I am trying to read the cryptographic key from my car key fob for exploration, basically seeing if I can clone it.
I popped open the case and I see it's using a Microchip HCS361. The HCS361 stores it's key in internal EEPROM that cannot be read during normal operation.
However, the datasheet says that "At the end of the programming cycle, the device can be verified by reading back the EEPROM". The mentioned programming cycle is just writing the EEPROM.
I was thinking that maybe it is possible to perform a voltage glitching attack on the chip to make it think that it has just been programmed so that EEPROM can be read.
The feasibility of this clearly depends on how the read protection is implemented on the chip. I would think that it would be basically a check if a certain bit is set in a register but I'm not sure. If this is the case, it should theoretically be possible to bypass that instruction via glitching.
Based on the following diagram for how to perform the verification,
I wrote a small Arduino sketch that does the following:
1. Set S1 and S3 to high
2. Perform the glitch
3. Clock S3 and read from DATA
and retries with different glitch times.
Most of the time, I get the expected PWM data on the DATA line that is transmitted on a button press. However, as the glitches get longer, I get more and more 0's.
Is this method even remotely feasible or should I just program the chip and relearn it to my car?
