Bypassing copy protection in microcontrollers using glitching

Question

The ATmega microcontrollers generally have two lock bits, LB1 and LB2. One prevents further programming, and the other prevents the flash being read back. If both are set, the chip needs to be erased before it can be programmed again. This prevents the flash memory being read out and reverse engineered. Similar mechanisms can be found on many other microcontroller families.

Certain other processors have widely documented bypasses e.g. PIC 18F452, where an individual block can be erased and firmware be written to read out other blocks (documented in "Heart of Darkness - exploring the uncharted backwaters of HID iCLASSTM security").

From time to time, forum posts are made by companies offering their services to read out protected ATmega chips. There are also sites, generally .ru, that offer these services. Price tends to be around $500-$1500 with a turnaround time of a few weeks.

I suspect at these costs, they are not decapsulating the chip and using a laser probe to reset the fuse bits. I have queried if they return the chip undamaged, but did not get a response.

In this research ("Copy Protection in Modern Microcontrollers"), it is mentioned in the section "Non-Invasive Attacks on Microcontrollers" that many microcontrollers can have copy protection bypassed using clock, power or data glitching. However, I have not seen any practical examples or further research in this area.

Several years ago, glitching was very popular to bypass protection on the smart cards used in satellite TV receivers, but again, I have not found much information here outside of some circuit diagrams of the glitchers.

Does anyone have any further information on using glitching to bypass copy protection?

Answer 1

What kind of further information are you looking for? I assume your goal is to read out the flash contents of an ATmega microcontroller. You found information on how the glitchers work, now I guess you want a confirmation that this is generally possible before committing to building one? In that case yes it's possible. I can't provide you any papers because it's based on practical experience (not necessarily on an ATmega mcu).

Since there is generally no way to provide the core clock to an embedded board yourself (unlike with smartcards) you'll have to do either power,laser or electromagnetic glitching. Assuming you'll do power you basically have to replace the core power source of the target by one provided by you. In this you can inject your power glitches (negative or positive).

There are many reasons why the copy protection might be bypassed all depending on the implementation of the protection mechanism. Some moments in time you can try are:

• Just after a cold reset. Say the value of the copy protection bit is stored in OTP. A system performs some initialization just after reset. This can include the transfer of the protection bit value to an internal register. Glitching during this moment in time can for example 'cancel out' the transfer, change the value on the bus or prevent the value from being stored into the destination register.
• Anytime during run-time. Glitching during run-time can affect any register. It's a wild shot but fun things can happen (hello JTAG unlock!)
• During permission checking. If flash reading is protected, this means it has to verify at some point if you have permission. If you can affect the outcome of this decision it can grant you access to retrieve the contents
• And there are many more you can think of, but also many reasons to what can prevent success (e.g. permanent physical disconnection of the JTAG interface with antifuses etc)

Answer 2

It's not directly targeted at bypassing copy protection, but there is substantial research in glitching embedded systems via fault injection by Jasper van Woudenberg. Applications of his research include manipulating branch decisions and leaking instructions and crypto keys, so there are likely avenues to apply it to your target as well.

Slides from his talk in 2012 may be found here: http://www.riscure.com/news-events/fault-injection-attacks-on-embedded-chips (more publications by the company may be found here)

He very recently gave a talk at Infiltrate 2013 that touched heavily in this area, so keep a look out for for slides and video from that.

Additionally, it may be worthwhile to learn about the Xbox 360 glitch hack and the process involved there.

Answer 3

In order to read out the flash contents for an Atmel AVR ATmega MCU，you can break the master chip. It doesn't return the chip undamaged, but provides the code and program.

Answer 4

This isn't really an answer to your question, but a different approach I've been thinking of for few hours.

From my experience, the locking of the JTAG port is done by software, by setting a specific register to a specific value. this information can easily be obtained from the manual of the microcontroller.

My idea is to attack from the software side, not the hardware.

Assumptions:

1. The device allows in-field firmware update using USB, UART, etc.

2. The firmware is not encrypted (well, from my experience it sometimes isn't).

My idea, is to alter the firmware file, and inject the specific opcode that clears the locking register.

This is only an idea, I never tried it before, but I guess it's possible....

Answer 5

I have seen one of this companies in China, I have seen a lot of microscopes, so I assume the decapsulating the chip and do some modifications on the chip.