MCU reverse engineering

Dallas MCU Crack

General Questions About Microcontroller Firmware Extraction

---

• Is it safe to send payment to MikaTech ?

  If MikaTech was a bad company, you could find tons of bad reputations about its service on the internet over the 28 years history

  So, the answer is YES! We are good people.

  Why choose Mikatech, please click here to find out
  

  
  
• Can Mikatech break ics not listed on this site ?

  Different chip manufacturers have different part numbers, but the inner core of the chip can be make with same technology, it would be quite impossible to list all the part numbers where our technology can apply such as MYSON, STK, FEELING, ANALOG, FUJITSU, NOVATEK, LG/HYNDAI.
  
  Also by the advancing of the technology, everyday we gain more and more experience and develope new methods for reverse engineering for different Intergated Circuit parts. Full list of Integrated Circuit part numbers which is within our scope of capability is always getting bigger, please contact us to find out.

• Will my privacy be protected ?

  Mikatech Innovative Limited understands the importance of its clients' privacy. At the moment you contact Mikatech, the personal information from you will be put under protection by our management regulations which was developed by our years of practice, Mikatech uses these information to customize its service to you, it will never disclose these information to third party out of any reason.
  Every project we did, we will delete all the data, materials, and codes 60days after deliverig the files, it iwll protect us and protect your privacy.

• Is it legal to get service from Mikatech ?

  Yes, it is totally legal.
  Mikatech deliver its reverse engineering services for educational purposes only, it can be illegal to use above mentioned services in some coutries or regions, please check your local laws. Mikatech does not take any responsibility in relation to the use of above mentioned services that may be considered illegal.

  
  
• Timing Attacks and the MCU Lockbit Lock

  Timing attacks exploit the variation in execution time of cryptographic or security-critical operations. The MCU lockbit lock often relies on password comparisons. If the comparison returns early upon a mismatch, the attacker can measure the time. This reveals the correct password byte by byte. The read-out of an EEPROM processor may be password-protected. The attacker can use timing to guess the password. Once guessed, they can dump flash and eeprom. Decapsulation and code recovery are not needed. Copy contents of crypto memory becomes possible. Microcontroller reverse engineering can then proceed. Firmware extraction is the final goal. The MCU lockbit lock is defeated by a simple timing side-channel. To prevent this, the comparison must be constant-time. It must take the same number of cycles regardless of the password. Many MCUs implement constant-time compare in hardware. The hardware compares all bytes simultaneously. This eliminates timing differences. However, other operations may have timing variations. For example, memory access times can depend on the address. If the attacker can cause cache misses, they can infer data. Some MCUs have instruction caches. The cache behavior leaks information. The MCU lockbit lock can be bypassed by exploiting cache timing. The attacker can monitor the execution time of a function. If the function accesses a secret table, the time reveals the index. This is a classic attack. The read-out of an EEPROM processor might be affected by cache. Dump flash and eeprom might have variable latency. The attacker can use that. To counter timing attacks, MCUs use deterministic memory access. They disable caches during security-sensitive operations. They also use random delays. The random delays add noise. But they do not eliminate the leak. The attacker can average out the noise. So constant-time is the only robust solution. The MCU lockbit lock should be implemented in hardware. Hardware does not have timing variations due to microarchitecture. It is deterministic. The lock decision should be a single combinatorial path. That path has fixed delay. The attacker cannot extract information. Additionally, the MCU can use blinding. Blinding randomizes the input. This makes timing attacks harder. For example, the password can be XORed with a random value. The comparison is done on the blinded values. The random value changes each attempt. The attacker cannot correlate time with password. The MCU lockbit lock also includes a maximum number of attempts. After a few failures, the lock permanently blocks. This prevents iterative timing attacks. The read-out of an EEPROM processor is then disabled. Dump flash and eeprom is disabled. Copy contents of crypto memory is disabled. Microcontroller reverse engineering is stopped. Firmware extraction is impossible. In conclusion, timing attacks are a subtle but effective method to break the MCU lockbit lock. Defenses include constant-time comparisons, cache management, random delays, blinding, and attempt limits. These ensure that read-out, dump, decapsulation, copy, reverse engineering, and extraction do not benefit from timing leakage.