MCU reverse engineering

Abstract

Embedded microcontrollers have become the foundational computing core of modern electronic systems, covering consumer electronics, industrial control, financial payment, military equipment, and medical instrumentation. The intellectual property (IP) embedded in microcontroller firmware, including proprietary control algorithms, business logic, and encrypted data processing routines, constitutes the core commercial and technical asset of device developers. This paper conducts a comprehensive security evaluation of copy protection mechanisms deployed in mainstream modern microcontrollers. It systematically demonstrates that commodity general-purpose microcontrollers lack fundamental hardware and firmware safeguards against unauthorized firmware reading, code cloning, and IP tampering. The study establishes a hierarchical threat-based taxonomy of microcontroller attack methodologies, covering non-invasive, low-cost invasive, and high-end reverse-engineering exploitation paths. Furthermore, this paper summarizes and analyzes practical, cost-effective defensive technologies tailored for both general-purpose and security-grade microcontrollers, providing actionable guidelines for embedded developers to enhance firmware anti-copy protection. This expanded version supplements underlying semiconductor physical principles, detailed attack mechanism derivation, and industrial application cases to enrich the depth and practicality of the original research.

1. Introduction

Embedded microcontrollers are ubiquitous in contemporary electronic ecosystems, serving as the brain of countless intelligent devices across diverse application tiers. Hobbyists utilize low-cost entry-level microcontrollers to build DIY interactive devices, robotic prototypes, and small-scale sensor nodes for educational and recreational purposes. Small and medium-sized enterprises deploy mid-range microcontrollers in industrial measurement instruments, automated control modules, environmental monitoring terminals, and consumer home appliances to implement customized business logic. High-reliability scenarios, including military avionics, governmental security terminals, banking payment terminals, and clinical medical diagnostic devices, rely on dedicated security-enhanced microcontrollers and smartcard processing cores to process classified and privacy-sensitive data.

Every microcontroller executes a fixed instruction sequence stored in its non-volatile program memory, defined as the firmware algorithm developed by engineers. Most embedded firmware is ultimately compiled into native assembly instructions, even if the high-level source code is written in C, C++, or Rust during the development phase. This compilation process translates human-readable logic into machine-executable opcodes tailored to the microcontroller’s specific instruction set architecture (ISA). A small number of niche low-end platforms adopt interpreted BASIC or Java virtual machine execution models, yet these architectures have limited penetration in industrial and security-critical applications due to performance and memory overhead constraints.

For firmware developers and original equipment manufacturers (OEMs), intellectual property protection is a core operational requirement. Developers aim to prevent unauthorized third parties from reading, copying, reverse-engineering, and redistributing their proprietary firmware, so as to control the production volume of end devices, avoid market piracy, and maintain technical competitive advantages. To address this demand, semiconductor manufacturers integrate dedicated hardware lock mechanisms and firmware-based copy protection features into their microcontroller products.

When activated during device programming, these protection features restrict external programmers and debug interfaces from dumping the complete program memory and user data stored inside the chip. This anti-cloning function is universally referred to as copy protection or code lock in the embedded semiconductor industry. Before deployment in end products, all microcontrollers must undergo a one-time or repeated programming process to write compiled firmware binaries into their non-volatile memory arrays.

The programming workflow, hardware requirements, and protection configuration methods vary significantly across manufacturers, product families, and memory types. For research, testing, and prototype validation purposes, manufacturers provide fully reprogrammable microcontroller variants that support repeated firmware erasure and writing. For small-batch commercial production, one-time programmable (OTP) microcontrollers are the preferred option, as they eliminate over-erasure risks and feature lower unit and programming costs compared to reprogrammable counterparts.

For large-scale mass production exceeding thousands of units, factory-masked read-only memory (Mask ROM) microcontrollers offer the lowest per-unit cost. However, this solution imposes a minimum order quantity of 1,000 pieces and requires fixed firmware solidification during wafer fabrication, leaving no room for post-production program modification or bug patching. After firmware code development, compilation, and functional verification are completed, the binary image must be uploaded to the target microcontroller via dedicated programming hardware.

This programming hardware, known as a device programmer or programming unit, differs greatly in complexity and cost. Most entry-level general-purpose microcontrollers support simple low-cost programmers composed of a DC power adapter, discrete transistors, current-limiting resistors, and a standard RS232 serial or parallel port connector. These DIY programmers are widely accessible to hobbyists and small developers due to their simple circuit design and open-source firmware.

In contrast, a small number of high-security microcontroller families mandate the use of manufacturer-exclusive encrypted programmers with closed communication protocols. These proprietary programmers feature identity authentication mechanisms and cannot be replicated by third-party hardware, making such microcontrollers unpopular in the open embedded community due to procurement barriers and high costs.

For long-term stable operation, especially for OTP microcontrollers that cannot be reprogrammed after writing, industrial-grade certified programmers are strongly recommended. These devices provide precise voltage regulation, electrostatic discharge (ESD) protection, standardized timing control, and traceable programming logs, which are fully compliant with the official specifications of most semiconductor vendors. Engineers can obtain complete parameter manuals, wiring diagrams, and compatibility lists of certified programmers from the official websites of microcontroller manufacturers.

Despite the widespread deployment of built-in copy protection, most commodity microcontrollers exhibit inherent security weaknesses in their lock mechanisms. Many protection circuits are designed with simplified logic to reduce chip area and production cost, making them vulnerable to physical disturbance, software exploitation, and low-cost invasive tampering. This paper first classifies microcontrollers by security grade and memory type, then systematically analyzes mainstream attack vectors, and finally proposes hierarchical defensive strategies matching different application cost budgets.

2. Classification and Core Characteristics of Modern Microcontrollers

To accurately evaluate copy protection performance and vulnerability levels, all embedded microcontrollers can be divided into two distinct categories based on hardware security architecture: general-purpose ordinary microcontrollers and dedicated security-grade microcontrollers. This classification is fundamental for subsequent attack analysis and defense design, as the two categories adopt completely different security boundary designs and threat resistance capabilities.

Security-grade microcontrollers are purpose-built for high-risk application scenarios including military control systems, financial transaction terminals, clinical medical equipment, and contactless smartcard wallets. They are the core processing units of trusted execution environments (TEEs) in security-critical devices. Unlike ordinary chips, they support multiple isolated operational privilege modes and hierarchical memory access permission levels to prevent cross-domain data leakage.

A key advanced feature of security microcontrollers is end-to-end encryption protection covering the entire chip. This includes not only encrypted external communication interfaces to prevent eavesdropping on off-chip data transmission but also on-chip bus encryption that scrambles all address and data signals transmitted between the CPU core, memory, and peripheral modules. Additional hardware mechanisms such as signal masking, clock jitter obfuscation, and on-chip sensor anti-tampering are integrated to counter side-channel analysis.

Launching effective attacks against security-grade microcontrollers requires ultra-precise semiconductor test equipment, professional cryptanalysis knowledge, and advanced chip reverse-engineering skills. The attack cost and technical threshold are extremely high, so the security performance of these chips is not the focus of this paper and will be discussed separately in follow-up specialized research.

General-purpose ordinary microcontrollers dominate the mainstream embedded market, covering consumer electronics, industrial automation, and automotive low-power auxiliary modules. Almost all ordinary microcontrollers integrate basic built-in copy protection locks to prohibit external firmware dumping after programming. However, embedded developers must recognize that most of these native protection mechanisms are structurally weak and can be bypassed via low-cost attack methods.

The most reasonable secondary classification of ordinary microcontrollers is based on the physical type of their program memory, as the memory storage principle directly determines copy protection robustness and attack difficulty. Different memory technologies have distinct charge retention characteristics, access timing parameters, and erasure mechanisms, which form the root cause of differentiated vulnerability performance. The following table summarizes the core technical parameters, programming characteristics, and cost attributes of seven mainstream program memory types for embedded microcontrollers.

Based on the memory classification above, the attack difficulty and protection effectiveness of each microcontroller type can be quantitatively analyzed. Mask ROM microcontrollers embed firmware during wafer manufacturing, with hardware-level access prohibition set by the vendor. However, some Mask ROM chips retain hidden factory test monitor programs for post-production memory verification, which may be exploited as backdoors to bypass access restrictions. The most reliable firmware extraction method for Mask ROM is chip depackaging and optical memory reading.

To enhance anti-optical-reading performance, some manufacturers fabricate ROM cells using transistors with differentiated threshold voltages, instead of the traditional presence/absence transistor binary storage method. This threshold-based storage cannot be decoded via surface optical observation, requiring microprobing or selective chemical etching to extract stored data.

OTP ROM microcontrollers allow developers to enable code protection fuses during initial programming. Even with protection activated, both invasive and non-invasive attacks remain feasible. Common low-cost invasive methods include targeted UV irradiation of protection fuses, laser cutting of lock signal lines, and manual fuse restoration on probing stations. Non-invasive attacks apply abnormal electrical signals to trick the on-chip protection state machine into invalidating lock flags.

UV EPROM microcontrollers share identical internal circuit architecture with OTP devices, differing only in their ceramic packages with transparent quartz windows for ultraviolet erasure. Thus, their copy protection vulnerabilities and attack methods are completely consistent with OTP counterparts. EEPROM-based microcontrollers exhibit stronger resistance to invasive attacks, as their data is stored via floating-gate charge accumulation, which is harder to physically manipulate than transistor-based logic cells.

Nevertheless, EEPROM chips are still susceptible to bus microprobing by skilled attackers. More critically, EEPROM memory cells have highly sensitive response characteristics to control signal timing and voltage levels, making non-invasive glitch attacks extremely effective. Attackers can selectively erase security fuses or induce state machine errors to bypass protection logic easily.

Flash EPROM microcontrollers dominate the current embedded market, with vulnerability levels nearly identical to EEPROM devices. The protection strength varies slightly across vendor iterations, but almost all commercial Flash microcontrollers have publicly disclosed non-invasive bypass methods. FRAM microcontrollers adopt ferroelectric polarization storage, featuring inherent anti-glitch and anti-charge-disturbance capabilities, delivering the best native security among ordinary memory types, though microprobing attacks still remain effective.

SRAM-based microcontrollers store firmware in volatile memory that loses all data once power is disconnected. This characteristic makes them highly resistant to invasive tampering, as any chip depackaging operation will interrupt power supply and erase firmware instantly. However, hardware and firmware bugs in some SRAM security chips create exploitable non-invasive attack surfaces, such as the publicly documented vulnerability of the Dallas Semiconductor DS5002FP bus-encrypted microcontroller.

3. General Taxonomy of Microcontroller Attack Technologies

A vast range of critical digital systems rely on the tamper-resistance capabilities of embedded processing devices. This ecosystem includes pay-TV conditional access terminals, GSM cellular baseband modules, prepaid gas and electricity smart meters, and smartcard electronic wallet chips. The commercial profitability and data security of these systems fundamentally depend on the inability of adversaries to extract embedded keys and proprietary firmware from internal memory.

It is crucial to clarify that chip tamper resistance is never absolute. Any adversary equipped with professional semiconductor test instrumentation can extract confidential key material and firmware data by directly observing and manipulating on-chip circuit components. The embedded security industry has reached a universal consensus: given sufficient capital investment, time resources, and technical expertise, any chip-scale tamper-resistant device can be ultimately penetrated and decoded.

Therefore, the practical security level of a microcontroller is not defined by absolute unbreakability, but by the time cost, financial investment, and technical threshold that its built-in protection mechanisms impose on attackers. Evaluating these three core penalty metrics is essential for embedded security engineering, yet this topic has long received insufficient attention from academic researchers, security evaluators, and industrial hardware engineers.

All existing attacks targeting microcontroller copy protection can be categorized into four standardized threat classes based on physical impact, equipment cost, and technical principle. This four-dimensional taxonomy was first proposed by Anderson and Kuhn in classic embedded security research, and it remains the most authoritative classification framework to date.

First, microprobing techniques belong to invasive hardware attacks that require direct physical access to the bare silicon die surface. Attackers use precision positioning equipment and nanoscale probe needles to contact on-chip metal interconnects, enabling real-time observation of signal transmission, intentional logic manipulation, and interference with normal integrated circuit operation.

Second, software attacks leverage the microcontroller’s standard external communication and debug interfaces. They exploit logical vulnerabilities in application protocols, cryptographic algorithm implementation defects, firmware state machine bugs, and access control logic loopholes to bypass protection without any physical modification of the chip.

Third, eavesdropping techniques are passive side-channel attacks that monitor analog physical characteristics during normal chip operation with high time resolution. Monitored signals include power supply current fluctuations, interface pin voltage transients, and electromagnetic radiation emitted by on-chip logic switching, which leak implicit information about executed instructions and secret key bits.

Fourth, fault generation techniques actively apply abnormal external environmental conditions to induce intentional processor malfunctions. These artificially injected faults break the normal execution flow of firmware, unlock restricted access modes, and expose protected memory areas that are inaccessible under standard operating conditions.

All microprobing-based exploitation methods are classified as invasive attacks. They require continuous operation for several hours to weeks in a dedicated electrostatic-shielded laboratory environment. The depackaging process permanently destroys the original chip plastic package, making the device non-functional for commercial use after attack. The other three attack categories are defined as non-invasive attacks, which leave the chip package intact and cause no permanent physical damage to the device.

The test equipment used for non-invasive attacks can be easily disguised as ordinary commercial smartcard readers or general-purpose microcontroller programmers, making them difficult to detect in field deployment scenarios. Non-invasive attacks pose two unique severe threats to security-critical applications that invasive methods do not have.

Firstly, the end user of the compromised microcontroller cannot perceive that confidential keys or firmware have been stolen, as the device maintains normal functional performance after non-invasive exploitation. Service providers and system administrators will not revoke the compromised credentials before malicious abuse occurs, leading to latent long-term security risks.

Secondly, non-invasive attack setups feature excellent scalability. The core hardware and firmware of attack equipment can be replicated, modified, and upgraded at extremely low marginal cost, enabling large-scale batch cracking of numerous identical microcontroller devices by a single attacker.

The technical development logic of microcontroller attacks follows a fixed industrial pattern. The design of high-precision non-invasive side-channel attacks requires in-depth prior knowledge of the target processor’s architecture, memory layout, and firmware execution logic. In contrast, invasive microprobing attacks have low initial knowledge requirements and adopt universal technical processes applicable to almost all semiconductor products of the same process node.

For this reason, most attack chains start with invasive reverse engineering to decode the chip’s internal structure and protection logic. The technical data obtained from invasive analysis is then used to develop low-cost, fast, scalable non-invasive attack tools for mass deployment. This two-stage attack evolution is the core reason why commodity microcontroller protection systems fail in large-scale anti-piracy scenarios.

3.1 Non-Invasive Attacks on Microcontrollers

Non-invasive attacks are the most prevalent and practically threatening exploitation methods for ordinary microcontrollers, due to their low cost, reusability, and undetectable characteristics. Since 1996, the author has conducted systematic experimental research on non-invasive copy protection bypass methods across hundreds of mainstream microcontroller models from global vendors. The PIC16F84 microcontroller was the first test subject successfully decrypted via self-developed glitch attack equipment, marking the start of long-term research in this field.

The author’s custom non-invasive attack platform is built on an IBM PC host running legacy MS-DOS or Windows 95/98 operating systems, with all control logic programmed in C++. This dedicated programmer hardware is designed to generate ultra-fast, wide-range adjustable power supply voltages and programming pulses, which is the core hardware prerequisite for conducting power glitch and clock glitch attacks.

The signal generation module of the platform outputs 32 configurable digital logic channels with adjustable high/low threshold levels, and some channels support open-drain output mode for flexible load matching. Meanwhile, the platform features 16 high-impedance signal input channels to capture real-time response signals from the target microcontroller during attack injection. This channel configuration is sufficient to cover the pin definitions and communication interfaces of over 95% of 8-bit and 16-bit embedded microcontrollers.

The hardware base of the platform includes a replaceable socket carrier board with dedicated pin sockets for all tested microcontroller packages. For special pin-arrangement variants, auxiliary adapter sockets are used to ensure reliable electrical connection without physical modification of the target chip.

The most common non-invasive attack vectors focus on manipulating the two core operating parameters of microcontrollers: supply voltage and input clock signals. Under-voltage injection reduces the core operating voltage below the datasheet-specified minimum threshold, while over-voltage stress raises the voltage beyond the maximum safe limit. Both methods can disable dedicated hardware protection circuits or force the CPU pipeline to execute incorrect out-of-specification instructions.

Many security-enhanced microcontrollers integrate built-in voltage detection sensors to monitor static operating voltage levels. However, almost all these sensors have inherent response latency defects and cannot detect nanosecond-level transient voltage glitches. Fast transient power pulses can reset the on-chip protection state machine temporarily without erasing or damaging the protected firmware and key data stored in non-volatile memory.

Precise power and clock transients can also interfere with the instruction decoding and execution process of individual CPU opcodes. Every transistor and metal interconnect on the chip forms an inherent RC delay network with fixed signal propagation latency. The microcontroller’s maximum stable clock frequency is determined by the longest RC delay path among all internal logic elements.

Similarly, each CMOS flip-flop has an ultra-narrow sampling time window of only a few picoseconds to latch input voltage levels and update output states. This window is fixed for an individual chip at a specific voltage and temperature, even within the standard setup/hold time range specified in the official datasheet.

By injecting a clock glitch (a pulse far shorter than the standard clock cycle) or a power glitch (a rapid transient voltage spike/drop), attackers can disrupt the switching behavior of targeted transistors selectively. Through systematic parameter traversal of glitch amplitude, width, and injection timing, the CPU can be forced to execute undefined invalid instructions that are not included in the official microcode instruction set.

Although the exact mapping between glitch parameters and wrong instructions cannot be predicted theoretically in advance, automated traversal testing via the custom programmer platform can quickly locate effective glitch configurations for specific microcontroller models. This brute-force search method is simple to implement and highly efficient for commodity chips with fixed process parameters.

Power analysis attack, also known as simple power analysis (SPA) and differential power analysis (DPA), is another mature non-invasive threat. A 10-15Ω high-precision sampling resistor is connected in series with the microcontroller’s power supply loop to convert dynamic current fluctuations into measurable voltage signals.

An analog-to-digital converter (ADC) with no less than 12-bit quantization resolution is used to sample the voltage signal, with the sampling frequency set to an integer multiple of the chip’s operating clock to achieve synchronous data acquisition. This synchronous sampling mode eliminates phase noise and improves the accuracy of side-channel signal extraction.

The address and data bus drivers of embedded microcontrollers typically consist of 8 to 12 parallel inverter units per signal line, driving large on-chip parasitic capacitive loads. Each logic level transition of the bus lines causes a transient short-circuit current in the power domain, generating a measurable power consumption peak.

Switching a single bus line between logic 0 and 1 produces a current variation of 0.5-1mA at the clock edge moment, which can be clearly distinguished by a 12-bit ADC. SRAM write operations generate the most prominent power signatures due to the simultaneous charging and discharging of multiple memory cell capacitors.

By averaging the power traces of hundreds of repeated identical operational transactions, attackers can extract weak side-channel signals that are not directly transmitted via the external bus. Carry flag state changes during arithmetic operations are the most valuable target, as most cryptographic key scheduling algorithms use bit shift operations that expose individual key bits through carry flag leakage.

Even if status bit changes cannot be measured directly, they alter the execution sequence of the instruction sequencer and microcode flow, resulting in distinguishable power consumption patterns. Different CPU instructions activate the decoder, arithmetic logic unit (ALU), and register file with varying activity intensities, allowing attackers to reconstruct the complete firmware execution flow and cryptographic algorithm logic from power traces.

Data remanence is a physical non-invasive vulnerability affecting volatile memory devices. Static RAM cells can retain stored data for a short duration after power disconnection due to residual charge accumulation. If an SRAM cell holds a fixed key value for a long runtime duration, the charge distribution will form a stable latent state that can be recovered upon the next power-up.

Low-temperature freezing further extends data remanence time. Cooling the microcontroller to -20°C allows SRAM to retain complete data for several minutes, while ultra-low temperatures below -50°C can extend data retention to several hours. This method enables attackers to extract sensitive runtime keys from volatile memory without any chip modification.

The following table lists all microcontroller models verified by the author to be vulnerable to non-invasive attacks, including their core memory features, effective attack methods, and technical notes. Models marked in brackets have not been physically tested but are inferred to have identical vulnerabilities based on family architecture consistency.

It is critical to note that inclusion in the vulnerability table only indicates inherent susceptibility to non-invasive attacks for the listed microcontroller revisions. Vendor-updated die steppings and revised firmware masks may fix these loopholes, so developers must verify the specific chip revision before product deployment. Some models have multiple alternative non-invasive attack methods, with success rates ranging from 15% to 100%. Low-success-rate methods circulating online carry risks of permanently damaging the target chip or the attack programmer hardware.

3.2 Invasive Attacks on Microcontrollers

WARNING: The invasive attack content described below is for academic research and security evaluation purposes only. The author assumes no legal or technical responsibility for any unauthorized use of these methods to crack copyrighted microcontroller firmware. Readers who attempt to replicate these experiments do so entirely at their own risk and must comply with local intellectual property and semiconductor security laws.

A widespread misconception in the embedded industry claims that invasive attacks require hundreds of thousands of dollars in laboratory equipment and professional doctoral-level expertise, making them inaccessible to low-budget attackers. This myth leads many developers to rely solely on non-invasive protection and ignore invasive threat assessment, resulting in severe IP leakage risks.

In reality, many practical invasive attacks can be implemented with low-cost, easily procured equipment and basic chemistry knowledge. While invasive methods involve chip depackaging and physical circuit manipulation, their total cost can be controlled below $3,000, far lower than most developers expect. This section dismantles the high-cost myth through two typical practical attack cases on commercial PIC microcontrollers.

The core prerequisite for all invasive attacks is chip depackaging, which removes the plastic or epoxy package to expose the bare silicon die. There are two mainstream depackaging workflows: full package dissolution and partial plastic removal above the die surface.

Full dissolution immerses the entire chip in corrosive acid to remove all packaging material, which requires a professional bonding station to rebond the bare die to a test carrier. This method has a high technical threshold and is not suitable for low-budget attackers. Partial plastic removal is the optimal choice for cost-sensitive research, as it only exposes the silicon die while retaining the original pin bonding wires and package base.

Fuming concentrated nitric acid (above 98% purity) is the standard reagent for partial depackaging. It rapidly dissolves the epoxy molding compound without corroding the aluminum bonding wires and silicon die. The chemical reaction must be conducted in a low-humidity fume hood, as water vapor will induce electrochemical corrosion of exposed metal interconnects on the chip surface.

After epoxy dissolution, residual acid waste is removed via acetone flushing. An ultrasonic cleaning bath is then used to eliminate microscopic chemical residues on the die surface. Finally, the chip is rinsed with deionized water and isopropanol for neutralization and drying. If an ultrasonic bath is unavailable, the rinsing step can be skipped; minor surface contamination does not affect subsequent UV exposure and probing operations.

A low-cost ultrasonic bath can be self-assembled using a signal generator, ferrite antenna coil, and stainless steel container, eliminating the need for commercial laboratory equipment. After depackaging, the chip retains full electrical functionality, enabling subsequent protection fuse manipulation and memory reading operations.

3.2.1 Low-Cost Invasive Attack on PIC12C508A

The Microchip PIC12C508A is an 8-pin ultra-low-cost OTP microcontroller widely used in consumer toys and simple control devices. Its copy protection mechanism can be completely bypassed via basic UV irradiation invasive attack with total equipment cost below $200.

After completing partial depackaging of the PIC12C508A chip, the next step is locating the on-chip security protection fuses. With a 100X magnification optical microscope, attackers can easily trace the metal signal line extending from the programming voltage (VPP) pin to locate the compact fuse array area on the die edge.

If no microscope is available, a brute-force UV scanning method can be adopted: irradiate different regions of the die with ultraviolet light sequentially and test the chip’s read protection status after each exposure. Once the fuse area is located, opaque black paper is used to cover the entire die except the fuse region to prevent accidental erasure of program memory cells.

Continuous UV irradiation for 5 to 10 minutes will reset the blown OTP security fuses to the unprogrammed state. After this operation, any ordinary off-the-shelf programmer can read the complete original program memory and user data from the chip without restriction.

A more precise variant of this attack uses a microscope and sharp tungsten probe needle instead of a laser cutter. By tracing the signal lines connected to the protection fuse array, attackers can identify the dedicated lock control line. Due to a historical design flaw in the PIC12C508A layout, this lock line is isolated from other dense interconnects.

Gently scratching the passivation layer above the line with a probe needle until the internal aluminum wire is cut will permanently disable the copy protection logic. This method avoids the need for expensive laser etching equipment and achieves the same protection bypass effect with manual mechanical operation.

3.2.2 Microprobing Attack on PIC16F874

The Microchip PIC16F874 is a mid-range Flash microcontroller with shielded EEPROM-based security fuses, which cannot be unlocked via conventional UV irradiation. This model requires basic microprobing technology to extract protected firmware data, representing a moderate-difficulty invasive attack case.

The chip depackaging process for the PIC16F874 is identical to the PIC12C508A workflow using fuming nitric acid. After exposing the bare die, the attacker observes the chip layout under a 100X-200X optical microscope to identify the parallel data bus lines connecting the Flash memory array to the CPU core and peripheral modules.

A critical design vulnerability of the PIC16F874 is that its copy protection mechanism only restricts user-mode memory access, while leaving programming-mode bus access completely unlocked. By positioning a precision probe needle on the exposed top-layer aluminum data bus lines, attackers can capture real-time data signals during memory read operations.

By repeatedly triggering the chip’s programming-mode read command and moving the probe needle across different bus lines sequentially, the complete 14-bit program memory and 8-bit user data memory contents can be fully reconstructed. This method requires only a basic microscope and manual probing needle, with total equipment cost below $1,500.

3.2.3 Advanced Invasive Reverse Engineering and FIB Technology

High-end invasive attacks involve full chip reverse engineering and focused ion beam (FIB) editing, targeting security-grade microcontrollers and complex programmable logic devices. The first step of full reverse engineering is constructing a complete chip layout map.

A CCD-equipped optical microscope captures high-resolution photographs of the entire die surface, which are stitched into meter-scale panoramic mosaic images. Engineers identify core functional modules including ROM, RAM, EEPROM, ALU, instruction decoder, and GPIO drivers by tracing metal interconnect connectivity and module boundary features.

The topmost aluminum metal layer blocks optical observation of underlying circuit layers. For non-planarized chips, lower-layer structures can be inferred from surface height variations. To obtain clear images of deep metal and polysilicon layers, the chip is briefly immersed in diluted hydrofluoric acid (HF) within an ultrasonic bath to strip the top oxide passivation and metal layers.

HF is a highly corrosive hazardous reagent that requires strict personal protective equipment and fume hood operation. After layer stripping, secondary panoramic photography reveals the complete multilayer circuit layout for logic function reconstruction.

Focused Ion Beam (FIB) workstations are advanced semiconductor editing tools built on vacuum chamber platforms similar to scanning electron microscopes (SEM). A liquid metal gallium ion source accelerates 30kV ion beams focused to a 5-10nm diameter spot, achieving dual functions of high-resolution imaging and precision material etching.

FIB systems can image chip surfaces at 5nm resolution via secondary particle detection. Increasing the beam current enables precise removal of die material at nanometer scale. Gas-assisted etching using iodine vapor improves etching speed and depth, allowing the creation of high-aspect-ratio vertical holes to access deep buried metal layers without damaging adjacent circuits.

Platinum-based organometallic gas can be decomposed by the ion beam to deposit conductive platinum traces, creating new probing pads on the die surface. Insulator deposition gas can build dielectric isolation layers for targeted circuit modification. Modern commercial FIB workstations cost less than $500,000, and processing time can be rented globally for $200-$500 per hour, making this technology accessible to professional attackers.

Rear-side access FIB technology polishes the chip from the silicon substrate side to a thickness of tens of micrometers. Infrared navigation and laser interferometer positioning enable precise transistor localization and substrate piercing contact. Although not yet widely used by commercial pirates, this emerging technique will become mainstream in future chip attacks and must be considered by security chip designers.

4. Threat Classification and Hierarchical Defense Technologies

Based on the attack methods verified in the above experiments, all microcontroller-oriented exploits can be classified into four threat levels according to implementation cost, technical threshold, and destructive scope, providing a basis for targeted defense design.

Level 1: Low-Cost Non-Invasive Attacks. This is the highest threat level, requiring only a custom or commercial glitch-capable programmer. Equipment cost is below $500, technical threshold is low, and attack scalability is maximum. All microcontrollers listed in the vulnerability table fall into this threat scope, and such attacks can be executed by individual amateur attackers.

Level 2: Basic Low-Cost Invasive Attacks. Equipment includes basic chemical reagents, optical microscope, and manual probing tools, with total cost ranging from $100 to $3,000. The technical threshold is equivalent to high school chemistry and basic embedded knowledge. Attackers can unlock OTP and Flash chips via UV erasure and simple line cutting, posing a severe threat to low and medium-end commercial products.

Level 3: Precision Microprobing Attacks. Requiring professional microprobing workstations and semiconductor expertise, total attack equipment cost ranges from $10,000 to $100,000. This threat only targets high-value commercial devices, as the attack time and labor cost exceed the profit of ordinary low-end products. Microcontrollers resistant to Level 1 and 2 attacks are sufficient for most industrial applications.

Level 4: Full Reverse Engineering & FIB Editing. The highest threat level, requiring FIB workstations, SEM, and professional VLSI design knowledge, with total investment exceeding $500,000. This attack is only used for military-grade and high-value financial chip decryption. Chips resisting the first three threat levels are considered sufficiently secure for most civilian scenarios.

The current embedded industry faces a challenging security dilemma: almost all commodity general-purpose microcontrollers are vulnerable to Level 1 or Level 2 attacks. Direct migration to security-grade microcontrollers can eliminate these threats, but it brings three critical drawbacks: extremely high unit cost, incompatible pin definitions and instruction sets with ordinary chips, and limited supply channels.

Most small and medium-sized enterprises cannot afford to redesign mature product hardware and firmware for security microcontroller migration. Even if security chips are adopted, attackers only targeting partial algorithm logic can still extract key code segments via low-level invasive methods, failing to achieve comprehensive IP protection.

To address this dilemma, this paper summarizes four practical, cost-effective defensive strategies compatible with ordinary microcontroller platforms, without requiring full chip replacement or large-scale hardware redesign.

First Strategy: Programmable Logic Device (PLD) Hardware Hardening. Complement the main microcontroller with CPLD or EPLD devices in the product circuit. PLDs have inherently stronger anti-attack performance than MCUs, with buried logic arrays that are difficult to reverse-engineer. Even if the main MCU firmware is cracked, the core authentication logic solidified in the PLD remains confidential, greatly increasing the overall attack time cost.

Second Strategy: Undocumented Analog Memory Bit Protection. Leverage the analog charge storage characteristics of OTP, EEPROM, and Flash memory cells. Program specific memory cells to intermediate charge states near the sense amplifier threshold. Due to circuit noise interference, these cells output random 0/1 values during normal reading.

The firmware uses these random bits as dynamic authentication keys during runtime. Attackers cannot replicate the intermediate charge state during cloning, so copied firmware will fail the dynamic authentication check. This analog physical feature creates a hardware-native unclonable function (PUF) without additional cost.

Third Strategy: Permanent Programming Interface Destruction. After completing mass programming, permanently disable the chip’s external programming interface via mechanical or electrical means. Mechanical methods include cutting the VPP programming pin and bonding wire with a precision cutter. Electrical methods apply instantaneous overvoltage to burn the internal programming interface fuse.

This method completely blocks non-invasive programming-mode read attacks, though it provides no defense against invasive die-level probing attacks. It is suitable for low-cost mass-produced products with no post-delivery firmware update requirements.

Fourth Strategy: Programming Mode Control Circuit Obfuscation. Reverse-engineer part of the chip’s programming control logic or use microprobing to modify the state machine timing. Obfuscate the trigger conditions for entering programming mode, making standard commercial programmers unable to enter the read-enabled programming state. This method raises the technical threshold for non-invasive and basic invasive attacks effectively.

5. Further Research Directions

Future embedded copy protection research should focus on the security evaluation of programmable logic arrays (PLA) and field-programmable gate arrays (FPGA). Similar to microcontrollers, PLDs integrate built-in anti-cloning security bits, yet their vulnerability to glitch, probing, and chemical attacks has not been systematically verified compared to MCUs.

FPGA devices have inherent security defects due to external configuration bitstream loading; unencrypted bitstreams can be easily copied and cloned. Many industrial systems use PLDs alongside FPGAs to prevent configuration piracy, making the anti-attack performance of EEPROM-based PLDs a critical research topic for industrial IP protection.

Another key research direction is the quantitative evaluation of physical unclonable functions (PUF) on ordinary microcontrollers. The analog memory bit protection proposed in this paper is a preliminary PUF implementation; future research can optimize stability and randomness to form standardized low-cost PUF solutions for mass deployment.

Additionally, the defense effect of on-chip voltage/temperature sensors against transient glitch attacks requires further quantitative testing. Optimizing sensor response latency to block nanosecond-level disturbance will effectively eliminate the most threatening Level 1 non-invasive attack vector for ordinary microcontrollers.