator inputs and outputs externally accessible

· Timer0: 8-bit timer/counter with 8-bit programmable prescaler

· Enhanced Timer1:

– 16-bit timer/counter with prescaler

– External Gate Input mode

– Option to use OSC1 and OSC2 in LP mode as Timer1 oscillator if INTOSC mode selected

· KEELOQ® compatible hardware Cryptographic module

· In-Circuit Serial ProgrammingTM (ICSPTM) via two pins

Low Frequency Analog Front-End Features (PIC16F639 only)

· Three input pins for 125 kHz LF input signals

· High input detection sensitivity (3 mVPP, typical)

· Demodulated data, Carrier clock or RSSI output selection

· Input carrier frequency: 125 kHz, typical

· Input modulation frequency: 4 kHz, maximum

· 8 internal configuration registers

· Bidirectional transponder communication (LF talk back)

· Programmable antenna tuning capacitance (up to 63 pF, 1 pF/step)

· Low standby current: 5 ìA (with 3 channels enabled), typical

· Low operating current: 15 ìA (with 3 channels enabled), typical

· Serial Peripheral Interface (SPI™) with internal MCU and external devices

· Supports Battery Back-up mode and batteryless operation with external circuits ly LOQ® compatible hardware Cryptographic module

· In-Circuit Serial ProgrammingTM (ICSPTM) IC breakion;

 

DEVICE OVERVIEW

This document contains device specific information for the PIC12F635/PIC16F636/639 devices. Additional information may be found in the “PICmicro® Mid-Range MCU Family Reference Manual” (DS33023), which may be obtained from your local Microchip Sales Representative or downloaded from the Microchip web site. The reference manual should be considered a complementary document to this data sheet and is highly recommended reading for a better understanding of the device architecture and operation of the peripheral modules for the purpose of CLONE IC.

Break IC PIC12F635 Program

Break IC PIC12F635 Program from eeprom and flash memory, and extract it out from it:

High-Performance RISC CPU:

· Only 35 instructions to learn:

– All single-cycle instructions except branches

· Operating speed:

– DC – 20 MHz oscillator/clock input

– DC – 200 ns instruction cycle

· Interrupt capability

· 8-level deep hardware stack

· Direct, Indirect and Relative Addressing modes

Special Microcontroller Features:

· Precision Internal Oscillator:

– Factory calibrated to ±1%

– Software selectable frequency range of 8 MHz to 31 kHz

– Software tunable

– Two-Speed Start-up mode

– Crystal fail detect for critical applications

· Clock mode switching for low power operation

· Power-saving Sleep mode

· Wide operating voltage range (2.0V-5.5V)

· Industrial and Extended Temperature range

· Power-on Reset (POR)

· Wake-up Reset (WUR)

· Independent weak pull-up/pull-down resistors

· Programmable Low-Voltage Detect (PLVD)

· Power-up Timer (PWRT) and Oscillator Start-up Timer (OST)

· Brown-out Detect (BOD) with software control option

· Enhanced Low-Current Watchdog Timer (WDT) with on-chip oscillator (software selectable nominal 268 seconds with full prescaler) with software enable

· Multiplexed Master Clear with pull-up/input pin

· Programmable code protection (program and data independent)

· High-Endurance Flash/EEPROM cell:

– 100,000 write Flash endurance

– 1,000,000 write EEPROM endurance

– Flash/Data EEPROM Retention: > 40 years

· Standby Current:

– 1 nA @ 2.0V, typical

· Operating Current:

– 8.5 ìA @ 32 kHz, 2.0V, typical

– 100 ìA @ 1 MHz, 2.0V, typical

· Watchdog Timer Current:

– 1 ìA @ 2.0V, typical

Break IC PIC12F609 Heximal

Break IC PIC12F609 Heximal from eeprom and flash memory, and then transfer the heximal into other blank PIC12F609 which will provide the same functions:

Program Memory Organization

The PIC12F609 has a 13-bit program counter capable of addressing an 8K x 14 program memory space. Only the first 1K x 14 (0000h-03FFh) for the PIC12F609/615/12HV609/615 is physically implemented. Accessing a location above these boundaries will cause a wraparound within the first 1K x 14 space. The Reset vector is at 0000h and the interrupt vector is at 0004h.

Data Memory Organization

The data memory (see Figure 2-2) is partitioned into two banks, which contain the General Purpose Registers (GPR) and the Special Function Registers (SFR). The Special Function Registers are located in the first 32 locations of each bank.

Register locations 40h-7Fh in Bank 0 are General Purpose Registers, implemented as static RAM. Register locations F0h-FFh in Bank 1 point to addresses 70h-7Fh in Bank 0. All other RAM is unimplemented and returns ‘0’ when read. The RP0 bit of the STATUS register is the bank select bit.

The Special Function Registers are registers used by the CPU and peripheral functions for controlling the desired operation of the device. These registers are static RAM.

The special registers can be classified into two sets: core and peripheral. The Special Function Registers associated with the “core” are described in this section. Those related to the operation of the peripheral features are described in the section of that peripheral feature.

The STATUS register, shown in Register 2-1, contains:

· the arithmetic status of the ALU

· the Reset status

· the bank select bits for data memory (RAM)

The STATUS register can be the destination for any instruction, like any other register. If the STATUS register is the destination for an instruction that affects the Z, DC or C bits, then the write to these three bits is disabled. These bits are set or cleared according to the device logic. Furthermore, the TO and PD bits are not writable. Therefore, the result of an instruction with the STATUS register as destination may be different than intended for the purpose of CLONE IC.

Break IC PIC12F615 Software

Break IC PIC12F615 Software from its memory, it is important to know the basic features of PIC12F615 and then disable its protection mechanism:

 

High-Performance RISC CPU:

· Only 35 instructions to learn:

– All single-cycle instructions except branches

· Operating speed:

– DC – 20 MHz oscillator/clock input

– DC – 200 ns instruction cycle

· Interrupt capability

· 8-level deep hardware stack

· Direct, Indirect and Relative Addressing modes

 

Special Microcontroller Features:

· Precision Internal Oscillator:

– Factory calibrated to ±1%, typical

– Software selectable frequency: 4 MHz or 8 MHz

· Power-Saving Sleep mode

· Voltage range:

– PIC12F609/615: 2.0V to 5.5V

– PIC12HV609/615: 2.0V to user defined maximum (see note)

· Industrial and Extended Temperature range

· Power-on Reset (POR)

· Power-up Timer (PWRT) and Oscillator Start-up Timer (OST)

· Brown-out Reset (BOR)

· Watchdog Timer (WDT) with independent oscillator for reliable operation

· Multiplexed Master Clear with pull-up/input pin

· Programmable code protection

· High Endurance Flash:

– 100,000 write Flash endurance

– Flash retention: > 40 years

Low-Power Features:

· Standby Current:

– 50 nA @ 2.0V, typical

· Operating Current:

– 11 ìA @ 32 kHz, 2.0V, typical

– 260 ìA @ 4 MHz, 2.0V, typical

· Watchdog Timer Current:

– 1 ìA @ 2.0V, typical

 

Peripheral Features:

· Shunt Voltage Regulator (PIC12HV609/615 only)

– 5 volt regulation

– 4 mA to 50 mA shunt range

· 5 I/O pins and 1 input only

· High current source/sink for direct LED drive

– Interrupt-on-pin change or pins

– Individually programmable weak pull-ups

· Analog Comparator module with:

– One analog comparator

– Programmable on-chip voltage reference (CVREF) module (% of VDD)

– Comparator inputs and output externally accessible

– Built-In Hysteresis (software selectable)

· Timer0: 8-bit timer/counter with 8-bit programmable prescaler

· Enhanced Timer1:

– 16-bit timer/counter with prescaler

– External Timer1 Gate (count enable)

– Option to use OSC1 and OSC2 in LP mode as Timer1 oscillator if INTOSC mode selected

– Option to use system clock as Timer1

· In-Circuit Serial ProgrammingTM (ICSPTM) via two pins

PIC12F615/HV615 ONLY:

· Enhanced Capture, Compare, PWM module:

– 16-bit Capture, max. resolution 12.5 ns

– Compare, max. resolution 200 ns

– 10-bit PWM with 1 or 2 output channels, 1 output channel programmable “dead time”, max. frequency 20 kHz, auto-shutdown

· A/D Converter:

– 10-bit resolution and 4 channels, samples internal voltage references

· Timer2: 8-bit timer/counter with 8-bit period register, prescaler and postscaler

Break IC PIC16F616 Heximal

Break IC PIC16F616 Heximal from the program memory, below we will introduce the program memory organization chart so you can have a better idea about how to get access to the wafer die:

 

PIC16F616/16HV616 only:

· A/D Converter:

– 10-bit resolution

– 8 external input channels

– 2 internal reference channels

· Timer2: 8-bit timer/counter with 8-bit period register, prescaler and postscaler

· Enhanced Capture, Compare, PWM module:

– 16-bit Capture, max. resolution 12.5 ns

– 16-bit Compare, max. resolution 200 ns

– 10-bit PWM with 1, 2 or 4 output channels, programmable “dead time”, max. frequency 20 kHz

Program Memory Organization of PIC16F616/16HV616

The PIC16F610/616/16HV610/616 has a 13-bit program counter capable of addressing an 8k x 14 program memory space. Only the first 1K x 14 (0000h-3FF) for the PIC16F610/16HV610 and the first 2K x 14 (0000h-07FFh) for the PIC16F616/16HV616 is physically implemented. Accessing a location above these boundaries will cause a wraparound within the first 1K x 14 space (PIC16F610/16HV610) and 2K x 14 space (PIC16F616/16HV616). The Reset vector is at 0000h and the interrupt vector is at 0004h.

 

 

The data memory (see Figure 2-4) is partitioned into two banks, which contain the General Purpose Registers (GPR) and the Special Function Registers (SFR). The Special Function Registers are located in the first 32 locations of each bank.

PIC16F610/16HV610 Register locations 40h-7Fh in Bank 0 are General Purpose Registers, implemented PC gram counter capable of addressing an 8k x 14 program memory space. Only the first 1K x 14 (0000h-3FF) for the PIC16F610/16HV610 and the first 2K x 14 (0000h-07FFh) for the PIC16F616/16HV616 is physically implemented.

Accessing a location above these boundaries will cause a wraparound within the first 1K x 14 space (PIC16F610/16HV610) and 2K x 14 space (PIC16F616/16HV616). The Reset vector is at 0000h and the interrupt vector is at 0004h.

We can attack PIC MCU 16F506 Code, please view the PIC MCU features for your reference:

High-Performance RISC CPU:

· Only 33 single-word instructions to learn

· All single-cycle instructions except for program branches, which are two-cycle

· 12-bit wide instructions

· 2-level deep hardware stack

· Direct, Indirect and Relative Addressing modes for data and instructions

· 8-bit wide data path

· 10 Special Function Hardware registers (PIC12F510)

· 13 Special Function Hardware registers (PIC16F506)

· Operating speed:

– DC – 8 MHz Crystal Oscillator (PIC12F510)

– DC – 500 ns instruction cycle (PIC12F510)

– DC – 20 MHz Crystal Oscillator (PIC16F506)

– DC – 200 ns instruction cycle (PIC16F506)

Special Microcontroller Features:

· 4 or 8 MHz selectable precision internal oscillator:

– Factory calibrated to ±1% when attack PIC MCU

· In-Circuit Serial Programming™ (ICSP™)

· In-Circuit Debugging (ICD) support

· Power-on Reset (POR)

· Device Reset Timer (DRT):

– Short DRT (1.125 ms, typical) for INTOSC, EXTRC and EC

– DRT (18 ms, typical) for HS, XT and LP

· Watchdog Timer (WDT) with dedicated on-chip RC oscillator for reliable operation

· Programmable code protection

· Multiplexed MCLR input pin if attack PIC MCU

· Selectable internal weak pull-ups on I/O pins

· Power-Saving Sleep mode

· Wake-up from Sleep on pin change

· Wake-up from Sleep on comparator change

Selectable oscillator options:

– INTOSC: 4/8 MHz precision Internal oscillator

– EXTRC: External low-cost RC oscillator

– XT: Standard crystal/resonator

– LP: Power-saving, low-frequency crystal

– HS: High-speed crystal/resonator (PIC16F506 only)

– EC: High-speed external clock input (PIC16F506 only) after Attack PIC MCU 16F506 Code

· Analog-to-Digital (A/D) Converter:

– 8-bit resolution

– 4-input channels (1 channel is dedicated to conversion of the internal 0.6V absolute voltage reference)

· High current sink/source for direct LED drive

· 8-bit real-time clock/counter (TMR0) with 8-bit programmable prescaler

 

Low-Power Features/CMOS Technology:

· Operating Current:

– < 170 ìA @ 2V, 4 MHz

· Standby Current:

– 100 nA @ 2V, typical

· Low-power, high-speed Flash technology:

– 100,000 cycle Flash endurance for the purpose of recover MCU

– > 40-year retention

· Fully static design

· Wide operating voltage range: 2.0V to 5.5V

· Wide temperature range:

– Industrial: -40°C to +85°C

– Extended: -40°C to +125°C e:AR-SA’>programmable prescaler