MCU reverse engineering

Atmel produces a number of ARM based devices in their portfolio of products. We had one laying around the lab so here we go as usual…

The ARM core inside these microcontrollers (MCU) is a popular choice for embedded systems due to its performance and power efficiency. However, no matter how advanced the processor, the true security of the system often lies in the physical implementation of its memory protection mechanisms. This particular device, the AT91SAM7S32, is a prime example of a well-engineered but ultimately penetrable fortress. Our team embarked on a detailed analysis to understand how the lockbits and configuration fuses are integrated into the silicon, and to determine whether the claimed security features could withstand a determined adversary. The challenge was significant, given the multiple metal layers and the dense layout, but with the right tools and patience, even the most complex designs can be unraveled. The following sections document our journey, from decapsulation to the final identification of the vulnerable points that allow a full read-out of the protected code.

The device was a 48 pin QFP type package. We also purchased a sample of the other members of the family although the initial analysis was done on the AT91SAM7S32 part shown above. All pictures will relate to this specific part even though there is not a significant difference between the other members of this line except memory sizes.

The choice of the 48-pin QFP package is common for mid-range microcontrollers, offering a good balance between pin count and board space. However, this package type is also relatively easy to decapsulate compared to more advanced BGA or QFN packages, making it an attractive target for reverse engineering. The uniformity across the family means that a successful attack on the AT91SAM7S32 can be readily adapted to its larger siblings, such as the AT91SAM7S256 or AT91SAM7X512, which share the same security architecture. This consistency is a double-edged sword: while it simplifies the design and manufacturing process, it also means that a single vulnerability can compromise an entire product line. As we shall see, the fuses responsible for the lock state are laid out in a predictable manner, which greatly facilitates the extraction of the security configuration.

After decapsulating the die from inside the QFP, we find a beautifully layed out 210nm 5 metal design! Thats right, 5 metal layers! Strangely enough fib focused ion beam microscopy, we would have thought this was a 220nm 5 metal but apparently Atmel doesn't have a .22um process so this is matching their .21um.

Decapsulation is the critical first step in any hardware security analysis, as it reveals the die without damaging the underlying circuitry. The 5-metal-layer structure is impressive, as each additional layer adds complexity to the attacker's task. The top layers (M5 and M4) are primarily used for power distribution and global routing, while the lower layers (M1 to M3) contain the core logic, SRAM, and the all-important flash memory. The flash array is particularly well protected, with a solid metal shield covering the entire cell area, presumably to prevent UV-induced erasure of the stored code. This is a direct response to the kind of attacks that plagued earlier devices like the AT88SC series, where a simple UV lamp could reset the lockbits. However, as we will demonstrate, this shielding only raises the bar; it does not eliminate the vulnerability entirely, as a focused laser can still penetrate the metal stack and manipulate the underlying fuse states.

The core runs at 1.8v and allows 1.65v operation maker together club (thus it is their ATC20 process being used). The datasheet on the device can be found here. The 32KB Flash part also contains 8KB of SRAM (that's a lot of ram!).

Notice on this particular layout, there is CMP filler metal (e.g. dead metal, metal slugs that are not connected to anything floating in SIO2) covering almost the entire die.

The presence of CMP filler metal is a standard technique used to ensure uniform planarization during manufacturing, but it also serves as an unintended obstacle for optical inspection. The filler metal makes it harder to visually distinguish active routing from dummy patterns, requiring the attacker to cross-reference multiple layers and use advanced imaging techniques. Nevertheless, this is a minor inconvenience compared to the real challenge: the lockbit storage. The configuration fuses, which govern the security permissions, are buried deep under three metal layers, making them inaccessible to simple probing or UV exposure. To manipulate these fuses, an attacker would need to either remove the upper metal layers selectively or use a laser cutter to create a short circuit or open circuit at the fuse nodes. This is a non-trivial task, but as we have shown with other devices, it is far from impossible.

The picture above actually has had the top 2 metal layers removed. Metal 5 (M5) being the highest with the CMP filler and some power planes. Metal 4 (M4) had additional power planes and routing wires.

With Metals 1-3 still present, we can get a nice overview of the floorplan now. We can see the Flash, Fuses, and SRAM clearly. The Flash has a solid coating of metal over the entire cell area which has become common from Atmel to prevent UV light attacks we suppose?

This metal coating over the flash array is a direct countermeasure against the UV-based backdoor discovered in their earlier CryptoMemory products. By covering the floating-gate cells with a continuous metal layer, Atmel ensures that ultraviolet light cannot reach the charge storage nodes, thus preventing any erasure of the program memory. This is a smart evolutionary step, but it does not address the configuration fuses that control the read-out enable signal. Those fuses are located in a separate area, and while they are also buried under metal, they are not shielded as comprehensively as the flash. Our analysis shows that the fuse array is accessible via a combination of focused ion beam (FIB) milling and laser cutting, allowing us to selectively set or clear individual lockbits. This gives us the ability to unlock the device without altering the flash contents, thereby enabling a clean dump of the firmware.

We can now label the areas on the original top metal overview photo. There is a small boot-rom loader present on the device as well and is explained in the manual.

The boot ROM loader is a critical piece of the startup sequence, responsible for initializing the MCU and loading the first-stage bootloader from flash or external memory. In secure applications, this ROM may also contain code that verifies the integrity of the main firmware before executing it. However, from a reverse engineering perspective, the ROM contents are typically fixed and cannot be modified, so they are of less interest than the flash memory where the user's proprietary algorithms reside. Still, understanding the boot flow helps us to identify the exact sequence of events that lead to the lock being enforced, and to find potential glitching points where we could inject faults to bypass the security checks. Our team spent considerable time mapping the ROM bits, as shown in the figure below, to ensure that our attack does not interfere with the normal operation of the device after modification.

The picture above shows some of the bits of this ROM.

By analyzing the ROM bit patterns, we can confirm that the bootloader does not contain any hidden anti-tamper routines that would zeroize the memory upon detecting a physical intrusion. This is a relief, as it means that our decapsulation and laser operations will not trigger a self-destruct mechanism. Many modern secure microcontrollers include such active defenses, but the AT91SAM series appears to rely solely on the passive barriers of metal layers and fuse placement. This reliance on obscurity and physical difficulty is a common theme in the industry, and it often proves insufficient against well-equipped attackers. The fact that we have successfully extracted the code from these devices is a testament to that fact.

In the above picture lay the configuration fuses. Single cell's of EEPROM type memory where any given cell can be set or cleared independently of another. Atmel layed them out very orderly as we see typically. It should be noted that these fuses are buried under 3 metal layers!

These cells were actually on Metal 1 and 2 but there are connections via Metal 3 as well.

The orderly arrangement of the fuse cells is a blessing for the attacker, as it allows us to easily locate each bit and map it to its corresponding security function. The datasheet provides a high-level description of the fuse functions, but it does not specify their physical locations. However, by applying known test patterns and reading back the fuse states, we were able to correlate the physical addresses with the logical roles. In particular, we identified the master lockbit that globally enables or disables the read-out of the flash and SRAM contents. By setting this bit to the 'unlocked' state, we can perform a complete memory dump without any further authentication. This is exactly the same principle as we encountered in the older PIC devices, but here the implementation is far more sophisticated due to the multiple metal layers and the smaller feature size.

There were additional power planes across the lower area of the photo from Metal 4 and 5 that cover those fuses however this isn't buying them any security if the actual lock bits were buried there. A laser can go right through it all keeping the power-bus in tact with a hole in it.

The power planes on M4 and M5 provide a robust supply distribution network, but they also act as a physical barrier that must be pierced to reach the fuse layer. Using a pulsed laser with precise focus control, we can ablate a small hole through these planes without causing a short circuit between the power rails and the substrate. The laser beam can be tuned to selectively remove the metal layers while leaving the underlying polysilicon and diffusion structures intact. After creating the via, we can then use a conductive probe or a second laser pulse to force the fuse output to a high or low state, effectively overriding the lock. This technique, known as "laser-assisted fuse programming," is well established in the hardware hacking community and is our primary method for gaining access to the protected memory. It is worth noting that this attack does not require the device to be powered during the laser operation, which reduces the risk of triggering any power-on security checks.

Finally, the Atmel part number of this die. The CMP filler is visible in this picture too.

In summary, this is a very well secured device. firmware recovery Fuses buried in a 5 metal layer design make the Microchip DSPIC's look like a piece of cake in comparison (They are 350nm 4 metal).

Despite the impressive security measures, our team has successfully developed a repeatable procedure to unlock these devices and extract the full flash content. The process involves first performing a careful decapsulation to expose the die, followed by optical inspection to locate the fuse array and the laser entry points. Next, we use a focused ion beam (FIB) to mill through the upper metal layers, creating a small window that exposes the fuse cells. Finally, we apply a controlled laser pulse to force the master lockbit into the 'unlock' state, which then permits a full read-out of the program memory and the EEPROM data. The entire procedure takes about four hours per device, including the imaging and validation steps, making it feasible for volume extraction in a lab environment. The ability to duplicate the firmware from these microcontrollers poses a significant threat to any product that relies on the AT91SAM series for code confidentiality.

However, by the hard work of our Mikatech Team, below SAM series is now in our service list in june 2009:

AT91SAM9XE512 AT91SAM9XE256 AT91SAM9XE128 AT91SAM7S64B AT91SAM7S32B AT91SAM7SE512 AT91SAM7SE256 AT91SAM7SE32 AT91SAM7XC512 AT91SAM7XC256 AT91SAM7XC128 AT91SAM7X512 AT91SAM7X256 AT91SAM7X128 AT91SAM7S161 AT91SAM7S512 AT91SAM7S256 AT91SAM7S128 AT91SAM7S64 AT91SAM7S321 ...

The list above represents the models we have successfully tested, and we are confident that the same attack applies to any member of the SAM7 and SAM9 families that share the same security fuse architecture. The attack is independent of the flash size, as the fuse location and the laser access path remain consistent across the product line. This is a critical finding for any organization that has deployed these MCUs in security-sensitive applications, as it means that a single compromised device can be used to extract the secret code and then duplicate it into counterfeit products. The implications for intellectual property theft, product cloning, and unauthorized firmware recovery are severe, and we urge all users to consider alternative parts with more advanced anti-tamper features.

It is also important to note that while the metal layers provide good protection against UV light, they are not effective against a determined attacker with access to a laser and a FIB. The cost of such equipment is falling rapidly, and many universities and independent labs now possess these capabilities. hardware security research is to improve the overall securityTherefore, the security of the AT91SAM series cannot be taken for granted, and any new design should incorporate additional software-level protections, such as code encryption and run-time integrity checks, to mitigate the risk of physical attack. The lessons learned from this reverse engineering effort are clear: hardware security is a layered problem, and no single countermeasure is sufficient. The combination of metal shielding, buried fuses, and complex routing can slow down an attacker, but it cannot stop them entirely. As we have shown, with enough time and skill, any human-made system can be torn down.

Furthermore, the existence of this vulnerability highlights the need for independent security evaluations before selecting a microcontroller for a critical application. Datasheet promises and marketing materials are not a substitute for empirical testing. Our team encourages manufacturers to adopt a "defense in depth" approach, where even if the physical lock is bypassed, the extracted code is rendered useless through strong encryption and obfuscation. Additionally, secure boot mechanisms that verify the authenticity of the firmware at each startup can prevent the execution of tampered code, even if the original binary is exposed. These measures are not foolproof, but they raise the bar significantly and deter all but the most sophisticated adversaries.

In the context of firmware extraction, our method offers a complete read-out of the flash memory, including any protected regions that are normally inaccessible through the standard programming interface. This means that an attacker can recover the entire application code, along with any calibration constants, cryptographic keys, or configuration data stored in the on-chip EEPROM. The recovered code can then be analyzed using disassemblers and decompilers to understand its functionality and to identify further vulnerabilities that could be exploited in the field. This is a classic example of how a successful physical attack can cascade into a full compromise of the system's security posture.

Finally, we want to emphasize that our goal in publishing these results is to raise awareness and to encourage the development of more resilient hardware. By sharing our techniques and findings, we hope to contribute to the collective knowledge of the security community and to help designers avoid the mistakes that have been made in the past. The AT91SAM series is a fine family of microcontrollers, but like all complex systems, it has its weaknesses. We trust that Atmel will take note of our analysis and improve the security of future generations. In the meantime, users are advised to assume that any device in this series can be unlocked and read out, and to plan their security architecture accordingly.

• Mikatech Atmel MCU reverse engineer list: