Break IC, Recover MCU, Microcontroller Reverse Engineering

Some of the old and out of date devices need to be repaired while the head of the device: Microcontroller has burned out and unable to be used anymore, at this time engineer need to get microcontroller replaced so Retrieve Nuvoton Microcontroller W77E54 Program become a necessary step to proceed with, today we would like to introduce how the W77E54 is working, start from the general introduction and main features:

The W77E54 is an 8-bit microcontroller which can accommodate a wider frequency range with low power consumption. The instruction set for the W77E54 is fully compatible with the standard 8051. The W77E54 contains an 4K bytes Flash EPROM; a 128 bytes RAM; four 8-bit bi-directional and bit-addressable I/O ports; an additional 4-bit I/O port P4; two 16-bit timer/counters when Retrieve Nuvoton Microcontroller W77E54 Program; a hardware watchdog timer and a serial port. These peripherals are supported by seven sources two-level interrupt capability. To facilitate programming and verification, the Flash EPROM inside the W77E54 allows the program memory to be programmed and read electronically. Once the code is confirmed, the user can protect the code for security.

The W77E54 microcontroller has two power reduction modes, idle mode and power-down mode, both of which are software selectable. The idle mode turns off the processor clock but allows for continued peripheral operation. The power-down mode stops the crystal oscillator for minimum power consumption. The external clock can be stopped at any time and in any state without affecting the processor after Retrieve Nuvoton Microcontroller W77E54 Program.

It is very critical to reset the security bits of Microcontroller W77E52 to disable its protection against the internal memory system which include flash and eeprom, only when the bits has been disable, the Attack Nutovon Microcontroller W77E52 Flash Memory will become a possibility, now we list some of the basic features of its security bits:

During the programmer operation mode, the Flash EPROM can be programmed and verified repeatedly. Until the code inside the Flash EPROM is confirmed OK, the code can be protected. The protection of Flash EPROM and those operations on it are described below.

The W77E52 has a Special Setting Register, the Security Register, which can be accessed in normal mode. The register can only be accessed from the Flash EPROM operation mode. Those bits of the Security Registers can not be changed once they have been programmed from high to low. They can only be reset through erase-all operation. The Security Register is addressed in the Flash EPROM operation mode by address #0FFFFh when Attack Nutovon Microcontroller W77E52 Flash Memory.

SPECIAL SETTING REGISTER

7.1 Lock Bit
This bit is used to protect the customer’s program code in the W78E51B. It may be set after the programmer finishes the programming and verifies sequence. Once this bit is set to logic 0, both the on-chip ROM data and Special Setting Registers can not be accessed again.

7.2 MOVC Inhibit
This bit is used to restrict the accessible region of the MOVC instruction. It can prevent the MOVC instruction in external program memory from reading the internal program code. When this bit is set to logic 0, a MOVC instruction in external program memory space will be able to access code only in the external memory, not in the internal memory. A MOVC instruction in internal program memory space will always be able to access the ROM data in both internal and external memory. If this bit is logic 1, there are no restrictions on the MOVC instruction after Attack Nutovon Microcontroller W77E52 Flash Memory.

7.3 Encryption
This bit is used to enable/disable the encryption logic for code protection. Once encryption feature is enabled, the data presented on port 0 will be encoded via encryption logic. Only whole chip erase will reset this bit before reverse engineering MICROCONTROLLER.

Break Locked MCU W77E51 Eeprom Memory and extract its heximal out from it is a commonly requirement especially for those repairing companies with some obselete devices which use microcontroller W77E51, hereby we would like to introduce the composition of W77E51 on chip ROM:

The W77E51 has several modes to program the on-chip Flash EPROM. All these operations are configured by the pins RST, ALE, PSEN , A9CTRL(P3.0), A13CTRL(P3.1), A14CTRL(P3.2), OECTRL(P3.3), CE (P3.6), OE (P3.7), A0(P1.0) and VPP( EA ). Moreover, the A15A0(P2.7P2.0, P1.7P1.0) and the D7D0(P0.7P0.0) serve as the address and data bus respectively for these operations.

Read Operation
This operation is supported for customer to read their code and the Security bits. The data will not be valid if the Lock bit is programmed to low when Break Locked MCU W77E51 Eeprom Memory.

Output Disable Condition
When the OE is set to high, no data output appears on the D7..D0.

Program Operation
This operation is used to program the data to ROM and the security bits. Program operation is done when the VPP is reach to VCP (12.5V) level, CE set to low, and OE set to high.

Program Verify Operation
All the programming data must be checked after program operations. This operation should be performed after each byte is programmed; it will ensure a substantial program margin.

Erase Operation
An erase operation is the only way to change data from 0 to 1. This operation will erase all the ROM cells and the security bits from 0 to 1. This erase operation is done when the VPP is reach to VEP level, CE set to low, and OE set to high after Break Locked MCU W77E51 Eeprom Memory.

Erase Verify Operation
After an erase operation, all of the bytes in the chip must be verified to check whether they have been successfully erased to 1 or not. The erase verify operation automatically ensures a substantial erase margin. This operation will be done after the erase operation if VPP = VEP (14.5V), CE is high and  OE is low if BREAK IC.

Through the traditional power clitch method we can Recover Winbond IC W78E065A Flash Program, and then transfer it to other blank W78E065A processor which will perform the same functions as original if there is no bits are missing or error during the recovering process, now we need to have some general idea about how W78E065A microcontroller carry out the power management:

Idle Mode
The idle mode is entered by setting the IDL bit in the PCON register. In the idle mode, the internal clock to the processor is stopped. The peripherals and the interrupt logic continue to be clocked. The processor will exit idle mode when either an interrupt or a reset occurs after Recover Winbond IC W78E065A Flash Program.

Power-down Mode
When the PD bit of the PCON register is set, the processor enters the power-down mode. In this mode all of the clocks are stopped, including the oscillator. The only way to exit power-down mode is by a reset.

The external RESET signal is sampled at S5P2. To take effect, it must be held high for at least two machine cycles while the oscillator is running. An internal trigger circuit in the reset line is used to deglitch the reset line when the W78E51B is used with an external RC network.

The reset logic also has a special glitch removal circuit that ignores glitches on the reset line. During reset, the ports are initialized to FFH, the stack pointer to 07H, PCON (with the exception of bit 4) to 00H, and all of the other SFR registers except SBUF to 00H. SBUF is not reset.

The first step to get Protected Winbond Microprocessor W78E65 Reverse Engineering to get its embedded firmware include the content from both eeprom and flash is to figure out the clock frequency, as a result of that, it is critical to understand the operational procedures of Microprocessor W78E65’s clock.

The W78E51B is designed to be used with either a crystal oscillator or an external clock. Internally,  the clock is divided by two before it is used.

This makes the W78E51B relatively insensitive to duty cycle variations in the clock. The W78E51B incorporates a built-in crystal oscillator. To make the oscillator work, a crystal must be connected across pins XTAL1 and XTAL2.

In addition, a load capacitor must be connected from each pin to ground. An external clock source should be connected to pin XTAL1. Pin XTAL2 should be left unconnected. The XTAL1 input is a CMOS-type input, as required by the crystal oscillator in order to finalize the evaluation of Protected Winbond Microprocessor W78E65 Reverse Engineering.

In below article we are going to introduce watchdog timer which play an important role in the process of Winbond Microcontroller W78E0516 Embedded Binary Recovering:

As we all know that the Watchdog timer is a free-running timer which can be programmed by the user to serve as a system monitor, a time-base generator or an event timer. It is basically a set of dividers that divide the system clock. The divider output is selectable and determines the time-out interval.

When the time-out occurs a system reset can also be caused if it is enabled. The main use of the Watchdog timer is as a system monitor. This is important in real-time control applications. In case of power glitches or electro- magnetic interference, the processor may begin to execute errant code. If this is left unchecked the entire system may crash.

The watchdog time-out selection will result in different time-out values depending on the clock speed. The Watchdog timer will de disabled on reset. In general, software should restart the Watchdog timer to put it into a known state. The control bits that support the Watchdog timer are discussed below.

Watchdog Timer Control Register

ENW : Enable watch-dog if set.

CLRW: Clear watch-dog timer and prescaler if set. This flag will be cleared automatically

WIDL : If this bit is set, watch-dog is enabled under IDLE mode. If cleared, watch-dog is disabled under IDLE mode. Default is cleared.

PS2, PS1, PS0: Watch-dog prescaler timer select. Prescaler is selected when set PS2~0 as follows:

watchdog timer scheme

The time-out period is obtained using the following equation:

OSC

´ 2¹⁴ ´PRESCALER ´ 1000 ´ 12 mS
Before Watchdog time-out occurs, the program must clear the 14-bit timer by writing 1 to WDTC.6 (CLRW). After 1 is written to this bit, the 14-bit timer, prescaler and this bit will be reset on the next instruction cycle. The Watchdog timer is cleared on reset.

When we try to Break WINBOND MCU W78E516 Eeprom Memory, there is an issue which is unable to avoid which is called EMI emission, and engineer need to figure out the way to reduce this Electro-magnetic emission interference. below we are going to introduce the cause of this interference and the way to reduce it:

Because of on-chip Flash EPROM, when a program is running in internal ROM space, the ALE will be unused. The transition of ALE will cause noise, so it can be turned off to reduce the EMI emission if it is useless. Turning off the ALE signal transition only requires setting the bit 0 of the AUXR SFR, which is located at 08Eh.

When ALE is turned off, it will be reactivated when the program accesses external ROM/RAM data or jumps to execute an external ROM code. The ALE signal will turn off again after it has been completely accessed or the program returns to internal ROM code space. The AO bit in the AUXR register, when set, disables the ALE output.

In order to reduce EMI emission from oscillation circuitry, W78E51B allows user to diminish the gain of on-chip oscillator amplifiers by using programmer to clear the B7 bit of security register. Once B7 is set to 0, a half of gain will be decreased after Break WINBOND MCU W78E516 Eeprom Memory.

Care must be taken if user attempts to diminish the gain of oscillator amplifier, reducing a half of gain may effect to external crystal operating improperly at high frequency above 24 MHz. The value of R and C1, C2 may need adjustment while running at lower gain before BREAK IC.

We can Restore Winbond Microcontroller W78E058 Heximal, please view the Microcontroller W78E058 features for your reference:

FUNCTIONAL DESCRIPTION:

The W78E058 architecture consists of a core controller surrounded by various registers, five general purpose I/O ports, 128 bytes of RAM, two timer/counters, and a serial port. The processor supports 111 different opcodes and references both a 64K program address space and a 64K data storage space.

NEW DEFINED PERIPHERAL:

In order to be more suitable for I/O, an extra 4-bit bit-addressable port P4 and two external interrupt
INT2 , INT3 has been added to either the PLCC or QFP 44 pin package. And description follows:

INT2 / INT3

Two additional external interrupts, INT2 and INT3 , whose functions are similar to those of external interrupt 0 and 1 in the standard 80C52. The functions/status of these interrupts are determined/shown by the bits in the XICON (External Interrupt Control) register. The XICON register is bit-addressable but is not a standard register in the standard 80C52. Its address is at 0C0H. To set/clear bits in the XICON register, one can use the “SETB (/CLR) bit” instruction. For example, “SETB 0C2H” sets the EX2 bit of XICON when Restore Winbond Microcontroller W78E058 Heximal.

XICON – external interrupt control (C0H)

PX3: External interrupt 3 priority high if set EX3: External interrupt 3 enable if set

IE3: If IT3 = 1, IE3 is set/cleared automatically by hardware when interrupt is detected/serviced IT3: External interrupt 3 is falling-edge/low-level triggered when this bit is set/cleared by software PX2: External interrupt 2 priority high if set

EX2: External interrupt 2 enable if set

IE2: If IT2 = 1, IE2 is set/cleared automatically by hardware when interrupt is detected/serviced IT2: External interrupt 2 is falling-edge/low-level triggered when this bit is set/cleared by software after Restore Winbond Microcontroller W78E058 Heximal

We can Decode Winbond Chip W78E065 Internal Memory, please view the Winbond Chip W78E065 features for your reference:

The W78E065 is an 8-bit microcontroller which can accommodate a wider frequency range with low power consumption. The instruction set for the W78E065 is fully compatible with the standard 8051. The W78E065 contains an 4K bytes Flash EPROM; a 128 bytes RAM; four 8-bit bi-directional and bit- addressable I/O ports; an additional 4-bit I/O port P4; two 16-bit timer/counters; a hardware watchdog timer and a serial port.

These peripherals are supported by seven sources two-level interrupt capability. To facilitate programming and verification, the Flash EPROM inside the W78E51B allows the program memory to be programmed and read electronically. Once the code is confirmed, the user can protect the code for security when Decode Winbond Chip W78E065 Internal Memory.

The W78E065 microcontroller has two power reduction modes, idle mode and power-down mode, both of which are software selectable. The idle mode turns off the processor clock but allows for continued peripheral operation. The power-down mode stops the crystal oscillator for minimum power consumption. The external clock can be stopped at any time and in any state without affecting the processor after Decode Winbond Chip W78E065 Internal Memory.

2. FEATURES
 Fully static design 8-bit CMOS microcontroller
 Wide supply voltage of 4.5V to 5.5V
 128 bytes of on-chip scratchpad RAM
 4 KB On-chip Flash EPROM
 64 KB program memory address space
 64 KB data memory address space
 Four 8-bit bi-directional ports

 One extra 4-bit bit-addressable I/O port, additional INT2 / INT3
(available on 44-pin PLCC/QFP package)
 Two 16-bit timer/counters
 One full duplex serial port(UART)
 Watchdog Timer
 Seven sources, two-level interrupt capability
 EMI reduction mode
 Built-in power management
 Code protection mechanism