Цитата(sysel @ Jun 25 2009, 11:27)
Какая-то религиозная тема получилась.
Один говорит, могу прочитать микроконтроллер защищенный, толпа кричит "врешь, собака!".
Может быть полезно было бы, если бы уважаемый Cyber описал кратко технологию считывания, подкрепил бы всё это фотографиями...
Тогда может быть и получился бы конструктивный разговор...
Пока я больше склоняюсь к мнению "врешь, собака"...
Все тыщу раз описано в интернете....
In the Microchip PIC16C61 and PIC16C71 microcontrollers [147], the memory content is
encrypted when the security bit is activated. The encryption involves XNOR of the seven high
order bits of the memory location with the seven low order bits. Neither encryption schemes is
much good, as an attacker can erase part of the memory using toothpick attacks and then restore
the memory or encryption table. For old PIC microcontrollers, the attacker did not have to find
and reset the security fuse, as the encrypted memory contents can be read in a standard way
using a suitable programmer.
Further improvement to the protection of EPROM-based microcontrollers involved covering
the fuses with a top metal layer opaque to UV. For example, most OTP PIC microcontrollers
with 14-bit and 16-bit cores benefit from this. This not only prevents the fuses from being reset,
but makes finding them more difficult. Until very recently, when we introduced fault injection
attacks, there were only two practical ways of defeating the protection in such microcontrollers.
One is reverse engineering followed by laser cutter or FIB treatment to remove the top metal
protection layer (Figure 101). Another is modifying the CPU and microprobing the data bus.
Both ways require substantial investments in equipment and a highly skilled attacker.
When EEPROM memory started to be used in microcontrollers, it allowed more protection
possibilities. In addition to the top metal, inverted memory cells were used which are less
sensitive to UV light. For example, in the Atmel AT89C51 microcontroller [148], security fuses
cannot be reset with UV light because the erased fuse corresponds to active security. However,
as the UV can change the fuse from the non-secure state to secure, it can still be used to find the
fuse. To prevent this, some microcontrollers benefit from both inverted fuses and top metal
protection, for example the Microchip PIC16F628 [149] and PIC16F876 [36] microcontrollers.
Certain implementations have potential security flows. For example, Ubicom SX
microcontrollers have a security fuse which cannot be reset with UV; protected memory is read
as the XOR of the four high order bits with the four middle and the four low bits. By using the
toothpick attacks described here it is possible to recover the memory contents. The attacker has
to erase, say, four high bits, then read the memory, then erase four middle bits and read it again
to get four low bits.
Figure. CP fuses in the PIC16C622A microcontroller and the top metal layer removed with a laser cutter
К РОДОНАЧАЛЬНИКАМ ТЕМЫ НЕ ИМЕЮ НИКАКОГО ОТНОШЕНИЯ.
Эскизы прикрепленных изображений
Восстановление прошивки, снятие бита защиты
May 22 2008, 20:51
