MCU reverse engineering

A programmable logic device or PLD is an electronic component used to build reconfigurable digital circuits. Unlike a logic gate, which has a fixed function, a PLD has an undefined function at the time of manufacture. Before the PLD can be used in a circuit it must be programmed, that is, reconfigured.

Before PLDs were invented, read-only memory (ROM) chips were used to create arbitrary combinational logic functions of a number of inputs. Consider a ROM with m inputs (the address lines) and n outputs (the data lines). When used as a memory, the ROM contains 2m words of n bits each.

Now imagine that the inputs are driven not by an m-bit address, but by m independent logic signals. Theoretically, there are 22m possible Boolean functions of these m input signals. By Boolean function in this context is meant a single function that maps each of the 2m possible combinations of the m Boolean inputs to a single Boolean output. There are 22m possible distinct ways to map each of 2m inputs to a Boolean value, which explains why there are 22m such Boolean functions of m inputs.

Now, consider that each of the n output pins acts, independently, as a logic device that is specially selected to sample just one of the possible 22m such functions. At any given time, only one of the 2m possible input values can be present on the ROM, but over time, as the input values span their full possible domain, each output pin will map out its particular function of the 2m possible input values, from among the 22m possible such functions. Note that the structure of the ROM allows just n of the 22m possible such Boolean functions to be produced at the output pins. The ROM therefore becomes equivalent to n separate logic circuits, each of which generates a chosen function of the m inputs.

The advantage of using a ROM in this way is that any conceivable function of all possible combinations of the m inputs can be made to appear at any of the n outputs, making this the most general-purpose combinational logic device available for m input pins and n output pins.

Also, PROMs (programmable ROMs), EPROMs (ultraviolet-erasable PROMs) and EEPROMs (electrically erasable PROMs) are available that can be programmed using a standard PROM programmer without requiring specialised hardware or software. However, there are several disadvantages:

they are usually much slower than dedicated logic circuits,
they cannot necessarily provide safe "covers" for asynchronous logic transitions so the PROM's outputs may glitch as the inputs switch,
they consume more power,
they are often more expensive than programmable logic, especially if high speed is required.
Since most ROMs do not have input or output registers, they cannot be used stand-alone for sequential logic. An external TTL register was often used for sequential designs such as state machines. Common EPROMs, for example the 2716, are still sometimes used in this way by hobby circuit designers, who often have some lying around. This use is sometimes called a 'poor man's PAL'.

Early programmable logic[edit source | editbeta]In 1969, Motorola offered the XC157, a mask-programmed gate array with 12 gates and 30 uncommitted input/output pins.[1]

In 1970, Texas Instruments developed a mask-programmable IC based on the IBM read-only associative memory or ROAM. This device, the TMS2000, was programmed by altering the metal layer during the production of the IC. The TMS2000 had up to 17 inputs and 18 outputs with 8 JK flip flop for memory. TI coined the term Programmable Logic Array for this device.[2]

In 1971, General Electric Company (GE) was developing a programmable logic device based on the new PROM technology. This experimental device improved on IBM's ROAM by allowing multilevel logic. Intel had just introduced the floating-gate UV erasable PROM so the researcher at GE incorporated that technology. The GE device was the first erasable PLD ever developed, predating the Altera EPLD by over a decade. GE obtained several early patents on programmable logic devices.[3][4][5]

In 1973 National Semiconductor introduced a mask-programmable PLA device (DM7575) with 14 inputs and 8 outputs with no memory registers. This was more popular than the TI part but cost of making the metal mask limited its use. The device is significant because it was the basis for the field programmable logic array produced by Signetics in 1975, the 82S100. (Intersil actually beat Signetics to market but poor yield doomed their part.)[6][7]

In 1974 GE entered into an agreement with Monolithic Memories to develop a mask- programmable logic device incorporating the GE innovations. The device was named the 'Programmable Associative Logic Array' or PALA. The MMI 5760 was completed in 1976 and could implement multilevel or sequential circuits of over 100 gates. The device was supported by a GE design environment where Boolean equations would be converted to mask patterns for configuring the device. The part was never brought to market.[8]

PLA[edit source | editbeta]Main article: Programmable Logic Array
In 1970, Texas Instruments developed a mask-programmable IC based on the IBM read-only associative memory or ROAM. This device, the TMS2000, was programmed by altering the metal layer during the production of the IC. The TMS2000 had up to 17 inputs and 18 outputs with 8 JK flip flop for memory. TI coined the term Programmable Logic Array for this device.[2]

A programmable logic array (PLA) has a programmable AND gate array, which links to a programmable OR gate array, which can then be conditionally complemented to produce an output.

PAL[edit source | editbeta]Main article: Programmable array logic
PAL devices have arrays of transistor cells arranged in a "fixed-OR, programmable-AND" plane used to implement "sum-of-products" binary logic equations for each of the outputs in terms of the inputs and either synchronous or asynchronous feedback from the outputs.

MMI introduced a breakthrough device in 1978, the Programmable Array Logic or PAL. The architecture was simpler than that of Signetics FPLA because it omitted the programmable OR array. This made the parts faster, smaller and cheaper. They were available in 20 pin 300 mil DIP packages while the FPLAs came in 28 pin 600 mil packages. The PAL Handbook demystified the design process. The PALASM design software (PAL Assembler) converted the engineers' Boolean equations into the fuse pattern required to program the part. The PAL devices were soon second-sourced by National Semiconductor, Texas Instruments and AMD.

After MMI succeeded with the 20-pin PAL parts, AMD introduced the 24-pin 22V10 PAL with additional features. After buying out MMI (1987), AMD spun off a consolidated operation as Vantis, and that business was acquired by Lattice Semiconductor in 1999.

GALs[edit source | editbeta]Main article: Generic array logic

Lattice GAL 16V8 and 20V8An innovation of the PAL was the generic array logic device, or GAL, invented by Lattice Semiconductor in 1985. This device has the same logical properties as the PAL but can be erased and reprogrammed. The GAL is very useful in the prototyping stage of a design, when any bugs in the logic can be corrected by reprogramming. GALs are programmed and reprogrammed using a PAL programmer, or by using the in-circuit programming technique on supporting chips.

Lattice GALs combine CMOS and electrically erasable (E2) floating gate technology for a high-speed, low-power logic device.

A similar device called a PEEL (programmable electrically erasable logic) was introduced by the International CMOS Technology (ICT) corporation.

CPLDs[edit source | editbeta]Main article: Complex programmable logic device
PALs and GALs are available only in small sizes, equivalent to a few hundred logic gates. For bigger logic circuits, complex PLDs or CPLDs can be used. These contain the equivalent of several PALs linked by programmable interconnections, all in one integrated circuit. CPLDs can replace thousands, or even hundreds of thousands, of logic gates.

Some CPLDs are programmed using a PAL programmer, but this method becomes inconvenient for devices with hundreds of pins. A second method of programming is to solder the device to its printed circuit board, then feed it with a serial data stream from a personal computer. The CPLD contains a circuit that decodes the data stream and configures the CPLD to perform its specified logic function.

FPGAs[edit source | editbeta]Main article: Field-programmable gate array
While PALs were busy developing into GALs and CPLDs (all discussed above), a separate stream of development was happening. This type of device is based on gate array technology and is called the field-programmable gate array (FPGA). Early examples of FPGAs are the 82s100 array, and 82S105 sequencer, by Signetics, introduced in the late 1970s. The 82S100 was an array of AND terms. The 82S105 also had flip flop functions.

FPGAs use a grid of logic gates, and once stored, the data doesn't change, similar to that of an ordinary gate array. The term "field-programmable" means the device is programmed by the customer, not the manufacturer.

FPGAs are usually programmed after being soldered down to the circuit board, in a manner similar to that of larger CPLDs. In most larger FPGAs the fib focused ion beam cost configuration is volatile, and must be re-loaded into the device whenever power is applied or different functionality is required. Configuration is typically stored in a configuration PROM or EEPROM. EEPROM versions may be in-system programmable (typically via JTAG).

The difference between FPGAs and CPLDs is that FPGAs are internally based on Look-up tables (LUTs) whereas CPLDs form the logic functions with sea-of-gates (e.g. sum of products). CPLDs are meant for simpler designs while FPGAs are meant for more complex designs. In general, CPLDs are a good choice for wide combinational logic applications, whereas FPGAs are more suitable for large state machines (i.e. microprocessors).

Other variants[edit source | editbeta]At present, much interest exists in reconfigurable systems. These are microprocessor circuits that contain some fixed functions and other functions that can be altered by code running on the processor. Designing self-altering systems requires engineers to learn new methods, and that new software tools be developed.

PLDs are being sold now that contain a microprocessor with a fixed function (the so-called core) surrounded by programmable logic. These devices let designers concentrate on adding new features to designs without having to worry about making the microprocessor work.

How PLDs retain their configuration[edit source | editbeta]A PLD is a combination of a logic device and a memory device. The memory is used to store the pattern that was given to the chip during programming. Most of the methods for storing data in an integrated circuit have been adapted for use in PLDs. These include:

Silicon antifuses
SRAM
EPROM or EEPROM cells
Flash memory
Silicon antifuses are connections that are made by applying a voltage across a modified area of silicon inside the chip. They are called antifuses because they work in the opposite way to normal fuses, which begin life as connections until they are broken by an electric current.

SRAM, or static RAM, is a volatile type of memory, meaning that its contents are lost each time the power is switched off. SRAM-based PLDs therefore have to be programmed every time the circuit is switched on. This is usually done automatically by another part of the circuit.

An EPROM fib聚焦离子束多少钱 cell is a MOS (metal-oxide-semiconductor) transistor that can be switched on by trapping an electric charge permanently on its gate electrode. This is done by a PAL programmer. The charge remains for many years and can only be removed by exposing the chip to strong ultraviolet light in a device called an EPROM eraser.

Flash memory is non-volatile, retaining its contents even when the power is switched off. It can be erased and reprogrammed as required. This makes it useful for PLD memory.

As of 2005, most CPLDs are electrically programmable and erasable, and non-volatile. This is because they are too small to justify the inconvenience of programming internal SRAM cells every time they start up, and EPROM cells are more expensive due to their ceramic package with a quartz window.

PLD programming languages[edit source | editbeta]Many PAL programming devices accept input in a standard file format, commonly referred to as 'JEDEC files'.They are analogous to software compilers. The languages used as source code for logic compilers are called hardware description languages, or HDLs.

PALASM, ABEL and CUPL are frequently used for low-complexity devices, while Verilog and VHDL are popular higher-level description languages for more complex devices. The more limited ABEL is often used for historical reasons, but for new designs VHDL is more popular, even for low-complexity designs.

For modern PLD programming languages, design flows, and tools, see FPGA and Reconfigurable computing.

PLD programming devices[edit source | editbeta]A device programmer is used to transfer the boolean logic pattern into the programmable device. In the early days of programmable logic, every PLD manufacturer also produced a specialized device programmer for its family of logic devices. Later, universal device programmers came onto the market that supported several logic device families from different manufacturers. Today's device programmers usually can program common PLDs (mostly PAL/GAL equivalents) from all existing manufacturers. Common file formats used to store the boolean logic pattern (fuses) are JEDEC, Altera POF (Programmable Object File), or Xilinx BITstream

While PLDs were originally designed for reconfigurable logic, their security aspects have become increasingly important. Many modern systems use a microcontroller (MCU) alongside PLDs to handle sensitive operations, and the configuration data stored in the PLD's internal memory is often as valuable as the firmware itself. Reverse engineering of PLD configurations has become a specialised field, where attackers attempt to read-out the fuse map or the bitstream that defines the logic function. In some cases, the configuration memory (whether EEPROM, flash, or SRAM) can be dumped and analysed to duplicate the entire design. This is particularly critical when the PLD contains proprietary algorithms or security keys that protect the overall system. The lockbit mechanism, if present, is intended to prevent unauthorised read-out of the configuration, but it is not always foolproof. Attackers have used decapsulation techniques to expose the die and then probe the internal fuses to unlock the device. Once unlocked, a full firmware extraction of the PLD's configuration becomes possible, allowing competitors to clone the product. The recovery of configuration data from obsolete PLDs is a legitimate need, but the same methods can be abused for malicious duplication. In the realm of CPLDs and FPGAs, the bitstream is often stored in an external EEPROM, which can be intercepted and duplicated if the communication is not encrypted. Some vendors have implemented a lock feature that binds the configuration to a specific device ID, but this can be bypassed with advanced reverse engineering. The historical use of EPROM cells with UV erasure made them vulnerable to optical attacks, similar to the backdoors found in earlier microcontrollers. Modern flash-based PLDs have better protection, but they are still susceptible to side-channel attacks that leak information about the fuse states. The ultimate goal of any reverse engineering effort is to obtain a complete read-out of the logic pattern, which can then be simulated or reprogrammed into a blank device. This process is analogous to the dump flash operation on a microcontroller, where the entire code memory is extracted. In many embedded systems, the PLD works in tandem with the MCU, and both must be secured to prevent a full system compromise. A single weak point, such as an unprotected configuration pin, can allow an attacker to read-out the PLD's internal registers. The security fuses in a PLD are typically programmed once, but if they are not fully verified, they may remain in a state that allows later modification. Some engineers have accidentally left test modes enabled, which permit an easy read-out of the configuration via JTAG. This is why thorough testing and final fuse verification are critical in the production flow. In the event of a lost password or corrupted configuration, legitimate users may need to perform a recovery procedure, but this often requires special access codes or physical intervention. The challenge is to balance ease of recovery against protection against unauthorised duplication. Many organisations now require that their PLD designs be encrypted before being stored in external memory, so that even if the bitstream is intercepted, it cannot be directly used. However, the encryption key itself must be securely stored, often in a separate EEPROM or battery-backed RAM. The lockbit in the PLD can control access to the read-back functionality, but if the device is decapsulated, an attacker can directly measure the antifuse states. Decapsulation is an invasive technique that destroys the package, but it provides unparalleled visibility into the internal structure. Once the die is exposed, the configuration fuses can be optically or electrically sensed, enabling a complete reverse engineering of the logic. This level of attack is expensive but feasible for high-value intellectual property. Consequently, designers are moving towards SRAM-based FPGAs that load their configuration from an external source each power-up, as they contain no permanent fuse state to be read. However, this introduces another vulnerability: the configuration stream can be sniffed during boot-up. To counter this, some FPGAs use an onboard decryption engine that requires a battery-backed key, which is erased upon tamper detection. These techniques are borrowed from the secure microcontroller domain, where lockbits and encryption are standard practice. The constant evolution of both PLD technology and attack methods ensures that security remains a moving target. For hobbyists, the ability to duplicate a simple PAL or GAL design from a known JEDEC file is a common exercise. But for commercial products, the stakes are much higher, and any breach can lead to significant financial loss. The lessons learned from reverse engineering of older PLDs have informed the design of today's more robust devices. In summary, while PLDs offer great flexibility, their configuration must be safeguarded with the same rigor applied to MCU firmware. The integration of PLDs with microcontrollers creates a powerful platform, but also expands the attack surface. Therefore, system architects must consider both the logical and physical security of every programmable element. Regular security audits, including attempts to read-out the configuration using both software and hardware methods, are essential. The field of PLD security continues to evolve, and we can expect to see even stronger protections in future generations.

It is worth noting that the configuration fuses in many CPLDs are implemented as floating-gate transistors, similar to EEPROM cells. These cells can be erased by UV light if the package is windowed, which is why windowed versions are now rare. However, even in opaque packages, a motivated attacker can perform decapsulation to remove the moulding compound and then use a UV lamp to reset the fuses. This is identical to the attack on the PIC16C84 and other early microcontrollers. Once the fuses are cleared, the device effectively becomes unlocked, and a full read-out of the internal logic is possible. This vulnerability was well known in the 1990s, and it prompted the industry to adopt better passivation layers and anti-tamper coatings. Today's PLDs often include a metal shield over the fuse area to block UV and optical probing. Additionally, some devices have built-in sensors that detect decapsulation attempts and erase the configuration immediately. These active defences are similar to those found in high-security microcontrollers. The cost of such protection is justified for military, aerospace, and financial applications. For less critical uses, standard lockbits may suffice, but it is important to understand their limitations. In all cases, the fundamental principle applies: if the attacker has physical access and sufficient resources, the lock can eventually be overcome. Therefore, the best strategy is to assume that the configuration will eventually be extracted and to design the system accordingly. This might include remote authentication, run-time code obfuscation, or periodic key rotation. The reverse engineering community has published numerous case studies of successful PLD attacks, which serve as valuable educational resources. By studying these, engineers can learn to avoid common pitfalls. The interplay between hardware and software security is complex, but it is essential for building trustworthy systems. As PLDs become more capable and ubiquitous, their protection will remain a top priority for both vendors and users.