Need a help for chip dump - Page 1
Forum section: electronics / general

author: xtremeloader
author_rank: Newbie
timestamp: April 04, 2014, 05:11:54 pm
content: Hi guys,I'm new in this forum and new in chips world. I just have a problem to dump a chip (from Aoyue 968a+ soldering station) and I think it is protected with a lock bits. I need to dump it because I have another same soldering station that have a problem with its chip. It was breaked due a problem with some high voltages.Situation: when I read it, it reads like a blank chip!Programmer: MiniPro TL866A.Can you guys help me with this please? Which technic or programmer to use for unlock this protection.Thank you advance...

author: amyk
author_rank: Super Contributor
timestamp: April 05, 2014, 03:46:55 pm
content: Is it similar to this model?https://www.eevblog.com/forum/reviews/youyue-858d-some-reverse-engineering-custom-firmware/Yes it's possible to break code protection, but for the $$$ it takes you'd probably be better off buying a new one or writing your own firmware.

author: JoeN
author_rank: Frequent Contributor
timestamp: April 06, 2014, 02:09:24 am
content: I am not seeing a microcontroller model so I don't know how anyone can give you any advice on this. But, just because you have an (E)(E)PROM programmer doesn't mean you will be able to program any particular microcontroller out there, most of them now use proprietary programming formats to allow debugging rather than just presenting a generic ROM programming parallel interface. Of all the microcontrollers I have programmed over the last few years, only some old 8051s from Atmel forced me to use my (E)(E)PROM programmer. Other than that, I tend to use it on actual (E)(E)PROMs.

author: xtremeloader
author_rank: Newbie
timestamp: April 08, 2014, 12:06:49 am
content: Quote from: amyk on April 05, 2014, 03:46:55 pmNo I have a AT89C52.

author: poorchava
author_rank: Super Contributor
timestamp: April 08, 2014, 08:15:53 am
content: Breaking code protection is difficult, expensive and resource consuming. In general you can't pull out the data from protected chip using a normal programmer. Most approach is to decap the chip without damaging it and then probe it (i suppose a ghetto setup could be made for a few thousand $).In case there is a bootloader of some sort or other application with which you can communicate, you MAY be able to find some exploit, that gives you code execution, then load instructions to dump program memory byte by byte. With bootloader you can sometimes use some sort of borderline condition attack like power or reset line glitching. I may get you somewhere, it may not.If it's aoyue you better buy new station or just frite FW yourself (it's gonna be better than the one in original station anyway)

author: dannyf
author_rank: Super Contributor
timestamp: April 08, 2014, 10:51:22 am
content: QuotePutting aside the legality of it, you are essentially asking people to provide you with free services that otherwise would fetch maybe a few hundred to a few thousand dollars on the market.You have a better chance just asking for the money to pay for someone to hack it for you.

author: amyk
author_rank: Super Contributor
timestamp: April 09, 2014, 01:46:29 pm
content: Quote from: xtremeloader on April 08, 2014, 12:06:49 amhttp://www.cl.cam.ac.uk/~sps32/mcu_lock.htmlsuggests "power glitch" might work.http://russiansemiresearch.com/en/service/will charge you $850 to do it.For that cost, it might be worth investing into writing your own firmware instead. The TL866A supports the AT89C52.

author: wraper
author_rank: Unknown
timestamp: April 09, 2014, 02:41:31 pm
content: Power glitch protection unlock worked on very old date code AT89C51/52. That was fixed in early 2000's IIRC. Very unlikely that you have a microcontroller that old unless they used really old stock. The trick was to start erasing and shut down the power almost instantly. Lock bit became erased while firmware itself remained intact (first byte often got also corrupted but could be easily restored by manual brute force).

author: JoeN
author_rank: Frequent Contributor
timestamp: April 09, 2014, 06:31:58 pm
content: Quote from: amyk on April 09, 2014, 01:46:29 pmWOW. There are a lot of really current processors on their list. Do you think they can pull this off, and how at this price?

author: amyk
author_rank: Super Contributor
timestamp: April 09, 2014, 09:01:22 pm
content: Probably decap + probe. I glanced through the list and none of those are high-security MCUs, so just resetting the lock bits is probably enough.The Russians and Chinese almost seem to exclusively specialise in this stuff... here's one of the Chinese ones (with a most interesting name):http://www.mcu-crack.com/en/services.html

author: casinada
author_rank: Frequent Contributor
timestamp: April 09, 2014, 09:15:03 pm
content: I would suggest you to send it back for repairs. The unit costs between $150 and $200 new.I have a similar unit based on the AVR processor (Gordak). They sent me a programmed microcontroller and didn't solve the problem. ($10)I had to send the unit back for repair ($50 shipping)Frustrating because the dead processor problem is not that uncommon. Please do a search on this blog.

author: GiskardReventlov
author_rank: Frequent Contributor
timestamp: April 10, 2014, 03:55:50 pm
content: When they decap do they grind the chip down or do they split it open? Both?Can STEM (scanning tunneling electron microscope) be used? What about ultrasound?Why even bother for something $100-200 dollars.

author: poorchava
author_rank: Super Contributor
timestamp: April 11, 2014, 08:01:05 am
content: look it up on the internet. In general it goes like that:-if you don't know the chip buy a dozen pieces to analyse and get familiar with chip layout and potential problems-choose attack method. Most common approaches are to either reset the lock bit nvm cell or to spy the busses where data and code are fetched. More advanced techniques include chip modification with FIB, backside attacks etcTo open a chip the most common method is to use hot fuming nitric acid while also keeping the chip hot. Bulk of the material from the top of the die can be removed mechanically if necessary. There are also specialized epoxy strippers, which may be be necessary if the chip uses copper bonding wire. While gold is impervious to nitric acid, the copper will get eaten away and the chip will have to be re-bonded which is not trivial and very expensive.Ultrasonic microscopes are more useful for diagnosing internal physical damage for example when die delamination/popcorning is suspected. It's a part of almost every company's failure analysis procedure.Check youtube for Christopher Tarnovsky

author: GiskardReventlov
author_rank: Frequent Contributor
timestamp: April 11, 2014, 10:25:13 pm
content: Quote from: poorchava on April 11, 2014, 08:01:05 amOk, I guess I can "look it up on the internet". But then we'd all stop conversing/discussing things.But back to the topic, for the OP purposes, it's like using a wrecking ball to hang a picture on a wall.I will check that out on utube.