ICT/GOULD Chip Reverse Engineering

Integrated Circuit Technology Corp. (ICT), with headquarters in San Jose, CA. designs, manufactures and markets user-programmable integrated circuits and offers licensable technology and IP for embedded Non-Volatile Memory (NVM) Blocks and embedded Programmability-On-Chip (POC) re-configurable logic blocks for the emerging System-On-Chip (SOC) market. ICT products, which include PEEL Devices, (including zero power, low voltage), PEEL Arrays and PLACE Development Software offers the most flexible PLD solutions for lower pin-count applications. ICT products are used extensively in the telecommunications, industrial control and computer markets, to reduce development time, improve performance, reduce power consumption and customize features. ICT's NVM technology and IP cores have been licensed by semiconductor manufacturers and will be used within SOC devices to keep information for system configurations, status, code or data storage after power is removed. ICT's POC technology and IP provide re-configurable logic capability to ASIC devices to enable feature differentiation, flexible, interfacing and repair.

General Questions About Microcontroller Firmware Extraction

• Is it safe to send payment to MikaTech ?

  If MikaTech was a bad company, you could find tons of bad reputations about its service on the internet over the 28 years history

  So, the answer is YES! We are good people.

  Why choose Mikatech, please click here to find out
  

  
  
• Can Mikatech break ics not listed on this site ?

  Different chip manufacturers have different part numbers, but the inner core of the chip can be make with same technology, it would be quite impossible to list all the part numbers where our technology can apply such as MYSON, STK, FEELING, ANALOG, FUJITSU, NOVATEK, LG/HYNDAI.
  
  Also by the advancing of the technology, everyday we gain more and more experience and develope new methods for reverse engineering for different Intergated Circuit parts. Full list of Integrated Circuit part numbers which is within our scope of capability is always getting bigger, please contact us to find out.

• Will my privacy be protected ?

  Mikatech Innovative Limited understands the importance of its clients' privacy. At the moment you contact Mikatech, the personal information from you will be put under protection by our management regulations which was developed by our years of practice, Mikatech uses these information to customize its service to you, it will never disclose these information to third party out of any reason.
  Every project we did, we will delete all the data, materials, and codes 60days after deliverig the files, it iwll protect us and protect your privacy.

• Is it legal to get service from Mikatech ?

  Yes, it is totally legal.
  Mikatech deliver its reverse engineering services for educational purposes only, it can be illegal to use above mentioned services in some coutries or regions, please check your local laws. Mikatech does not take any responsibility in relation to the use of above mentioned services that may be considered illegal.

  
  
• I sent you an email, why there is no answer ?

  • A. Our mail server is temperally broke down, your message has not been delivered to our mailbox even the mail sent successfully message is showed on the screen, please contact us again.
  • B. Our email is recognised as junk mail email by your mail server, so our reply has been rejected by your mail server or it is diverted to your junk mailbox, please remove our account from junkmail list or check your junk mailbox, or use another email account to contact such as gmail.
  • C. Your email is recognised as junk mail email by our mail server, so your email was put to our junk mailbox, please use another email account to contact us again.

• Bypassing Logical MCU Lockbit Barriers

  Non-Invasive Side-Channel Attack Pathways Bypassing Logical MCU Lockbit Barriers. Electromagnetic emanation, power consumption, and runtime timing side-channel attacks represent a powerful class of completely non-invasive techniques that bypass logical mcu lockbit lock restrictions without any physical modification, packaging removal, or die contact with the targeted microcontroller. Unlike all invasive and semi-invasive attack methods, side-channel analysis relies solely on measuring unintentional physical emissions generated by the MCU during normal operational execution to infer protected data values indirectly. The core principle driving these attacks is that every computational and memory access operation within the MCU produces unique power draw patterns and electromagnetic field signatures that correlate directly with processed binary data. Active mcu lockbit lock configurations only block logical access pathways via debug and programming interfaces; they have no hardware mechanism to suppress physical emission leakage from internal memory transactions. This fundamental security gap enables adversaries to perform indirect read-out of an EEPROM processor stored calibration values, runtime variables, and persistent configuration data without establishing any formal debug connection to the locked device. The EEPROM processor generates distinct power signatures during read and write operations that differ based on the bit patterns being accessed within the memory array. High-sensitivity current sensors placed in series with the MCU power supply capture these minute signature variations at nanosecond temporal resolution. Over thousands of repeated identical memory access cycles, statistical signal processing filters isolate unique traces corresponding to individual EEPROM bit values. After trace aggregation and pattern matching, attackers reconstruct complete stored values that the lockbit logic formally blocks from external logical access. Scaled to the full memory array, this process allows threat actors to effectively dump flash and eeprom entire non-volatile memory contents through purely passive measurement. Flash memory access produces even more distinguishable electromagnetic emissions than EEPROM due to its higher charge density programming mechanism. Near-field magnetic probes positioned millimeters above the MCU package capture these high-frequency emissions to map complete flash memory page contents without electrical contact. The resulting full memory dumps eliminate the primary barrier to rapid, low-cost microcontroller reverse engineering of locked consumer and industrial embedded devices. Analysts can reconstruct complete firmware binaries from side-channel dumps using standard binary analysis tools without specialized laboratory decapsulation equipment. A defining characteristic of side-channel attacks is their non-destructive nature, which eliminates the need for immediate, costly decapsulation and code recovery workflows during initial device compromise. The original device packaging, silicon die, and lockbit OTP cells remain entirely unaltered after data extraction, leaving no forensic evidence of prior memory access. This makes side-channel attacks extremely difficult to detect during post-compromise device auditing and supply chain integrity verification. Despite their formidable capabilities, standard side-channel attacks possess well-defined limitations that prevent direct extraction of the most sensitive device data. Passive emission measurement cannot resolve the high-density signal patterns generated within hardware-isolated crypto memory partitions. As a result, attackers cannot directly copy contents of crypto memory using only basic power and electromagnetic side-channel analysis. The secure memory controller suppresses emission differentiation during key processing operations to prevent direct bit inference from external traces. However, aggregated side-channel data from user memory domains provides critical metadata that drastically accelerates subsequent invasive analysis workflows. Leaked memory layout information, firmware compression parameters, and lockbit state transition timing derived from side-channel traces streamline targeted decapsulation and code recovery operations if physical access is later obtained. This hybrid attack chain combining non-invasive tracing and invasive probing delivers the highest success rate for complete end-to-end firmware extraction in modern adversarial campaigns. Defensive embedded security designers implement multiple layers of countermeasures to mitigate side-channel leakage alongside standard mcu lockbit lock protection. Dynamic voltage and frequency scrambling randomizes power consumption patterns during memory access to eliminate repeatable signature traces. Differential routing balancing equalizes electromagnetic field emission across the die to remove data-dependent signal variation. Masked cryptographic algorithms normalize computation power draw during key processing to hide crypto memory operation signatures. Active noise injection superimposes artificial electromagnetic noise over native device emissions to corrupt external trace measurement accuracy. Partitioned memory access timing randomization breaks repeatable cycle sequencing required for statistical trace aggregation. When combined with robust lockbit partitioning and tamper detection circuitry, these countermeasures significantly increase the signal processing complexity required for successful side-channel data inference. Understanding the full scope of non-invasive side-channel vulnerabilities enables security engineers to build holistic embedded defense ecosystems that protect against both logical lockbit bypass and physical emission leakage simultaneously.