50

The ATmega microcontrollers generally have two lock bits, LB1 and LB2. One prevents further programming, and the other prevents the flash being read back. If both are set, the chip needs to be erased before it can be programmed again. This prevents the flash memory being read out and reverse engineered. Similar mechanisms can be found on many other microcontroller families.

Certain other processors have widely documented bypasses e.g. PIC 18F452, where an individual block can be erased and firmware be written to read out other blocks (documented in "Heart of Darkness - exploring the uncharted backwaters of HID iCLASSTM security").

From time to time, forum posts are made by companies offering their services to read out protected ATmega chips. There are also sites, generally .ru, that offer these services. Price tends to be around $500-$1500 with a turnaround time of a few weeks.

I suspect at these costs, they are not decapsulating the chip and using a laser probe to reset the fuse bits. I have queried if they return the chip undamaged, but did not get a response.

In this research ("Copy Protection in Modern Microcontrollers"), it is mentioned in the section "Non-Invasive Attacks on Microcontrollers" that many microcontrollers can have copy protection bypassed using clock, power or data glitching. However, I have not seen any practical examples or further research in this area.

Several years ago, glitching was very popular to bypass protection on the smart cards used in satellite TV receivers, but again, I have not found much information here outside of some circuit diagrams of the glitchers.

Does anyone have any further information on using glitching to bypass copy protection?

  • 9
    I hate making these congratulatory, unproductive statements, but AWESOME question. – ŹV - Apr 10 '13 at 16:42
  • The RussianSemiResearch company can read many MCUs with protection. – user3508 Dec 30 '13 at 19:53
  • Well, if locking is implemented properly, you cannot play around with boot loader to change lock bits and back read code. But at same time people have written to get avr unlocked for 500$, How do they achieve this? any idea? – user12494 May 12 '15 at 7:54
  • In this YouTube channel she do lots of practical examples about glitching and explaining every step, it may help you: youtube.com/channel/UCaEgw3321ct_PE4PJvdhXEQ. – de6f Feb 6 '17 at 8:51
15

What kind of further information are you looking for? I assume your goal is to read out the flash contents of an ATmega microcontroller. You found information on how the glitchers work, now I guess you want a confirmation that this is generally possible before committing to building one? In that case yes it's possible. I can't provide you any papers because it's based on practical experience (not necessarily on an ATmega mcu).

Since there is generally no way to provide the core clock to an embedded board yourself (unlike with smartcards) you'll have to do either power,laser or electromagnetic glitching. Assuming you'll do power you basically have to replace the core power source of the target by one provided by you. In this you can inject your power glitches (negative or positive).

There are many reasons why the copy protection might be bypassed all depending on the implementation of the protection mechanism. Some moments in time you can try are:

  • Just after a cold reset. Say the value of the copy protection bit is stored in OTP. A system performs some initialization just after reset. This can include the transfer of the protection bit value to an internal register. Glitching during this moment in time can for example 'cancel out' the transfer, change the value on the bus or prevent the value from being stored into the destination register.
  • Anytime during run-time. Glitching during run-time can affect any register. It's a wild shot but fun things can happen (hello JTAG unlock!)
  • During permission checking. If flash reading is protected, this means it has to verify at some point if you have permission. If you can affect the outcome of this decision it can grant you access to retrieve the contents
  • And there are many more you can think of, but also many reasons to what can prevent success (e.g. permanent physical disconnection of the JTAG interface with antifuses etc)
  • 2
    Thanks for the answer. I wasn't specifically wanting to bypass an ATmega, it was just an example of a microncontroller where there is no commonly known method. I was really looking for a practical hardware and software example of this - everything seems very wordy. – Cybergibbons Apr 11 '13 at 14:59
5

It's not directly targeted at bypassing copy protection, but there is substantial research in glitching embedded systems via fault injection by Jasper van Woudenberg. Applications of his research include manipulating branch decisions and leaking instructions and crypto keys, so there are likely avenues to apply it to your target as well.

Slides from his talk in 2012 may be found here: http://www.riscure.com/news-events/fault-injection-attacks-on-embedded-chips (more publications by the company may be found here)

He very recently gave a talk at Infiltrate 2013 that touched heavily in this area, so keep a look out for for slides and video from that.

Additionally, it may be worthwhile to learn about the Xbox 360 glitch hack and the process involved there.

  • Xbox glitch hack link is dead – Mellowcandle Jul 10 '15 at 13:25
1

In order to read out the flash contents for an Atmel AVR ATmega MCU,you can break the master chip. It doesn't return the chip undamaged, but provides the code and program.

  • Do you been decapping the chip and read the flash visually or using a laser? This is possible, but not the question I am asking. – Cybergibbons Aug 15 '13 at 13:30
0

This isn't really an answer to your question, but a different approach I've been thinking of for few hours.

From my experience, the locking of the JTAG port is done by software, by setting a specific register to a specific value. this information can easily be obtained from the manual of the microcontroller.

My idea is to attack from the software side, not the hardware.

Assumptions:

  1. The device allows in-field firmware update using USB, UART, etc.

  2. The firmware is not encrypted (well, from my experience it sometimes isn't).

My idea, is to alter the firmware file, and inject the specific opcode that clears the locking register.

This is only an idea, I never tried it before, but I guess it's possible....

  • If the locking is implemented correctly, it should be impossible to change the firmware without a reset. – nneonneo Apr 11 '13 at 13:45
  • I can't speak for all microcontrollers, But in Atmel's SAM3 (Arm Cortex M3) it's a bit which can be changed back and forth. – Mellowcandle Apr 11 '13 at 13:51
  • That's not much of a lock then, is it? I don't believe that's the case for their AVR controllers. – nneonneo Apr 11 '13 at 13:54
  • 1
    you're right regarding AVR's, as stated here: electronics.stackexchange.com/questions/53282/… – Mellowcandle Apr 11 '13 at 13:59
  • As this isn't about glitching, I don't think this should be an answer here. – Cybergibbons Apr 12 '13 at 2:10
-1

I have seen one of this companies in China, I have seen a lot of microscopes, so I assume the decapsulating the chip and do some modifications on the chip.

protected by Community Feb 4 '17 at 14:00

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.