MCU reverse engineering

We wanted to leave you with a piece of logic taken out of an older PIC16C series microcontroller. We want you to guess which micro(s) this gate (well the pair of them) would be found in.

The security of embedded systems often hinges on a handful of protective circuits buried deep within the silicon. In the world of microcontrollers, the battle between code protection and reverse engineering is a constant arms race. This particular AND gate structure is not merely a logic primitive; it is the cornerstone of the entire lockbit mechanism for an entire family of popular MCUs. When we examine this circuit, we are essentially looking at the physical manifestation of the microcontroller's trust model. Every read-out operation from the program memory must pass through this gate's final verdict. The design team at Microchip clearly invested significant effort to ensure that any attempt to dump flash contents would be blocked by this very structure.

Above we talked about the snaileye structure of an AND-gate layed out in Silicon CMOS. Now, we present to you how this AND gate has been used in Microchip PICs such as PIC16C558, PIC16C620, PIC16C621, PIC16C622, and a variety of others.

Before we dive deeper, it is crucial to understand the broader context of firmware extraction from these devices. Many engineers and security researchers have spent countless hours attempting to bypass the lock mechanism on these PIC microcontrollers. The lockbit system was designed to prevent unauthorized reading of proprietary code, effectively acting as a digital fortress around the programmer's intellectual property. However, as we shall see, even the most carefully designed fortress has its weak points. The physical layout of the fuses and the routing of critical signals can inadvertently create vulnerabilities that skilled attackers can exploit. The decapsulation process is often the first step in this journey, revealing the die's intricate details under a microscope. Once the chip is exposed, the real detective work begins, tracing each metal trace and polysilicon path to understand how the security fuses interact with the rest of the logic.

If you wish to determine if this article relates to a particular plasma focused ion beam fib lab PIC you may be in possession of, you can take a windowed OTP part (/JW) and set the lock-bits. If after 10 minutes in UV, it still says it's locked, this article applies to your PIC.

This test is actually a diagnostic for a specific generation of security implementation. The fact that UV exposure fails to clear the lock indicates that the fuses are not the traditional floating-gate type that can be erased by ultraviolet light. Instead, these devices use a more sophisticated locking scheme that combines multiple fuse elements in a logic network. The AND gates we have been studying are responsible for evaluating the state of these fuses. Only when all the individual lockbits are in the erased state (logic '1') does the gate output a '1', signaling that the device is unlocked and ready for read-out operations. This multi-factor approach to security is commendable, but it also creates a single point of failure at the AND gate's output node. An attacker who can manipulate that node can effectively override the entire security system, regardless of the state of the individual fuses.

IF THE PART REMAINS LOCKED, IT CANNOT BE UNLOCKED SO TEST AT YOUR OWN RISK.

The picture above is the die of the PIC16C558 magnified 100x. The PIC16C620-622 look pretty much the same. If there are letters after the final number, the die will be most likely, "shrunk" (e.g. PIC16C622 vs PIC16C622A).

Die shrinkage is a common practice in the semiconductor industry, often used to reduce manufacturing costs and improve performance. However, shrinking the die can sometimes introduce new challenges for security, as the reduced feature sizes make it harder to visually inspect the circuit for potential weaknesses. On the other hand, smaller geometries can also make physical attacks like focused ion beam (FIB) modification more difficult due to the tighter tolerances involved. The PIC16C558 and its siblings were manufactured using a mature process node that allowed relatively straightforward optical inspection. This is one of the reasons why these devices have been so thoroughly studied by the reverse engineering community over the years. The knowledge gained from analyzing these chips has informed the design of subsequent generations of secure microcontrollers, creating a valuable feedback loop for the industry.

Our area of concern is highlighted above along with a zoom of the area.

When magnified 500x, things become clear. Notice the top metal (M2) is covering our DUAL 2-Input AND gate in the red box above.

At this magnification level, the security architecture starts to reveal its secrets. The top metal layer serves not only as an interconnect but also as a physical barrier to prevent UV light from reaching the underlying fuse structures. This is a deliberate design choice to thwart simple optical attacks that rely on erasing fuses through the package window. The engineers at Microchip understood that an OTP (One-Time Programmable) device with a windowed package could be vulnerable to UV erasure, so they added metal shielding to protect the critical fuses. However, this shielding also makes it more difficult for legitimate users to perform code recovery in case of a forgotten password or a misconfigured lockbit. The trade-off between security and usability is always a delicate balancing act in the design of any microcontroller.

We previously showed you one half of the above area. Now you can see that there is a pair of 2-input AND gates. This was done to pcb hack offer two security lock-bits for memory regions (read the datasheet on special features of the CPU).

[Note: Clicking on pictures will give you a large file]

Stripping off that top metal (M2) now clearly shows us the bussing from two different areas to keep the part secure. Microchip went the extra step of covering the floating gate of the main easily discoverable fuses with metal to prevent UV from erasing a locked state. The outputs of those maker together club two fuses also feed into logic on the left side of the picture to tell you that the part is locked during a device readback of the configuration fuses.

The bussing network visible after M2 removal is particularly revealing. It shows how the two lockbits are routed to the AND gates and then onward to the read-out enable logic. This type of layout analysis is a fundamental technique in semiconductor reverse engineering, allowing researchers to reconstruct the circuit's functionality without needing the original schematics. By carefully tracing each metal line and identifying the transistors they connect to, one can build a complete picture of the security subsystem. The fact that the outputs of the fuses are routed through multiple layers of metal makes it more difficult to probe them directly with a microscope or a focused ion beam. However, as we shall see, the final AND gate stage presents a much more accessible target for physical attack.

This type of fuse is protected by multiple set fuses of which only some are UV-erasable. The AND gates are ensuring all fuses are erased to a '1' to "unlock" the device.

Let us consider the implications of this design from the perspective of a security researcher attempting to perform firmware extraction. The first step in any such endeavor is to understand the exact sequence of events that leads to the device being unlocked during normal operation. The lockbits are typically programmed at the factory or by the end user using a programmer. Once set, these fuses prevent any external read-out of the program memory, including the code space and any data stored in the EEPROM. The AND gates serve as the final arbiter of the lock state, combining the outputs of all the individual fuses into a single unlock signal. If an attacker can force this signal to a logic '1', the entire security system collapses, allowing unrestricted access to the device's contents. This is why the physical location and routing of the AND gates are of such paramount importance in the analysis of any secure microcontroller.

What does this mean to an attacker? It means, go after the final AND gate if you want to forcefully unlock the CPU. The outputs of the final AND gate stage run underneath VDD!! (The big mistake Microchip made). Two shots with a laser-cutter and we can short the output stages "Y" from the AND-gate to a logic '1' allowing readback of the memories (the part will still say it is locked 聚焦离子束加工技术).

This vulnerability is a textbook example of how a seemingly minor layout decision can have catastrophic security consequences. By routing the critical AND gate output underneath the VDD supply line, Microchip inadvertently made it possible for an attacker to force the output high using a simple laser-cut or focused ion beam modification. The technique involves using a laser cutter to create a short circuit between the AND gate output and the VDD rail, effectively overriding the gate's logic function. Once this modification is made, the device will behave as if the lockbits are cleared, even though the fuses themselves remain programmed. This allows the attacker to perform a full read-out of the program memory, including the code and any embedded constants. The part will still report itself as locked when queried, but the actual memory contents can now be dumped without any further obstacles. This type of attack is often referred to as a "hardware glitch" or "fault injection" attack, and it highlights the importance of secure layout practices in the design of safety-critical systems.

Stripping off the lower metal layer (M1) reveals the Poly-silicon layer.

The polysilicon layer represents the actual gate electrodes of the transistors that make up the logic gates. At this level of magnification, one can see the individual transistor structures that form the NAND gates and inverters we identified earlier. The polysilicon pattern is a direct reflection of the circuit design, and experienced reverse engineers can often reconstruct the entire schematic from these images alone. The alignment between the polysilicon and the diffusion layers determines the channel regions of the MOSFETs, and the contacts between polysilicon and metal define the interconnections. By carefully analyzing these layers, researchers can verify the functionality of the circuit and confirm their understanding of the security mechanism. In the case of the PIC16C558, the polysilicon layer confirms that the AND gates are indeed built from a NAND gate followed by an inverter, as we suspected from the higher-level metal images.

What have we learned from all this?

• A lot of time and effort went into the design of this series of security mechanisms.
• These are the most secure Microchip PICs of ALL currently available. The latest ~350-400nm 3-4 metal layer PICs are less secure than these.
• Anything made by human can be torn down by human!

The security of these older PIC microcontrollers is not absolute, but it is significantly stronger than many people assume. The multi-layer metal shielding, the use of AND gates to combine multiple fuses, and the careful placement of critical logic all contribute to a robust security architecture. However, as with any security system, there are always trade-offs between cost, performance, and protection. The fact that the output of the AND gate runs underneath VDD is a clear oversight, but it is also a reminder that even the most sophisticated designs can have subtle vulnerabilities. The reverse engineering community has spent decades studying these devices, and the knowledge gained has helped improve the security of subsequent generations of microcontrollers. Today's secure MCUs use more advanced techniques such as active shielding, random delay insertion, and cryptographic authentication to protect against physical attacks.

For security researchers and embedded systems engineers, the lessons from the PIC16C558 series are still highly relevant. Understanding the physical implementation of security mechanisms is essential for designing systems that can resist determined adversaries. The techniques of decapsulation, imaging, and layout analysis remain powerful tools in the arsenal of anyone working with secure hardware. Moreover, the ongoing cat-and-mouse game between attackers and defenders drives innovation in both attack techniques and countermeasures. The next time you encounter a secure microcontroller, remember that its security is only as strong as its weakest physical link. The AND gate we have examined today is a perfect example of how a single structural weakness can undermine an otherwise well-designed security architecture.

When performing firmware extraction from these devices, the attacker must consider all possible attack vectors, including side-channel analysis, fault injection, and direct physical modification. The PIC16C558's lockbit mechanism is vulnerable to the latter, but other devices may be more susceptible to timing attacks or power analysis. The diversity of attack methods reflects the creativity and persistence of the reverse engineering community. In many cases, the most effective approach is to combine multiple techniques to achieve the desired outcome. For example, an attacker might first use decapsulation to expose the die, then use optical imaging to identify the security logic, and finally use a laser cutter to modify the circuit. This multi-step process requires a high level of skill and specialized equipment, but it is well within the reach of dedicated laboratories and well-funded research groups.

One of the most intriguing aspects of this security mechanism is the use of two separate AND gates for the two lockbits. This suggests that the device has separate security regions, perhaps for program memory and configuration fuses, or for different banks of EEPROM. The datasheet for these PICs mentions "special features of the CPU" that include configurable code protection, but the details are deliberately vague to discourage casual attempts at circumvention. The dual-gate design ensures that an attacker cannot simply erase one set of fuses and expect the device to unlock; both sets must be cleared simultaneously. This adds an extra layer of complexity to the attack, as the attacker must either find a way to clear all fuses or bypass the AND gates entirely. As we have seen, bypassing the AND gates by forcing their outputs high is a more practical approach than attempting to erase the fuses themselves.

The technique of using a laser cutter to short the AND gate output to VDD is a form of "hardware hacking" that has been known for many years. However, the specific implementation details vary from device to device, and each new generation of microcontrollers presents unique challenges. The PIC16C558 series is particularly amenable to this attack because the layout of the metal layers is relatively coarse and easy to visualize. Newer devices with smaller feature sizes and additional metal layers are much harder to modify, even with the most advanced laser tools. This is why the statement that these older PICs are "the most secure Microchip PICs of ALL currently available" is so striking—it suggests that the newer devices have sacrificed security for other benefits, such as lower cost or higher performance.

From the perspective of a code owner, the vulnerability we have described is a sobering reminder that no security mechanism is infallible. If your intellectual property is valuable enough, a determined adversary will eventually find a way to extract it. The best defense is a layered security approach that combines hardware protection with software obfuscation and regular security audits. Even if an attacker manages to unlock the device and perform a read-out of the flash memory, the code itself can be protected through techniques like code encryption, anti-tamper mechanisms, and remote attestation. These additional measures can make the firmware extraction process much more difficult and time-consuming, potentially deterring all but the most persistent attackers.

In the context of the PIC16C558, the AND gates we have studied are not the only security features present on the die. The datasheet mentions other features such as oscillator calibration, power-on reset, and watchdog timer, all of which have indirect effects on the device's security posture. For example, the oscillator circuit can be used to implement timing-based security checks, and the watchdog timer can prevent certain types of fault injection attacks. The overall security of the device is the sum of these individual features, and a thorough reverse engineering effort must consider all of them. The fact that the AND gate vulnerability exists does not mean that the device is completely insecure; it simply means that there is a known attack path that can be exploited under the right conditions.

For those interested in replicating this analysis, the steps are relatively straightforward but require access to specialized equipment. First, the device must be decapsulated using chemical etching or mechanical polishing to expose the die. Then, the die must be imaged using a high-resolution optical microscope or scanning electron microscope (SEM) to capture the layout of the metal layers. By comparing images taken at different magnifications and after removing successive metal layers, one can reconstruct the complete circuit topology. This process is time-consuming and requires careful attention to detail, but it yields a wealth of information about the device's internal architecture. With enough patience and expertise, even the most complex security circuits can be understood and potentially circumvented.

The security community has long recognized the importance of hardware reverse engineering in advancing the state of the art in both attack and defense. By studying devices like the PIC16C558, researchers can identify patterns and weaknesses that are likely to appear in other products from the same manufacturer or using similar design methodologies. This cumulative knowledge helps the industry as a whole to build more secure systems over time. The fact that Microchip's newer devices are described as "less secure" is a testament to the value of this ongoing research—it shows that the company has shifted its focus away from physical security and toward other priorities, possibly because they believe that the threat landscape has evolved.

It is also worth noting that the AND gate vulnerability is not the only way to compromise the security of the PIC16C558. Other attack vectors include power analysis, electromagnetic emanation, and clock glitching, all of which can be used to bypass the lockbit mechanism or to extract code without modifying the hardware. The choice of attack method depends on the attacker's resources and the specific constraints of the target system. For example, if the device is in a secure enclave and cannot be physically accessed, side-channel attacks may be the only viable option. On the other hand, if the device is removable and can be examined in a laboratory, direct physical modification like the laser cutter attack is often the most reliable approach.

In the end, the story of the PIC16C558's security mechanism is a microcosm of the broader struggle between security engineers and attackers. The engineers at Microchip designed a sophisticated system that combines multiple fuses, AND gates, and metal shielding to protect the device's memory. The attackers, armed with decapsulation tools and laser cutters, found a single point of failure in the routing of the AND gate outputs. This cat-and-mouse dynamic is what drives progress in both fields, ensuring that each generation of microcontrollers is more secure than the last. While no system can ever be completely invulnerable, the lessons learned from analyzing devices like the PIC16C558 help to raise the bar for security in the embedded systems industry.

The specific technique of shorting the AND gate output to VDD is a classic example of a "fault injection" attack, where the attacker introduces a controlled fault into the circuit to alter its behavior. In this case, the fault is a permanent short circuit that modifies the logic function of the gate. Other types of fault injection include voltage glitches, clock glitches, and electromagnetic pulses, all of which can have similar effects on the circuit's operation. The advantage of the laser cutter approach is that it is relatively precise and does not require the device to be powered while the modification is made. This makes it easier to perform the attack without triggering any anti-tamper measures that might be active during normal operation.

For engineers working on secure systems, the key takeaway from this analysis is the importance of physical security in addition to logical security. It is not enough to design a robust algorithm or a clever security protocol; the implementation must also withstand physical attacks. This means paying careful attention to the layout of critical signals, using multiple layers of metal and polysilicon to obscure the circuit, and incorporating active countermeasures such as on-chip sensors that detect tampering attempts. The PIC16C558 series incorporates some of these features, such as the metal shielding over the fuses, but it falls short in the routing of the AND gate outputs. This oversight is a valuable lesson for future designs.

As we conclude this analysis, it is important to recognize the contributions of the reverse engineering community in bringing these vulnerabilities to light. Without their efforts, many of these security flaws would remain unknown, leaving users with a false sense of security. The publication of findings like these is essential for the health of the industry, as it allows manufacturers to improve their products and users to make informed decisions about the security of their systems. The fact that this information is now publicly available is a testament to the importance of transparency and collaboration in the field of information security.

In summary, the PIC16C558 and its siblings offer a fascinating case study in the design and analysis of microcontroller security mechanisms. The AND gate approach to lockbit management is both clever and flawed, and the physical implementation reveals a wealth of information about the trade-offs involved in secure hardware design. Whether you are a security researcher, an embedded systems engineer, or simply a curious observer, there is much to learn from these devices. The techniques of decapsulation, imaging, and fault injection are powerful tools that can be applied to a wide range of hardware security challenges, and the lessons from the PIC16C558 will continue to inform the development of secure systems for years to come.

For those who wish to explore this topic further, there are many resources available online and in the academic literature. The techniques of hardware reverse engineering are well-documented, and there are numerous communities dedicated to sharing knowledge and tools in this area. The PIC16C558 is just one example of a device that has been thoroughly analyzed, and the methods used to study it are applicable to many other microcontrollers and secure elements. As technology continues to evolve, the importance of understanding hardware security will only grow, making this an exciting and vital field for future research and development.

Finally, we should consider the ethical implications of this type of analysis. While the information we have presented here is intended for educational and research purposes, it could also be used for malicious purposes. It is the responsibility of the reader to use this knowledge ethically and legally, and to respect the intellectual property rights of others. The goal of hardware security research is to improve the overall security of the ecosystem, not to enable unauthorized access or duplication of protected code. By working together, security researchers and manufacturers can build a more secure and trustworthy digital world.

• Mikatech Microchip PIC MCU reverse engineer list: