Copy PIC soldered on board? - Page 1
Forum section: electronics / beginners

author: dds
author_rank: Contributor
timestamp: October 18, 2010, 01:45:35 pm
content: Hi,Is it possible to copy firmware from PIC (say PIC16F873A) which is already soldered on the board, if yes how? Just curiousThanks.

author: dimlow
author_rank: Frequent Contributor
timestamp: October 18, 2010, 01:57:42 pm
content: I was going to answer this, then i thought, but what if dds was going to copy my work? Would i be happy with this ? So i didnt

author: migsantiago
author_rank: Frequent Contributor
timestamp: October 18, 2010, 02:22:15 pm
content: Quote from: dds on October 18, 2010, 01:45:35 pmYou have to unsolder it if there are no visible ICSP pins.And the people who wrote the code for that PIC might have copy-protected it. So... it's a long shot.

author: Mechatrommer
author_rank: Super Contributor
timestamp: October 18, 2010, 04:55:42 pm
content: Quote from: migsantiago on October 18, 2010, 02:22:15 pmyou can possibly tap the ICSP pins, but only if the circuit allows it and designed accordingly. but if its copy protected, then you'll have to use x-ray machine that nobody here could possibly afford it.

author: Unknown
author_rank: Unknown
timestamp: October 18, 2010, 05:17:27 pm
content: Quote from: shafri on October 18, 2010, 04:55:42 pmOr you can pay some company to etch open the IC and disable the protection fuses for (a little over) a few bucks.

author: Mechatrommer
author_rank: Super Contributor
timestamp: October 18, 2010, 05:32:35 pm
content: Quote from: alm on October 18, 2010, 05:17:27 pmbut i believe that kind of company (or more precisely... service) is not available in western or near our region country. perharps in China. so i should add, you have to buy 2way ticket to China to pay to the company... with condition.... you are not in China!

author: dds
author_rank: Contributor
timestamp: October 18, 2010, 05:53:40 pm
content: Could be a possibility to connect PickIt 3 programmer/debugger to PIC16F873A soldered on board and copy contents of it?

author: Simon
author_rank: Unknown
timestamp: October 18, 2010, 05:59:45 pm
content: it will depend on the circuitry around the pic, to much capacitance or too low resistance will upset the signals integrity

author: Mechatrommer
author_rank: Super Contributor
timestamp: October 18, 2010, 06:13:15 pm
content: Quote from: dds on October 18, 2010, 05:53:40 pmyes, there is possibility, but as i and Simon said, it depends. the only thing for sure is you can do what ppl have suggested here, click the "Read" button. if its succesfull or not, then i'll be glad to hear from you and see the picture of your circuit. if its not success then perharps we all will be glad to analyze your picture why its cant. Cheersif you have dismantled it from the circuit and still no success, then you can refer to the above posts indicating you have to buy 2way ticket

author: dds
author_rank: Contributor
timestamp: October 18, 2010, 06:25:54 pm
content: I always wanted to see Shenzhen

author: Unknown
author_rank: Unknown
timestamp: October 18, 2010, 06:33:50 pm
content: Quote from: shafri on October 18, 2010, 05:32:35 pmI believe it is also available within Silicon Valley.Quote from: shafri on October 18, 2010, 05:32:35 pmEither that, or a stamp, whichever is cheaper.

author: Mechatrommer
author_rank: Super Contributor
timestamp: October 18, 2010, 06:37:04 pm
content: Quote from: dds on October 18, 2010, 06:25:54 pmI always wanted to see Shenzhen girls. (the real one, not in the net)Quote from: alm on October 18, 2010, 06:33:50 pmand the silicon girls

author: marianoapp
author_rank: Regular Contributor
timestamp: October 18, 2010, 08:12:00 pm
content: I remember reading about a method to read the contents of a protected pic, it involved erasing the pic and measuring the current consumption change during the process. The idea is that when the pic is changing a bit from 1 to 0 (or the other way around, I can't remember) it uses more power than if the bit is already a 0.The downside is that you have only one chance to do it right.[if you're trying to steal someone else's work, don't]

author: JohnS_AZ
author_rank: Frequent Contributor
timestamp: October 18, 2010, 08:25:35 pm
content: I'm trying to think of a reason to do this that doesn't involve stealing someone else's software.Step 1- Learn PIC programming.Step 2- Write your own code.

author: dds
author_rank: Contributor
timestamp: October 18, 2010, 08:30:26 pm
content: Quote from: marianoapp on October 18, 2010, 08:12:00 pmDo you think of this:http://en.wikipedia.org/wiki/Power_analysis?

author: dds
author_rank: Contributor
timestamp: October 18, 2010, 08:38:25 pm
content: Quote from: JohnS_AZ on October 18, 2010, 08:25:35 pmNothing will be stealed or used commercially or published ..actually lot of *very* similar products are open sourced with blueprints flying all over InternetBut you're right..I should go first through steps 1 and two

author: migsantiago
author_rank: Frequent Contributor
timestamp: October 19, 2010, 02:08:43 am
content: Quote from: marianoapp on October 18, 2010, 08:12:00 pmThat's an interesting theory.What I'm not so sure of is... in order to erase a PIC, a single command is sent, so you can't actually have an exact timing or clock source to sample the current consumption.I mean, every PIC must have a different erasing time. So, how would you know when a 1 is being erased or a 0?A neat theory... any one interested in working it out?

author: Mechatrommer
author_rank: Super Contributor
timestamp: October 19, 2010, 03:51:41 am
content: Quote from: migsantiago on October 19, 2010, 02:08:43 amor maybe we make a device to sense the electromagnet around it. who knows, when erasing 0,1... there will be some electromagnet signature for it?

author: joelby
author_rank: Frequent Contributor
timestamp: October 19, 2010, 04:36:09 am
content: There's some good introductory information on reverse engineering athttp://www.cl.cam.ac.uk/~sps32/mcu_lock.html. The invasive PIC attacks sound incredibly straightforward!The remainder of this researcher's pages talk about more sophisticated attacks such as timing and power analysis.

author: Mechatrommer
author_rank: Super Contributor
timestamp: October 19, 2010, 10:13:19 am
content: good info! for criminal and soldiers in war i think.

author: Zero999
author_rank: Super Contributor
timestamp: October 19, 2010, 11:37:21 am
content: Bah, I don't like copy protection and will never use it myself, unless I have to do something for a company which pays me a lot.I see deliberatively stopping the customer from seeing how a product works is kind of deceitful in itself.As far as so called code theft is concerned, you're not really stealing anything, yes it's breaking the law but it's classed as copyright violation not theft. Code protection doesn't actually stop big companies from using code written by others because they can afford to get the code protection circumvented. Code protection just makes it harder for hobbyists to learn and repair devices, like any other form of DRM it inconveniences the honest majority more than those who want to commit software piracy.

author: cybergibbons
author_rank: Frequent Contributor
timestamp: October 19, 2010, 09:28:59 pm
content: I've attempted to use differential power analysis to look into what was going on inside a PIC clone. Hmm. It's not very easy to do really, especially with hobbyist level equipment.You stick a small value resistor in the ground line of the processor and measure the voltage. Too low a resistance and you lose the data in the noise, too high and the processor drops out.The memory depth (2Msamples) on my scope is very limiting, as well as the speed at which I can shift it out to my computer (10-15mins). I can't capture an entire sequence from start to finish (as I could really be doing simple power analysis if I could), so I need to carefully trigger the capture at several different points. Then I need to do this many times, and perform autocorrelation in both time and sample direction.

author: Mechatrommer
author_rank: Super Contributor
timestamp: October 19, 2010, 11:18:08 pm
content: @cyber: so meaning, you are close... and there is possibility to observe the data, given a bit of higher spec'ed gear?

author: Murphy
author_rank: Regular Contributor
timestamp: October 24, 2010, 07:22:48 pm
content: Interesting!What about using a comparator circuit and a logic analyzer (or bus pirate?)?

author: cybergibbons
author_rank: Frequent Contributor
timestamp: October 31, 2010, 09:20:58 pm
content: It's not so much that you can work out the code inside the chip - really it is useful when you suspect the chip is using a certain algorithm. You can tell the difference between reading from registers, RAM, and flash. You can also identify different mathematical functions.