Hacking PICs by microtoming - Page 1
Forum section: electronics / general

author: MikeW
author_rank: Regular Contributor
timestamp: July 20, 2015, 07:14:26 pm
content: So one of the incredibly knowledgeable people at work told me about this really cool technique today.Basically, if you really, really,reallywant to get the code off a PIC, but it's locked (and you have some kind of military grade lab). Then you microtome down to the silicon level, x-ray it and read the positions of the gates.How cool is that?I didn't press him for more specifics cos I was busy, but anyone else got any reading material about this?

author: free_electron
author_rank: Super Contributor
timestamp: July 20, 2015, 07:20:36 pm
content: WRONG. Then you have the position of the gates, but not the code. that is stored as electrical charge.the easiest way is to take a blank pic, set the protect bit , cut it open, ebeam to find the protect bit , then take the protected pic, go to the same coordinates and erase it with the ebeam.

author: MikeW
author_rank: Regular Contributor
timestamp: July 20, 2015, 07:21:38 pm
content: Then please correct me?

author: tom66
author_rank: Super Contributor
timestamp: July 20, 2015, 07:25:39 pm
content: The data is stored in flash memory. Charges on capacitors. You can't directly read it by eye or by any obvious probing method, without destroying the data first. For the really early "mask rom" devices this was possible but not for modern flash based devices.There is an easier way, using carefully angled UV light it is possible to flip the "chip protect" bit. Bunnie has some information on this:http://www.bunniestudios.com/blog/?page_id=40

author: Richard Crowley
author_rank: Super Contributor
timestamp: July 20, 2015, 07:28:00 pm
content: 1) Microtoming is a mechanical process which will either fail to reveal the surface of the die or else destroy the die. It is NOT a practical method if you want to avoid destroying the die.A practical method of de-potting a typical injection-molded plastic IC package is to dissolve it in red fuming nitric acid, a particularly nasty material to contain, ship, and use.2) X-ray will not reveal the "position of the gates" (does that mean the value of the data bits?)Now, some types of scanning electron microscopes can read data values, but it seems much more practical to use a micromanipulator to probe the bond pads or even the internal circuit interconnect nodes.

author: MikeW
author_rank: Regular Contributor
timestamp: July 20, 2015, 07:31:17 pm
content: Quote from: Richard Crowley on July 20, 2015, 07:28:00 pmNot sure, it was quite an off the cuff conversation.Quote from: tom66 on July 20, 2015, 07:25:39 pmDude is 50 something years old, did security for IBM for twenty years or so. I think that's what he was talking about actually.Even if you can't do it anymore it's still fascinating to think about.QuoteThanks

author: hamster_nz
author_rank: Super Contributor
timestamp: July 21, 2015, 12:04:29 am
content: Quote from: MikeW on July 20, 2015, 07:14:26 pmFor some reason, this makes me think of XKCD #538 -https://xkcd.com/538/- perhaps it is because if you are sufficiently well resourced to get the information back this way, then I am pretty sure you could also get the contents back in a more cost effective way...

author: T3sl4co1l
author_rank: Super Contributor
timestamp: July 21, 2015, 07:36:21 am
content: Curious, I wonder if a tightly collimated x-ray beam could erase the lock bit, once you know where it is.Or, assuming you have a population of identically programmed chips, if you could x-ray them just until the lock bit flips, and reconstruct the data (which will be mostly obliterated, but in mostly random, but weighted, patterns i.e.), you might get a good enough (confidence > 99%?) idea of program and data to be able to reverse engineer and error correct it.Tim

author: marshallh
author_rank: Unknown
timestamp: July 21, 2015, 07:35:11 pm
content: That's what I did to extract program code from a mask rom MCU.It had to be stained a certain way to expose the implant layer (where the rom bits were).Will have a full presentation on the technique and stuff later on.