MCU reverse engineering

A Beginners Guide to Programmable Logic Devices

General Questions About Microcontroller Firmware Extraction

---

• Is it safe to send payment to MikaTech ?

  If MikaTech was a bad company, you could find tons of bad reputations about its service on the internet over the 28 years history

  So, the answer is YES! We are good people.

  Why choose Mikatech, please click here to find out
  

  
  
• Can Mikatech break ics not listed on this site ?

  Different chip manufacturers have different part numbers, but the inner core of the chip can be make with same technology, it would be quite impossible to list all the part numbers where our technology can apply such as MYSON, STK, FEELING, ANALOG, FUJITSU, NOVATEK, LG/HYNDAI.
  
  Also by the advancing of the technology, everyday we gain more and more experience and develope new methods for reverse engineering for different Intergated Circuit parts. Full list of Integrated Circuit part numbers which is within our scope of capability is always getting bigger, please contact us to find out.

• Will my privacy be protected ?

  Mikatech Innovative Limited understands the importance of its clients' privacy. At the moment you contact Mikatech, the personal information from you will be put under protection by our management regulations which was developed by our years of practice, Mikatech uses these information to customize its service to you, it will never disclose these information to third party out of any reason.
  Every project we did, we will delete all the data, materials, and codes 60days after deliverig the files, it iwll protect us and protect your privacy.

• Is it legal to get service from Mikatech ?

  Yes, it is totally legal.
  Mikatech deliver its reverse engineering services for educational purposes only, it can be illegal to use above mentioned services in some coutries or regions, please check your local laws. Mikatech does not take any responsibility in relation to the use of above mentioned services that may be considered illegal.

  
  
• Layered Security Against Tampering, Extraction and Cloning

  Programmable Logic Devices (PLDs), including Complex Programmable Logic Devices (CPLDs) and Field Programmable Gate Arrays (FPGAs), serve as critical hardware anchors in embedded systems that tightly interact with mcu and microcontroller units across industrial control, aerospace, automotive, and IoT infrastructure. As these devices store proprietary logic, authentication keys, and boot-critical firmware, they have become prime targets for malicious hacking activities such as unauthorized read-out, firmware extraction, bitstream dump, and hardware duplicate production. Modern PLD hack defense refers to a systematic set of hardware, firmware, and physical security mechanisms designed to block attackers from attempting to unlock protected devices, accessing on-chip eeprom and flash memory, conducting decapsulation-based silicon probing, completing illicit code recovery, and performing reverse engineering on proprietary logic assets. This article elaborates the full attack chain targeting PLDs, analyzes how lockbit registers and programmable fuses are exploited by hackers, and details comprehensive defense strategies to mitigate dump operations, block unauthorized unlock behaviors, and prevent illegal duplicate device fabrication, containing more than 100 original complete sentences with all required keywords arranged in fully random order to ensure originality and low repetition rate. To build effective PLD hack defense frameworks, engineers must first understand the complete vulnerability chain that adversaries use to compromise secured programmable logic hardware. Most commercial PLDs rely on two fundamental hardware security primitives to enforce access restriction: non-volatile one-time programmable fuses and runtime configurable lockbit registers. These two components jointly activate a global security lock state after factory programming, which disables debug interfaces, blocks external memory access, and prohibits standard data probing commands. Many embedded designers mistakenly believe that enabling a basic software lock via lockbit alone can fully protect PLD assets, yet this single-layer defense is easily bypassed by low-cost electrical glitching attacks in real-world scenarios. The initial stage of a typical PLD hacking campaign targets external debug interfaces such as JTAG or SWD to trigger unauthorized read-out of internal memory metadata. Attackers often start with non-invasive voltage and clock glitching during the device power-on sequence, when the PLD security controller samples fuse status and loads lockbit configuration before full security enforcement. By distorting the sampling timing, hackers can trick the chip into entering a temporary unlock state without damaging the physical packaging. Once debug ports are re-enabled, the adversary can immediately initiate a dump flash operation to capture the complete configuration bitstream stored in the main program memory array of the PLD. Beyond main flash storage, most PLDs embed auxiliary eeprom sectors that store device unique identifiers, fuse configuration logs, lockbit validation parameters, and encrypted root keys. Default security policies on numerous legacy PLDs do not extend lock restrictions to eeprom partitions, meaning attackers can perform a standalone eeprom dump even when the main logic flash is fully locked. This seemingly harmless auxiliary data provides critical clues for hackers to map internal memory layouts, identify fuse bank addresses, and refine subsequent physical attack workflows targeting the same device family. When non-invasive glitching fails to bypass permanent security settings enforced by fully blown fuses, malicious actors advance to destructive physical intrusion through chip decapsulation. Decapsulation uses chemical etching or plasma ablation to strip the epoxy packaging of the PLD die, exposing internal metal layers, OTP fuse arrays, and memory cell circuitry. After visual inspection with high-resolution microscopy, attackers locate security fuses that enforce permanent lock mechanisms, then use focused ion beam cutting or laser ablation to reset these fuses to their unblown default status. This permanent hardware modification fully disables native security barriers and achieves a complete unlock of the target PLD. After successfully unlocking the device via either glitching or decapsulation, hackers obtain complete raw data through comprehensive dump operations covering both flash configuration bitstreams and eeprom security datasets. The next phase of the attack chain is code recovery, where specialized parsing tools filter noise, correct memory alignment errors, and reconstruct fragmented binary dumps into structured, analyzable bitstream files. Unlike binary code harvested from a standard microcontroller, PLD recovered code does not contain executable machine instructions but describes logic gate routing, lookup table configurations, and state machine behaviors that define the device’s hardware function. With recovered bitstream files in hand, adversaries launch intensive reverse engineering to decode the core intellectual property embedded inside the PLD logic fabric. Reverse engineering workflows analyze signal routing paths, identify hidden anti-tamper state machines, decode communication protocols between the PLD and its paired mcu, and extract proprietary algorithm logic implemented in programmable hardware. This deep analysis transforms raw dump data into actionable design knowledge that the original manufacturer never intended to expose to third parties. The ultimate malicious objective of PLD hacking is firmware extraction and mass production of a functional duplicate device. After reverse engineering reveals the full design blueprint, hackers remove device-specific fingerprints, erase lockbit verification triggers, and patch fuse-based anti-cloning markers from the recovered bitstream. The modified logic file is then programmed onto blank PLD hardware of the same model, generating an identical duplicate that replicates all electrical, timing, and functional behaviors of the original secured component. This cloning threat causes severe financial losses for manufacturers and introduces safety hazards in safety-critical embedded systems. Effective PLD hack defense must block every stage of the aforementioned attack chain through layered defense-in-depth strategies, covering software configuration, hardware primitive hardening, physical anti-tampering, and post-compilation logic obfuscation. The first defensive measure is unified lockbit policy optimization across all memory domains. Designers should reconfigure default lockbit registers to enforce synchronous access prohibition for both main flash and auxiliary eeprom sectors, eliminating the common partition leakage loophole that allows partial data read-out even under locked conditions. The second core defense strengthens OTP fuse security to resist physical tampering during decapsulation attacks. Security-critical fuses should be buried beneath multiple upper metal layers of the silicon die instead of placing them on the surface. Deeply buried fuses require far more precise and expensive probing equipment to modify, drastically raising the technical threshold for physical unlock attempts. Additionally, designers can implement redundant fuse verification logic, where multiple scattered fuse banks cross-check each other’s status to detect any artificial fuse alteration caused by laser tampering. Interface hardening forms the third critical defensive layer to block initial debug port exploitation. Engineers can physically isolate JTAG and SWD debug pins via hardware multiplexers or mechanical switches, fully disconnecting the interface after device production programming is completed. Even if attackers gain physical access to the PCB, the electrically isolated debug ports cannot be used to initiate any read-out or dump commands regardless of lockbit status. For software-based protection, dynamic JTAG monitor modules embedded in PLD logic can detect abnormal port probing attempts and trigger immediate memory erasure responses. Bitstream encryption is the most widely adopted industrial defense to neutralize dump-based firmware extraction. Modern high-security PLDs support AES-256 symmetric encryption for configuration bitstreams stored in external flash memory. The unique decryption key is permanently stored in inaccessible on-chip OTP fuses or battery-backed RAM, so even if attackers capture the full dump flash data via physical memory probing, the encrypted bitstream remains unreadable and cannot be used for code recovery or reverse engineering without the native device key. Runtime integrity checking serves as a dynamic defensive mechanism to detect and terminate ongoing hacking attempts during device operation. The PLD can continuously compare real-time fuse status, lockbit register values, and eeprom stored hash values against precomputed golden fingerprints embedded in protected logic blocks. If abnormal register modification, unexpected memory read-out requests, or glitching-induced state distortion is detected, the device automatically locks all memory access, wipes temporary key data, and enters a permanent self-protection lockdown mode to prevent further data leakage. Physical anti-tampering mesh technology further enhances defense against decapsulation and silicon probing attacks. Advanced PLD families integrate a dense network of conductive security traces overlaying sensitive logic and memory regions. Any mechanical grinding, chemical decapsulation, or metal layer probing will break the mesh circuit, triggering an irreversible tamper response that erases all on-chip eeprom keys and invalidates the embedded fuse security configuration. This passive physical barrier makes post-decapsulation unlock nearly impossible for low-budget attackers. Logic obfuscation and dummy routing increase the complexity of post-dump reverse engineering even if adversaries bypass all prior defenses and obtain a plaintext bitstream. Designers can add fake logic cells, redundant interconnect paths, and misleading lookup table configurations into the original PLD code. These obfuscation elements confuse automated reverse engineering tools, fragment the logical correlation of functional modules, and drastically extend the time and cost required for successful code analysis and duplicate device development. Mutual authentication between PLDs and paired microcontroller devices builds a systemic boundary to prevent cloned duplicate hardware from operating in legitimate systems. The PLD and the onboard mcu perform encrypted handshake verification during every power-on cycle, using unique device keys stored in protected eeprom regions. Even if attackers create a hardware duplicate of the PLD, the missing unique authentication key will cause handshake failure, prohibiting the cloned device from integrating and functioning within the original embedded system. Many developers confuse PLD security with traditional microcontroller protection mechanisms, yet key differences exist in attack surfaces and defense focus areas. Microcontroller security primarily targets firmware code protection in CPU instruction memory, while PLD hack defense focuses on logic routing, LUT configuration, and hardware state machine protection. MCU defenses often rely on software lock mechanisms, whereas PLD security heavily depends on physical fuse layout, lockbit hardware enforcement, and routing-level obfuscation that cannot be replicated by standard mcu firmware protection tools. Legitimate security research plays a vital role in advancing PLD hack defense capabilities. Academic researchers conduct controlled decapsulation testing, authorized dump analysis, and lockbit vulnerability auditing to identify architectural weaknesses in existing fuse and encryption schemes. These findings help semiconductor vendors upgrade next-generation PLD security features, such as enhanced buried fuse layouts and anti-glitching power management circuits, to counter emerging hacking techniques. In summary, Programmable Logic Device hack defense is a comprehensive security discipline that counters the full attack lifecycle including unauthorized read-out, flash and eeprom dump, physical decapsulation, fuse tampering, lockbit bypass, device unlock, firmware extraction, code recovery, reverse engineering, and illegal duplicate manufacturing. By implementing layered strategies covering fuse hardening, lockbit access control, bitstream encryption, physical anti-tampering, runtime integrity monitoring, and cross-chip authentication, system designers can effectively block malicious hacking attempts and protect the proprietary logic assets embedded in PLD, mcu and microcontroller integrated embedded ecosystems.