Dallas / Elan EMC Microcontroller Hack

Elan Microelectronics Corp. is principally engaged in the research, development, manufacture and marketing of integrated circuits (ICs) and microcontrollers. The Company provides five categories of products: consumer ICs, including handwriting identification ICs, electronic education learning aid (ELA) ICs, high-second voice synthesis ICs, music ICs, computer ICs and controller ICs for remote controllers and small home appliances; communications ICs, including Walky talky wafers and other wafers for telephones; microcontrollers, applied for small home appliances, washing machines, air conditioners, communications products and remote controllers; personal computer peripheral ICs, such as touch controllers, keyboard ICs and others, as well as network interface devices (NIDs), including pointing sticks and touch pad modules. The Company distributes its products in Taiwan, Southeast Asia, Northeast Asia, the Americas and Europe.

 

Dallas Semiconductor was acquired by Maxim Integrated. Dallas Semiconductor was founded in 1984 as a designer and manufacturer of semiconductors and chip-based subsystems. Dallas Semiconductor quickly established its innovation and technical leadership in developing a wide variety of high-performance products, including 1-Wire®, iButton®, microcontroller (MCU), timekeeping, thermal management, and communications devices.

 

ELAN Microelectronics clones (13 bit)

ELAN Microelectronics Corp. make a series of PICmicro-like microcontrollers with a 13-bit instruction word.[11] The instructions are mostly compatible with the mid-range 14-bit instruction set, but limited to a 6-bit register address (16 special-purpose registers and 48 bytes of RAM) and a 10-bit (1024 word) program space.

The 10-bit program counter is accessible as R2. Reads access only the low bits, and writes clear the high bits. An exception is the TBL instruction, which modifies the low byte while preserving bits 8 and 9.

The 7 accumulator-immediate instructions are renumbered relative to the 14-bit PICmicro, to fit into 3 opcode bits rather than 4, but they are all there, as well as an additional software interrupt instruction.

There are a few additional miscellaneous instructions, and there are some changes to the terminology (the PICmicro OPTION register is called the CONTrol register; the PICmicro TRIS registers 1–3 are called I/O control registers 5–7), but the equivalents are obvious Silicon Wafer Delayer & SEM Microphoto.

13-bit EM78 instruction set^[12]

12	11	10	9	8	7	6	5	4	3	2	1	0	Mnemonic	C?	Z?	Description
0	0	0	0	0	0	0	opcode						Miscellaneous instructions
0	0	0	0	0	0	0	0	0	0	0	0	0	NOP*			No operation (MOVW 0,W)
0	0	0	0	0	0	0	0	0	0	0	0	1	DAA†	C		Decimal Adjust after Addition
0	0	0	0	0	0	0	0	0	0	0	1	0	CONTW*			Write CONT register (CONT ← W)
0	0	0	0	0	0	0	0	0	0	0	1	1	SLEEP*			Go into standby mode (WDT ← 0, stop clock)
0	0	0	0	0	0	0	0	0	0	1	0	0	CLRWDT*			Restart watchdog timer (WDT ← 0)
0	0	0	0	0	0	0	0	0	f				IOW f*			Copy W to I/O control register (f = 5–7, 11–15)
0	0	0	0	0	0	0	0	1	0	0	0	0	ENI†			Enable interrupts maker together club
0	0	0	0	0	0	0	0	1	0	0	0	1	DISI†			Disable interrupts snaileye
0	0	0	0	0	0	0	0	1	0	0	1	0	RET			Return from subroutine, W unmodified
0	0	0	0	0	0	0	0	1	0	0	1	1	RETI			Return from interrupt; return & enable interrupts
0	0	0	0	0	0	0	0	1	0	1	0	0	CONTR†			Read CONT register (W ← CONT)
0	0	0	0	0	0	0	0	1	f				IOR f†			Copy I/O control register to W (f = 5–7, 11–15)
0	0	0	0	0	0	0	1	0	0	0	0	0	TBL†	C	Z	PCL += W. preserve PC bits 8 & 9
0	0	opcode				d	register						ALU operations same as 12- and 14-bit PIC
0	1	op		bit			register						Bit operations same as 12- and 14-bit PIC
1	0	op	k										Control transfers same as 14-bit PIC
1	1	opcode			8-bit immediate								Operations with W and 8-bit literal: W ← OP(k,W)
1	1	0	op		k								MOV/IOR/AND/XOR, same as 12-bit PIC
1	1	1	0	0	k								RETLW k			W ← k, then return from subroutine
1	1	1	0	1	k								SUBLW k	C	Z	W ← k−W (W ← k+~W+1)reverse engineering
1	1	1	1	0	k								INT k†			Push PC, PC ← k (software interrupt, usually k=1)
1	1	1	1	1	k								ADDLW k	C	Z	W ← k+W
12	11	10	9	8	7	6	5	4	3	2	1	0	Mnemonic	C?	Z?	Description

General Questions About Microcontroller Firmware Extraction

---

• Is it safe to send payment to MikaTech ?

  If MikaTech was a bad company, you could find tons of bad reputations about its service on the internet over the 28 years history

  So, the answer is YES! We are good people.

  Why choose Mikatech, please click here to find out
  

  
  
• Can Mikatech break ics not listed on this site ?

  Different chip manufacturers have different part numbers, but the inner core of the chip can be make with same technology, it would be quite impossible to list all the part numbers where our technology can apply such as MYSON, STK, FEELING, ANALOG, FUJITSU, NOVATEK, LG/HYNDAI.
  
  Also by the advancing of the technology, everyday we gain more and more experience and develope new methods for reverse engineering for different Intergated Circuit parts. Full list of Integrated Circuit part numbers which is within our scope of capability is always getting bigger, please contact us to find out.

• Will my privacy be protected ?

  Mikatech Innovative Limited understands the importance of its clients' privacy. At the moment you contact Mikatech, the personal information from you will be put under protection by our management regulations which was developed by our years of practice, Mikatech uses these information to customize its service to you, it will never disclose these information to third party out of any reason.
  Every project we did, we will delete all the data, materials, and codes 60days after deliverig the files, it iwll protect us and protect your privacy.

• Is it legal to get service from Mikatech ?

  Yes, it is totally legal.
  Mikatech deliver its reverse engineering services for educational purposes only, it can be illegal to use above mentioned services in some coutries or regions, please check your local laws. Mikatech does not take any responsibility in relation to the use of above mentioned services that may be considered illegal.

  
  
• I sent you an email, why there is no answer ?

  • A. Our mail server is temperally broke down, your message has not been delivered to our mailbox even the mail sent successfully message is showed on the screen, please contact us again.
  • B. Our email is recognised as junk mail email by your mail server, so our reply has been rejected by your mail server or it is diverted to your junk mailbox, please remove our account from junkmail list or check your junk mailbox, or use another email account to contact such as gmail.
  • C. Your email is recognised as junk mail email by our mail server, so your email was put to our junk mailbox, please use another email account to contact us again.

• Flash and EEPROM Dumping Techniques for Locked MCUs

  Targeted Flash and EEPROM Dumping Techniques for Cost-Optimized Locked IoT MCUs. Internet of Things (IoT) microcontrollers are engineered to balance ultra-low bill-of-materials cost, minimal energy consumption for battery operation, and baseline embedded security for consumer deployment. This three-way design balance results in hybrid security architectures where the primary mcu lockbit lock mechanism fully disables standard JTAG/SWD debug interfaces but leaves intentional and unintentional residual memory leakage points within peripheral buses and runtime firmware pathways. These leakage points are not full security bypasses, but they enable specialized targeted techniques to dump flash and eeprom memory segments without full lockbit circumvention or invasive chip decapsulation. Understanding these semi-invasive dumping methods is essential for both defensive IoT security engineers and adversarial microcontroller reverse engineering specialists. The most prevalent IoT-focused memory dumping technique relies on asynchronous UART bus sniffing during the MCU’s power-on self-test (POST) sequence. All IoT MCUs transmit diagnostic status data over UART during initialization to validate peripheral functionality and memory integrity before launching application firmware. Even with active mcu lockbit lock, this diagnostic transmission pathway remains enabled to support factory testing and field debugging workflows. Attackers attach high-bandwidth logic analyzers to the device’s UART transmit pin to capture these unencrypted diagnostic streams during boot. Within the streams are segmented fragments of flash memory checksum data and EEPROM configuration values that can be reconstructed into larger memory blocks. A second common technique leverages timing-based side-channel analysis to infer memory contents without direct data transmission access. Variations in power draw and electromagnetic emission patterns during EEPROM and flash read operations reveal individual bit values to calibrated measurement equipment. By recording thousands of runtime memory access cycles, attackers can statistically reconstruct complete memory pages to effectively dump flash and eeprom arrays segment by segment. The fragmented datasets obtained from UART sniffing and timing analysis cannot be used directly as functional firmware binaries due to missing segments and bit ordering inconsistencies. Advanced binary stitching algorithms are required during post-processing microcontroller reverse engineering to reorder fragments, fill missing gaps using checksum metadata, and reconstruct executable firmware images. This stitching process requires detailed knowledge of the target MCU’s memory page layout, boot segment structure, and firmware compression algorithms. Many consumer IoT vendors compress firmware binaries to save flash storage space, adding an additional layer of complexity to dumped data reconstruction. Despite the effectiveness of these semi-invasive dumping methods, the enforced mcu lockbit lock still prevents full internal bus access to hardware-isolated memory zones. Standalone segmented dumping workflows therefore lack the capability to directly copy contents of crypto memory that stores BLE pairing keys, cloud authentication credentials, and secure boot hashes. Crypto memory zones are electrically isolated from the UART bus and timing measurement domains, rendering side-channel sniffing ineffective against these high-security partitions. To retrieve cryptographic material after successful user memory dumping, attackers must initiate follow-up decapsulation and code recovery operations targeting only the small crypto memory die region. This targeted decapsulation is far less costly than full die processing, as prior dumped memory data reveals the exact physical location of crypto circuitry on the silicon surface. Defensive IoT security teams have developed specific mitigation strategies to block semi-invasive memory dumping on locked devices. The most impactful control involves disabling all UART diagnostic transmission pathways in production firmware builds, removing the primary vector for boot-time data sniffing. Developers can also randomize memory access timing to eliminate consistent electromagnetic patterns that enable timing side-channel data inference. Dynamic memory page remapping during runtime disrupts fixed address sequencing used by stitching algorithms to reconstruct fragmented dumps. Strengthening mcu lockbit lock partitioning to disable residual factory test modes eliminates hidden peripheral pathways that leak memory fragments. Restricting the read-out of an EEPROM processor debug register set prevents attackers from retrieving metadata that aids memory segment reconstruction. Firmware encryption with device-unique keys ensures that even if flash data is dumped successfully, the binary remains unexecutable and unintelligible without the isolated crypto key. Regular OTA security updates can patch runtime firmware loopholes that expose temporary memory access pathways during specialized operational modes. Security testing for IoT devices must include side-channel leakage assessment to identify unobvious memory emission patterns before mass deployment. By implementing this layered set of countermeasures, manufacturers can neutralize the most common semi-invasive dumping techniques and prevent unauthorized end-to-end firmware extraction on cost-optimized locked IoT MCU fleets.