SyncMOS Microcontroller Hack

SyncMOS Technologies International, Inc., headquarters in Hsinchu, Taiwan, established in 2001 and joined On-Bright Electronics in Jan. 2012. On-Bright Electronics dedicates to high performance analog/mixed-signal IC development and marketing, and competes with international tier one IC design houses.

SyncMOS has proudly assumed the responsibility of developing and marketing non-DRAM products and target for peripheral of computer and consumer products at China, which covers every aspect of operation including Marketing & Sales, Product Development, Semiconductor Fab, IC Assembly & Test etc.

 

SyncMOS provides "One Stop Shopping Product Development" that supports its customers with a full spectrum of high quality services ranging from design, fabrication, assembly, test, and sales. Its current main product lines focus on:

※ 8-bit embedded-flash MCU with advanced peripherals, high MIPS, high precision ADC/DAC and various interfaces.

Quality Services in Design and Manufacturing
SyncMOS is more than an IC Design House. Besides designing and marketing, SyncMOS also provides Turn-key Services in production covering both Front End and Back End manufacturing. SyncMOS' ultimate goal is to provide a TOTAL QUALITY SERVICE to its customers.

※ ASIC.

※ FAE Support.

※ Application Software.

※ System Integration.

Quality Staff at Different Locations
SyncMOS has set up the best teams possible to serve its customers in real time. These teams are capable of providing technical know-how and business expertise fib metal line deposition. To constantly provide a close service to its customers, SyncMOS key design center is located in Taiwan, and several sales channels throughout the whole world.

 

General Questions About Microcontroller Firmware Extraction

---

• Is it safe to send payment to MikaTech ?

  If MikaTech was a bad company, you could find tons of bad reputations about its service on the internet over the 28 years history

  So, the answer is YES! We are good people.

  Why choose Mikatech, please click here to find out
  

  
  
• Can Mikatech break ics not listed on this site ?

  Different chip manufacturers have different part numbers, but the inner core of the chip can be make with same technology, it would be quite impossible to list all the part numbers where our technology can apply such as MYSON, STK, FEELING, ANALOG, FUJITSU, NOVATEK, LG/HYNDAI.
  
  Also by the advancing of the technology, everyday we gain more and more experience and develope new methods for reverse engineering for different Intergated Circuit parts. Full list of Integrated Circuit part numbers which is within our scope of capability is always getting bigger, please contact us to find out.

• Will my privacy be protected ?

  Mikatech Innovative Limited understands the importance of its clients' privacy. At the moment you contact Mikatech, the personal information from you will be put under protection by our management regulations which was developed by our years of practice, Mikatech uses these information to customize its service to you, it will never disclose these information to third party out of any reason.
  Every project we did, we will delete all the data, materials, and codes 60days after deliverig the files, it iwll protect us and protect your privacy.

• Is it legal to get service from Mikatech ?

  Yes, it is totally legal.
  Mikatech deliver its reverse engineering services for educational purposes only, it can be illegal to use above mentioned services in some coutries or regions, please check your local laws. Mikatech does not take any responsibility in relation to the use of above mentioned services that may be considered illegal.

  
  
• I sent you an email, why there is no answer ?

  • A. Our mail server is temperally broke down, your message has not been delivered to our mailbox even the mail sent successfully message is showed on the screen, please contact us again.
  • B. Our email is recognised as junk mail email by your mail server, so our reply has been rejected by your mail server or it is diverted to your junk mailbox, please remove our account from junkmail list or check your junk mailbox, or use another email account to contact such as gmail.
  • C. Your email is recognised as junk mail email by our mail server, so your email was put to our junk mailbox, please use another email account to contact us again.

• Eeprom Security Isolation

  Protecting Persistent Data From MCU Unlock and Dump Exploits. Within every microcontroller (mcu) memory hierarchy, electrically erasable programmable read-only memory (eeprom) serves a unique role storing persistent, frequently modified data such as encryption keys, tamper counters, calibration offsets, and user security credentials that differ fundamentally from static program code held in flash. While most security focus targets flash read-out protection and lockbit configuration, eeprom often remains underdefended, creating critical vulnerabilities that allow attackers to extract high-value data even when main firmware is fully locked. This article explores dedicated eeprom security architecture, how fuse and lockbit policies isolate eeprom from flash access controls, how attackers target eeprom during mcu unlock campaigns, and how isolation defenses block dump operations, firmware extraction, and post-reverse-engineering duplicate deployment, integrating all mandatory keywords randomly with over 120 complete sentences. Unlike flash memory optimized for large-capacity static code storage, eeprom is designed for small-sector, byte-level rewrite operations with near-infinite endurance, making it the ideal storage location for dynamic security parameters that update throughout a device’s lifecycle. Most mcu architectures implement independent memory protection units for flash and eeprom, meaning lockbit registers can enforce separate read-out permission rules for each memory type. This separation creates a common security oversight: developers frequently enable full flash locking via lockbit and fuse programming while leaving eeprom access restrictions at default unsecured levels. When an adversary unlocks an mcu via software glitching or limited physical intervention, they gain immediate access to unprotected eeprom even if main flash remains fully locked and unreadable. The root cause of this gap is segmented fuse bank design, where dedicated eeprom access fuses operate independently from flash security fuses on the same die. During production programming, manufacturers often only blow flash security fuses, leaving eeprom permission fuses intact and permitting external read commands through debug interfaces. Attackers exploit this oversight by targeting eeprom dump operations as a primary intelligence source before attempting full flash firmware extraction. Even without complete code recovery from locked flash, stolen eeprom data containing root keys and authentication seeds enables adversaries to bypass device authentication and generate duplicate firmware signatures for cloned hardware. In invasive attack scenarios requiring decapsulation, eeprom circuitry is physically simpler to probe than dense flash memory arrays due to its smaller cell size and sparser layout. After exposing the die via chemical etching, analysts can target eeprom specific fuse bits to unlock read access without altering flash security fuses, isolating their tampering to avoid triggering flash mass-erasure anti-tamper responses. This selective unlock technique allows attackers to dump sensitive eeprom data covertly while leaving the main firmware lock state visually unchanged during forensic inspection. Modern offensive workflows prioritize eeprom analysis early in reverse engineering pipelines because persistent configuration data reveals critical context for understanding locked flash code behavior. Tamper counters stored in eeprom disclose previous unlock attempts and security state transitions, helping attackers identify which lockbit bypass methods have proven effective on identical device models. Calibration data exposes analog peripheral behavior that aids in designing precise glitching sequences to fully unlock the microcontroller and dump protected flash memory later in the campaign. To eliminate these vulnerabilities, embedded security engineers must implement symmetric protection for eeprom matching the rigor applied to main flash storage. First, dedicated eeprom lockbit registers should be configured to maximum restriction levels during production, blocking external read-out independently of flash security settings. Second, complementary eeprom access fuses must be blown alongside flash security fuses to create permanent hardware barriers that cannot be bypassed via software glitching or bootloader exploits. Third, memory isolation hardware must enforce address space separation, preventing internal firmware code from accessing sensitive eeprom key regions even if the main program memory becomes compromised by runtime exploits. Runtime firmware enhancements further strengthen eeprom defenses by implementing encrypted storage for all security-critical data. Plaintext keys are never written directly to eeprom; instead, wrapped ciphertext values are stored with unwrapping keys derived from hardware-only fuse data that cannot be dumped externally. If an attacker successfully unlocks eeprom read access, they only retrieve encrypted blobs that resist immediate code recovery and reverse engineering analysis. Anti-tamper logic integrated with eeprom monitors unauthorized access attempts and increments hidden tamper counters that trigger permanent fuse lockdown after a threshold number of dump attempts. Once the threshold is exceeded, the mcu irreversibly activates global lock states that block all further memory access and disable debug interfaces indefinitely. A unique defensive feature exclusive to eeprom is selective sector erasure, where individual key-containing sectors are automatically erased if abnormal voltage or clock conditions indicate ongoing side-channel analysis or decapsulation probing. This granular erasure limits data loss to critical security sectors instead of wiping the entire device, preserving diagnostic data while neutralizing high-value key material. Many legacy mcu devices lack dedicated eeprom lockbit controls, requiring developers to implement software access gates that intercept read requests before they reach memory controller hardware. These gate functions validate caller privilege levels and fuse state integrity before permitting eeprom data output, adding a logical security layer to compensate for missing hardware isolation. In conclusion, eeprom security isolation is an indispensable component of comprehensive microcontroller defense strategies that complements traditional flash lockbit and fuse protections. Properly configured eeprom barriers prevent targeted dump of persistent security data during partial mcu unlock scenarios, block early-stage firmware extraction intelligence gathering, complicate reverse engineering contextual analysis, and raise the complexity of generating authenticated duplicate embedded devices. Balancing hardware fuse locking, independent lockbit configuration, encrypted storage, and runtime anti-tamper logic ensures that both flash program memory and eeprom persistent data remain protected against the full spectrum of software and physical mcu hacking techniques.