Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

What are the parameters in play, and what is a rough estimate of the hardness of the task of reading the contents of flash memory off a microcontroller? Of course, it is assumed that there is no conventional way to do it.

share|improve this question

1 Answer 1

It largely depends on the chip and the person that programmed it. Microcontrollers usually have a feature that allows you to pull the existing firmware binary off, but in many cases that can be disabled with a so-called "secure flag", which disables the download process until a new firmware is uploaded containing directives that turn the secure flag off. Of course, this wipes the existing firmware in the process. Check the datasheet for the microcontroller for specifics.

If it's a microprocessor (as opposed to a microcontroller) then there is usually no on-chip firmware, and the program code is stored externally on a memory device. Usually this will be an EEPROM or a mask ROM which you can interface with separately. I've done this with embedded systems that use SPI flash - just desolder it and hook it up to a Bus Pirate. If you can't desolder the device, it may also be possible to sniff the bus and gain information that way.

The universal way to get at the data is decapping. You get some strong acid (nitric acid is a common choice) that will eat away and the package compound, but not the silicon, and leave it in there for a day or two. You then take photographs with a digital microscope and use image processing to turn the patterns into data.

share|improve this answer
    
Can we get more details on the commands or steps one would take using a Bus Pirate? –  atdre Feb 17 at 22:36
    
@atdre It entirely depends on the flash chip. It could have an SPI or I2C interface, or something totally different. Then on top of that there'll be commands and steps that are unique to that device. It's impossible to give a catch-all. You have to read the datasheet and the BusPirate manual. –  Polynomial Feb 17 at 22:57
    
That's a fair answer. What would you do if you had a bigger budget and also pretend that Bus Pirate didn't exist. What would you use instead? Isn't the Bus Pirate just a glorified serial-friendly vesion of the Arduino but made by TI? –  atdre Feb 17 at 23:49
1  
The BusPirate is a device which is designed to be a programmable interface with various bus types, with minimal implementation overhead. It is designed for interfacing with individual components without supporting circuitry. It and the Arduino do two completely different things. Also, the BusPirate is made by Dangerous Prototypes, not TI. If I had a big budget I'd probably still use a BusPirate, simply because it's so easy to use. I would probably buy a proper logic analyser to support it, though. –  Polynomial Feb 18 at 13:14
1  
The BP comes with a set of female pins that connect to headers, but you can also buy alternative headers that has hook probes and tweezer clips. I use both. You can also clip various things into the standard headers anyway. It's mainly designed for easy integration into through-hole / breadboard stuff, as it primarily targets the hobbyist market. When I'm dealing with SMD stuff I usually use the tweezer clips (pincer style ones) to hook onto the leads. –  Polynomial Feb 18 at 16:56

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.