If MikaTech was a bad company, you could find tons of bad reputations about its service on the internet over the 28 years history
So, the answer is YES! We are good people.Why choose Mikatech, please click here to find out
-
MikaTech Lab - Slide
-
MikaTech Lab Started
-
MCU Decap Room
Our values and goals
About MikaTech
Time went fast, from the day we did our first 8051 MCU reverse engineering project in 1998, to the day we set up our million dollar reverse engineering lab in 2012, 14 years went by. Now we start our new business of embedded visual system development, hope we can serve another 10 years.
Peter Lee
Co-Founder & CEO
Geehy Integrated Circuit (ic) firmware Attack
CORERIVER Semiconductor is one of the most famous fabless company in South Korea and a new leader in researching, designing and marketing advanced microcontroller including easy-to-use MDS( Microcomputer Development System). CORERIVER was established in 2002 in the IT-SoC Venture Tower Bldg, Seoul. We are moving fast toward not only developing general purpose MCUs but also providing the enhanced system solution. After 3 years of growth and accumulation of valuable assets in products and technologies, there is a systematic and series of overall planning and operation for everything starting from our own product design, production, marketing and system Please check CORERIVER Semiconductor Co. Ltd for more information.
- Mikatech Coreriver MCU reverse engineer list:
- GC89L591A0 GC89L581A0 GC89L541A0 GC89C521A0 GC89C510A1 GC89C510A0 GC89C501A1 GC89C501A0 GC89C500A1 GC89C500A0 GC87C510A1 GC87C510A0 ...
Geehy Semiconductor Chip
Preface
Geehy Semiconductor (Zhuhai Geehy) is a fabless IC design company focusing on 32-bit Arm Cortex MCUs, automotive-grade SoCs, dedicated motor control SoCs, dual-core high-performance industrial MCUs, BLE wireless MCUs, analog front-end ICs and sensor chips.
Main product brand prefixes:
- APM32: Industrial general-purpose & automotive-qualified 32-bit MCUs (Cortex-M0+/M3/M4F)
- G32: New-generation high-performance dedicated MCUs / automotive SoCs / motor control MCUs
- GW: Bluetooth Low Energy wireless MCU series
- GURC: Special analog & sensor signal conditioning chips
Note: Each base family contains dozens of sub-models differentiated by Flash size, SRAM capacity, pin count, package and temperature grade; only core representative base series are listed below.
1. APM32 Series – Industrial & Automotive Arm Cortex MCUs
1.1 APM32F0 / APM32E0 Series (Cortex-M0+, Low-cost General MCU)
Core sub-series:
APM32F003, APM32F030，APM32F003F4M6 APM32F003F4P6 APM32F003F4U6 APM32F003F6M6 APM32F003F6P6 APM32F003F6U6 APM32F003F6P7 APM32F003F6U7, APM32F035 (APM32F035C8T7 APM32F035K8T7), APM32F051, APM32F051C6T6 APM32F051C6T6-R APM32F051C6T7 APM32F051C6T7-R APM32F051C6U6 APM32F051C6U6-R APM32F051C6U7 APM32F051C6U7-R APM32F051C8T6 APM32F051C8T6-R APM32F051C8T7 APM32F051C8T7-R APM32F051C8U6 APM32F051C8U6-R APM32F051C8U7 APM32F051C8U7-R APM32F051K6T6 APM32F051K6T6-R APM32F051K6T7 APM32F051K6T7-R APM32F051K6U6 APM32F051K6U6-R APM32F051K6U7 APM32F051K6U7-R APM32F051K8T6 APM32F051K8T6-R APM32F051K8T7 APM32F051K8T7-R APM32F051K8U6 APM32F051K8U6-R APM32F051K8U7 APM32F051K8U7-R APM32F051R6T6 APM32F051R6T6-R APM32F051R6T7 APM32F051R6T7-R APM32F051R8T6 APM32F051R8T6-R APM32F051R8T7 APM32F051R8T7-R, APM32F072, APM32F091
APM32E030 (enhanced low-power M0+ variant)
Features: 48MHz max frequency, built-in TSC touch, CAN, high-precision op-amp; for smart home, small industrial controllers, consumer touch panels
1.2 APM32F1 Series (Cortex-M3, Mainstream Industrial MCU)
Core sub-series:
APM32F103 (APM32F103C4 APM32F103C6 APM32F103C8 APM32F103CB APM32F103CC APM32F103R4 APM32F103R6 APM32F103R8 APM32F103RB APM32F103RC APM32F103RD APM32F103RE APM32F103T4 APM32F103T6 APM32F103T8 APM32F103TB APM32F103V8 APM32F103VB APM32F103VC APM32F103VD APM32F103VE APM32F103ZC APM32F103ZD APM32F103ZE APM32F103C8T6 APM32F103C8T6-R APM32F103CBT6 APM32F103CBT6-R APM32F103CCT6 APM32F103CCT6-R APM32F103CCT7 APM32F103CCT7-R APM32F103R8T6 APM32F103R8T6-R APM32F103RBT6 APM32F103RCT6 APM32F103RDT6 APM32F103RCT7 APM32F103T8U6 APM32F103T8U6-R APM32F103T8U7 APM32F103T8U7-R APM32F103TBU6-R APM32F103VBT6 APM32F103VCT6 APM32F103VCT6S APM32F103VCT7 APM32F103VCT7S APM32F103VET6 APM32F103VET7 APM32F103ZET6)
APM32F105, APM32F107 (APM32F105R8T6 APM32F105RBT6 APM32F105RCT6 APM32F105V8T6 APM32F105VBT6 APM32F105VCT6 APM32F107RBT6 APM32F107RCT6 APM32F107VBT6 APM32F107VCT6)
Features: Up to 96MHz, large Flash/SRAM, rich communication peripherals; widely used in PLC, inverters, charging piles
1.3 APM32E1 Series (Cortex-M3, Enhanced High-frequency MCU)
Core sub-series:
APM32E103
Features: Max 120MHz, independent FPU, CRC accelerator, expanded storage; high-end industrial equipment, medical devices
1.4 APM32F4 Series (Cortex-M4F, High-performance DSP MCU)
Core sub-series:
APM32F411, APM32F405, APM32F407, APM32F417, APM32F465
APM32F423, APM32F425, APM32F427 (APM32F411CCT6 APM32F411CCU6 APM32F411CET6 APM32F411CEU6 APM32F411RCT6 APM32F411RET6 APM32F411VCT6 APM32F411VET6 APM32F405RGT6 APM32F405VGT6 APM32F405ZGT6 APM32F407IGH6 APM32F407IGT6 APM32F407RET6 APM32F407RGT6 APM32F407VET6 APM32F407VGT6 APM32F417IGT6 APM32F417VGT6 APM32F417ZGT6 APM32F465CEU6 APM32F465RET6 APM32F465VET6 APM32F423CGT6 APM32F423CGU6 APM32F423RGT6 APM32F423VGT6 APM32F423ZGT6 APM32F425CGT6 APM32F425CGT7 APM32F425CGU6 APM32F425CGU7 APM32F425RGT6 APM32F427CGT6 APM32F427CGT7 APM32F427CGU6 APM32F427CGU7 APM32F427RGT6 APM32F427RGT7 APM32F427VGT6 APM32F427VGT7 APM32F427ZGT6 APM32F427ZGT7)
Features: Single-precision FPU, DSP instruction set, high-speed USB OTG, Ethernet; new energy, servo control, industrial gateway
1.5 APM32A Series (AEC-Q100 Automotive Grade MCUs)
Core sub-series:
APM32A003 (M0+ entry auto MCU)
APM32A072, APM32A091 (M0+ body control auto MCU, integrated TSC touch, CAN)
APM32A103 (Cortex-M3 automotive MCU)
APM32A407 (Cortex-M4F high-performance auto MCU, Ethernet support)
Certification: AEC-Q100 Grade1/Grade2, -40℃~125℃; for car body control, LED lighting, OBC, BMS, instrument cluster
2. G32 Series – New-Generation Dedicated High-performance SoC & MCUs
2.1 G32A Automotive Grade SoC Series
Core sub-series:
G32A1045, G32A1065, G32A1085 (Cortex-M0+ low-cost auto MCU for body electronics)
G32A1445, G32A1465 (high-integration automotive control SoC)
Application: Ultrasonic radar, window control, seat control, automotive small actuators
2.2 G32R Dual-Core Industrial High-performance MCUs (Cortex-M52 with Helium)
Core sub-series:
G32R430, G32R501
Features: Dual-core parallel processing up to 250MHz, IEC61508 SIL2 compliant, large Flash/SRAM; solar inverter, EV charger, high-speed industrial automation
2.3 G32F Dedicated BLDC Motor Control MCUs
Core model:
G32F031
Features: Cortex-M0+ 64MHz, built-in DIV/MULT FOC acceleration unit, multi-channel high-speed ADC; drone motors, fan, pump BLDC control
2.4 G32M Integrated Motor Driver SoC
Core model:
G32M3101
Features: On-chip 40V 3P+3N gate driver, integrated LDO, native FOC algorithm hardware; small fan, household appliance motor one-chip solution
3. GW Series – BLE Wireless Low-power MCUs
Core models:
GW8811 (BLE 4.2)
GW3323 (BLE 5.2 long-range low-power Bluetooth SoC)
Application: Bluetooth sensors, wearable devices, wireless remote control, IoT tags
4. GURC Series – Analog & Mixed-Signal Special Chips
Core model:
GURC01 (sensor signal conditioning analog front-end AFE)
Application: Industrial pressure, temperature, current sensor signal processing
Supplementary General Technical Notes
- Naming Rule Definition
- Standard full part number template: [Series][Model][Suffix][Package][Temperature]
- Example: APM32F103RCT7
- APM32F103: Base model series
- R: Flash capacity variant
- C: LQFP48 package
- T: Industrial temperature grade (-40~105℃)
- Common suffix mark: C=Commercial, I=Industrial, A=Automotive, V=LQFP100, R=LQFP64
- Application Classification Summary
- General industrial control: APM32F0/F1/F4, APM32E0/E1
- Automotive electronics: APM32A, G32A
- BLDC motor dedicated control: APM32F035, G32F031, G32M3101
- High-end dual-core industrial control: G32R series
- Wireless Bluetooth IoT: GW series
- Analog signal conditioning: GURC series
- Development Ecosystem
- All Geehy MCU devices support Geehy IDE, Geehy Programmer, compatible with J-Link, ST-Link universal debuggers, standard SWD/JTAG download interfaces.
- Scope Explanation
- This catalog only covers standard mass-produced off-the-shelf MCU, wireless SoC and analog ICs. Customer customized mask ROM chips are excluded. Each base family has hundreds of complete orderable part numbers distinguished by storage size, GPIO count, package and temperature grade, which cannot be fully enumerated individually.
Pure English Document Version (Copy directly to Word / Markdown file)
Full Catalog of Geehy Semiconductor Chip Product Families
Overview
Geehy Semiconductor Co., Ltd. develops a full portfolio of 32-bit Arm Cortex microcontrollers, automotive-qualified SoCs, dedicated motor control integrated MCUs, dual-core high-performance industrial processors, BLE wireless SoCs and analog front-end signal conditioning chips. The product lineup is divided into four major brand prefixes: APM32, G32, GW and GURC. This list covers all core standard mass-production product families, excluding custom customer-specific mask ICs.
1. APM32 Series – Industrial & Automotive Arm Cortex MCUs
1.1 APM32F0 / APM32E0 (Cortex-M0+ Low-cost General MCUs)
Core representative sub-series:
APM32F003, APM32F030, APM32F035, APM32F051, APM32F072, APM32F091, APM32E030
Key features: Max 48MHz operation frequency, integrated TSC touch controller, CAN bus, high-precision operational amplifiers; target cost-sensitive consumer electronics, small industrial controllers and touch control panels.
1.2 APM32F1 (Cortex-M3 Mainstream Industrial MCUs)
Core representative sub-series:
APM32F103, APM32F105, APM32F107
Key features: Up to 96MHz, IEC61508 SIL3 functional safety certification, abundant communication peripherals including dual CAN and Ethernet variants; widely adopted in PLC, frequency converters and charging equipment.
1.3 APM32E1 (Cortex-M3 Enhanced High-frequency MCUs)
Core representative sub-series:
APM32E103
Key features: 120MHz maximum frequency, built-in hardware FPU and CRC accelerator, expanded Flash and SRAM capacity; for high-end industrial automation and medical devices.
1.4 APM32F4 (Cortex-M4F High-performance DSP MCUs)
Core representative sub-series:
APM32F411, APM32F405, APM32F407, APM32F417, APM32F465, APM32F423, APM32F425, APM32F427
Key features: Single-precision floating-point unit, dedicated DSP instruction set, high-speed USB OTG and integrated Ethernet PHY; suitable for new energy power conversion, servo motor control and industrial gateways.
1.5 APM32A Automotive-Grade MCUs (AEC-Q100 Certified)
Core representative sub-series:
APM32A003, APM32A072, APM32A091, APM32A103, APM32A407
Key features: AEC-Q100 Grade1/Grade2 qualification, wide temperature range -40℃ ~ +125℃, native CAN bus, integrated touch detection; designed for automotive body control, LED headlights, on-board chargers, BMS and instrument clusters.
2. G32 Series – New-Generation Dedicated High-performance SoCs & MCUs
2.1 G32A Automotive Integrated SoCs
Core representative sub-series:
G32A1045, G32A1065, G32A1085, G32A1445, G32A1465
Key features: Cortex-M0+ low-power automotive cores, high integration for vehicle body electronics, ultrasonic radar and small actuator control.
2.2 G32R Dual-Core Industrial MCUs (Arm Cortex-M52 with Helium Vector Extensions)
Core representative sub-series:
G32R430, G32R501
Key features: Dual-core parallel processing up to 250MHz, IEC61508 SIL2 compliance, large on-chip memory; for solar inverters, EV on-board chargers and high-speed industrial control systems.
2.3 G32F BLDC Dedicated Motor Control MCUs
Core representative model:
G32F031
Key features: Cortex-M0+ 64MHz core, hardware FOC acceleration unit, multi-channel high-speed ADC; optimized for drone motors, fans and pump BLDC drive solutions.
2.4 G32M Integrated Motor Driver SoC
Core representative model:
G32M3101
Key features: On-chip 40V 3-phase gate driver and integrated LDO, native hardware FOC algorithm accelerator; single-chip solution for household appliance motors.
3. GW Series – BLE Low-Power Wireless MCUs
Core representative models:
GW8811 (Bluetooth 4.2)
GW3323 (Bluetooth 5.2 long-range low-power SoC)
Key features: Ultra-low sleep current, integrated RF transceiver; for wearable devices, wireless sensors and IoT Bluetooth tags.
4. GURC Series – Analog & Mixed-Signal Front-End Chips
Core representative model:
GURC01
Key features: Dedicated sensor signal conditioning analog front-end (AFE); for industrial temperature, pressure and current sensor signal processing.
General Supplementary Specifications
- Part Number Naming Format
- Standard full ordering part number rule: [Family Prefix][Base Model][Capacity Suffix]-[Package][Temperature Grade]
- Suffix definitions:
- C: Commercial temperature (0~70℃)
- I: Industrial temperature (-40~105℃)
- A: Automotive AEC-Q100 temperature (-40~125℃)
- R/C/V/Z: LQFP package size codes
- Application Market Segmentation
- General industrial automation: APM32F0, APM32F1, APM32E1, APM32F4
- Automotive electronics: APM32A, G32A
- BLDC motor control: APM32F035, G32F031, G32M3101
- High-end dual-core industrial control: G32R series
- Bluetooth IoT wireless products: GW series
- Analog sensor signal processing: GURC series
- Development Tool Support
- All Geehy MCUs are fully compatible with Geehy official IDE, Geehy Programmer, and mainstream debug adapters including J-Link and ST-Link via standard SWD/JTAG interfaces.
- Limitation Statement
- This catalog only includes standard off-the-shelf mass-production semiconductors. Customized mask ROM chips developed for specific customer projects are not listed. Each base model family contains hundreds of complete orderable part numbers differentiated by Flash capacity, SRAM size, pin count, package and temperature grade, which cannot be fully listed individually.
General Questions About Microcontroller Firmware Extraction
-
Is it safe to send payment to MikaTech ?
-
Can Mikatech break ics not listed on this site ?
Different chip manufacturers have different part numbers, but the inner core of the chip can be make with same technology, it would be quite impossible to list all the part numbers where our technology can apply such as MYSON, STK, FEELING, ANALOG, FUJITSU, NOVATEK, LG/HYNDAI.
Also by the advancing of the technology, everyday we gain more and more experience and develope new methods for reverse engineering for different Intergated Circuit parts. Full list of Integrated Circuit part numbers which is within our scope of capability is always getting bigger, please contact us to find out. -
Will my privacy be protected ?
Mikatech Innovative Limited understands the importance of its clients' privacy. At the moment you contact Mikatech, the personal information from you will be put under protection by our management regulations which was developed by our years of practice, Mikatech uses these information to customize its service to you, it will never disclose these information to third party out of any reason.
Every project we did, we will delete all the data, materials, and codes 60days after deliverig the files, it iwll protect us and protect your privacy. -
Is it legal to get service from Mikatech ?
Yes, it is totally legal.
Mikatech deliver its reverse engineering services for educational purposes only, it can be illegal to use above mentioned services in some coutries or regions, please check your local laws. Mikatech does not take any responsibility in relation to the use of above mentioned services that may be considered illegal.
-
Laser Fault Injection and Optical Attacks on MCUs
Laser fault injection is a powerful technique that uses focused light to induce transient faults in semiconductor devices. The MCU lockbit lock can be defeated by a well-aimed laser pulse. The pulse creates a photocurrent that flips a bit in a register or memory. The attacker can target the lock control register. If that register is flipped from "locked" to "unlocked", the MCU grants full access. The read-out of an EEPROM processor then becomes possible. Dump flash and eeprom commands succeed. Decapsulation is required for laser injection because the package must be removed. So decapsulation and code recovery are prerequisite steps. The attacker first decapsulates the chip. They then locate the lock logic via optical inspection. They use a laser microscope to focus the beam. The beam is pulsed with nanosecond precision. The MCU lockbit lock is vulnerable if it is not protected by active shielding. Active shielding can detect the laser spot because the mesh lines are disrupted. But the attacker can aim at a gap in the mesh. Or they can use a laser with a wavelength that penetrates the silicon without affecting the mesh. Infrared lasers can pass through silicon and deposit energy deeper. This is called backside laser injection. The attacker thins the die from the back. Then they shoot the laser from the backside. The front mesh is unaffected. This makes active shielding useless. To counter this, some MCUs have backside sensors. These sensors are doped regions that detect light. They are connected to the tamper response. If light is detected, the MCU erases all data. The read-out of an EEPROM processor is prevented. Dump flash and eeprom is aborted. Copy contents of crypto memory is impossible. The MCU lockbit lock now includes optical sensors. These sensors are sensitive to near-infrared. They can detect even a faint laser beam. The sensor output is processed by an analog comparator. The comparator triggers an interrupt. The interrupt service routine zeroizes the memory. This happens within microseconds. So the attacker gets no data. Laser injection is also used for single-event upset (SEU) testing. But SEU is random. The attacker needs precise targeting. They must know the layout of the die. This requires extensive reverse engineering. Microcontroller reverse engineering teams often create a floorplan. They identify the lock register's location. Then they aim there. But modern MCUs randomize the placement of security-critical registers. They also use redundant registers. The lock is stored in multiple places. To unlock, all must be flipped. That requires multiple laser pulses. The timing between pulses is critical. The MCU lockbit lock can detect multiple faults. It has a fault counter. After a few faults, it permanently locks. This is a brute-force defense. Laser injection is expensive and requires specialized equipment. So it is mainly used by nation-states. The MCU lockbit lock is designed to withstand such attacks. But no lock is invulnerable. The attacker can always use a more powerful laser. Or they can use a pulse that causes a permanent change. That would destroy the chip but might reveal data. However, firmware extraction is the goal. If the chip is destroyed, the data is lost. So the attacker must be careful. In conclusion, laser fault injection is a sophisticated attack on the MCU lockbit lock. It requires decapsulation and precise targeting. Defenses include active shielding, backside sensors, redundant lock registers, and fault counters. These make the read-out of an EEPROM processor, dump flash and eeprom, copy contents, reverse engineering, and firmware extraction extremely difficult.
Years
28
+
|
Countries
110
+
|
Clients
5000
+
|
Projects
60000
+
|
