Nuvoton/Winbond MCU Clone

Nuvoton Technology Corporation is a Taiwan-based semiconductor company established in 2008. It spun off from Winbond Electronics Corp. as a wholly owned subsidiary.

Winbond Electronics Corporation is a Taiwan-based corporation founded in 1987 that produces semiconductors and several types of integrated circuits, most notably Dynamic RAM, Static RAM, microcontrollers, and personal computer ICs. Winbond is currently the largest brand name integrated circuit supplier in Taiwan, and one of the biggest suppliers of semiconductor solutions worldwide.

Computer IC, Consumer Electronics IC and Logic Product Foundry of Winbond product lines have been spun off as Nuvoton Technology Corporation on July 1, 2008.

 

Nuvoton's main product lines are Microcontroller Application IC, Audio Application IC, Cloud & Computing IC, and foundry service.[1] Its consumer electronics ICs focus mainly on microcontroller ICs and voice and speech ICs. Its ARM Cortex-M0 microcontroller IC NuMicro Family is well known for its density and functionality. Its computer IC product line designs and manufactures the key chips for PC motherboards, notebook computers and servers, offering complete Super I/O solutions, clock generators, hardware monitoring IC, power management IC, TPM security IC, notebook keyboard controller, and mobile platform embedded control (EC).

Nuvoton operates a six-inch wafer fab which provides foundry service for the company's own branded IC products, as well as for selected manufacturing partners.

Type Corporation
Industry Semiconductor
Founded 2008
Headquarters Hsinchu Science and Industrial Park, Taiwan
Key people Arthur Yu-Cheng Chiao, Chairman
Robert Hsu, President
Products Microcontroller Application IC, Audio Application IC, Cloud & Computing IC, Foundry Service
Subsidiaries Nuvoton Electronics SEM FIB Technology (H.K.) Limited
Nuvoton Electronics Technology (Shanghai) Limited
Nuvoton Electronics Technology (Shenzhen) Limited
Nuvoton Technology Corp. America
Nuvoton Technology Israel Ltd.
Website Nuvoton Technology Corp.

General Questions About Microcontroller Firmware Extraction

---

• Is it safe to send payment to MikaTech ?

  If MikaTech was a bad company, you could find tons of bad reputations about its service on the internet over the 28 years history

  So, the answer is YES! We are good people.

  Why choose Mikatech, please click here to find out
  

  
  
• Can Mikatech break ics not listed on this site ?

  Different chip manufacturers have different part numbers, but the inner core of the chip can be make with same technology, it would be quite impossible to list all the part numbers where our technology can apply such as MYSON, STK, FEELING, ANALOG, FUJITSU, NOVATEK, LG/HYNDAI.
  
  Also by the advancing of the technology, everyday we gain more and more experience and develope new methods for reverse engineering for different Intergated Circuit parts. Full list of Integrated Circuit part numbers which is within our scope of capability is always getting bigger, please contact us to find out.

• Will my privacy be protected ?

  Mikatech Innovative Limited understands the importance of its clients' privacy. At the moment you contact Mikatech, the personal information from you will be put under protection by our management regulations which was developed by our years of practice, Mikatech uses these information to customize its service to you, it will never disclose these information to third party out of any reason.
  Every project we did, we will delete all the data, materials, and codes 60days after deliverig the files, it iwll protect us and protect your privacy.

• Is it legal to get service from Mikatech ?

  Yes, it is totally legal.
  Mikatech deliver its reverse engineering services for educational purposes only, it can be illegal to use above mentioned services in some coutries or regions, please check your local laws. Mikatech does not take any responsibility in relation to the use of above mentioned services that may be considered illegal.

  
  
• I sent you an email, why there is no answer ?

  • A. Our mail server is temperally broke down, your message has not been delivered to our mailbox even the mail sent successfully message is showed on the screen, please contact us again.
  • B. Our email is recognised as junk mail email by your mail server, so our reply has been rejected by your mail server or it is diverted to your junk mailbox, please remove our account from junkmail list or check your junk mailbox, or use another email account to contact such as gmail.
  • C. Your email is recognised as junk mail email by our mail server, so your email was put to our junk mailbox, please use another email account to contact us again.

• The Role of Secure Boot in Strengthening the MCU integrity

  Secure boot establishes a chain of trust from the moment the MCU powers up. The MCU lockbit lock is the first link in this chain. It verifies the authenticity and integrity of the first-stage bootloader. If the verification fails, the MCU halts. This prevents the execution of malicious firmware. An attacker who attempts to dump flash and eeprom may be thwarted because the bootloader itself is locked. The read-out of an EEPROM processor can only occur after authentication. Secure boot uses cryptographic signatures. The MCU has a public key embedded in OTP. The bootloader signature is checked against this key. If the signature matches, execution continues. The lockbit lock ensures that the OTP key cannot be modified. It is physically immutable. Decapsulation and code recovery might reveal the OTP bits, but they cannot change them. The attacker could try to copy contents of crypto memory that holds the key, but OTP is not copyable. Microcontroller reverse engineering can read the public key, but that is harmless. The private key is held by the manufacturer. Firmware extraction is allowed only after secure boot passes. However, if the attacker can bypass secure boot by glitching the signature check, they can load arbitrary code. That code could then dump the flash. So secure boot must be resistant to fault injection. Many MCUs implement redundant signature checks. They also use delayed execution to allow time for glitch detection. The MCU lockbit is reinforced by hardware-based hash engines. These engines compute the signature quickly and deterministically. Timing attacks on the signature verification are possible. If the verification exits early, the attacker can guess the key. But the key is public, so timing doesn't help. The security relies on the private key being unknown. The attacker cannot forge signatures. So they cannot replace the bootloader. They can only try to disrupt the verification. Fault injection is the main threat. To mitigate, some MCUs check the signature twice. They also monitor the supply voltage and clock during verification. If anomalies are detected, they reset. The reset clears any attempt to dump flash and eeprom. The read-out of an EEPROM processor is also protected because the EEPROM is only accessible after secure boot. In some designs, the EEPROM contains calibration data that is not sensitive. But the main firmware is in flash. Secure boot ensures that only signed firmware runs. This prevents ransomware like LockBit from injecting malicious code. LockBit typically targets Windows, but embedded LockBit variants exist. They might try to replace the firmware with a ransom-seeking version. Secure boot stops that. However, the attacker could still exploit vulnerabilities in the bootloader itself. The bootloader is a small piece of code. It may have buffer overflows. If the attacker can exploit one, they can gain control before the signature check. Then they can disable the lock. This is a software attack. The MCU lockbit must also protect the bootloader from being overwritten. Many MCUs have a protected boot sector. That sector is write-protected by a hardware lock. The lockbit controls that protection. The attacker might try to glitch the write-protect fuse. If successful, they can replace the bootloader with a malicious one. That malicious bootloader would then dump the flash. Decapsulation and code recovery are not needed. So the MCU lockbit must include multiple fuses. Some fuses control bootloader write protection. Others control debug access. They are separate. The attacker must break all of them. This layered approach increases difficulty. Secure boot also supports remote attestation. The MCU can report its boot state to a remote server. If the attestation fails, the server can revoke credentials. This is useful against firmware extraction because the extracted firmware cannot be attested. The attacker cannot spoof the attestation without the private key. That key is inside the MCU. The read-out of an EEPROM processor cannot retrieve it. Dump flash and eeprom will not reveal it because it is in dedicated secure storage. Decapsulation and code recovery might find it, but then the chip is destroyed. Copy contents of crypto memory of the key is impossible if it is stored in a secure enclave. Microcontroller reverse engineering of secure enclaves is extremely difficult. Firmware extraction from enclaves is also impossible because the enclave has its own lock. So secure boot, combined with hardware root of trust, creates a formidable barrier. The MCU lockbit is not just a single bit; it is a system of checks. In conclusion, secure boot fortifies the MCU lockbit by ensuring only authenticated code runs. It resists dump flash and eeprom attempts, read-out of an EEPROM processor, decapsulation, copy contents, reverse engineering, and firmware extraction, provided the hardware and fault protections are adequate.