Copy PIC soldered on board?

[dds]

Hi,

Is it possible to copy firmware from PIC (say PIC16F873A) which is already soldered on the board, if yes how? Just curious

Thanks.

[dimlow]

I was going to answer this, then i thought, but what if dds was going to copy my work? Would i be happy with this ? So i didnt

[migsantiago]

Hi,

Is it possible to copy firmware from PIC (say PIC16F873A) which is already soldered on the board, if yes how? Just curious

Thanks.

You have to unsolder it if there are no visible ICSP pins.

And the people who wrote the code for that PIC might have copy-protected it. So... it's a long shot.

[Mechatrommer]

You have to unsolder it if there are no visible ICSP pins.
And the people who wrote the code for that PIC might have copy-protected it. So... it's a long shot.

you can possibly tap the ICSP pins, but only if the circuit allows it and designed accordingly. but if its copy protected, then you'll have to use x-ray machine that nobody here could possibly afford it.

[alm]

you can possibly tap the ICSP pins, but only if the circuit allows it and designed accordingly. but if its copy protected, then you'll have to use x-ray machine that nobody here could possibly afford it.

Or you can pay some company to etch open the IC and disable the protection fuses for (a little over) a few bucks.

[Mechatrommer]

Or you can pay some company to etch open the IC and disable the protection fuses for (a little over) a few bucks.

but i believe that kind of company (or more precisely... service) is not available in western or near our region country. perharps in China. so i should add, you have to buy 2way ticket to China to pay to the company ... with condition.... you are not in China!

[dds]

Could be a possibility to connect PickIt 3 programmer/debugger to PIC16F873A soldered on board and  copy contents of it?

[Simon]

it will depend on the circuitry around the pic, to much capacitance or too low resistance will upset the signals integrity

[Mechatrommer]

Could be a possibility to connect PickIt 3 programmer/debugger to PIC16F873A soldered on board and  copy contents of it?

yes, there is possibility, but as i and Simon said, it depends. the only thing for sure is you can do what ppl have suggested here, click the "Read" button. if its succesfull or not, then i'll be glad to hear from you and see the picture of your circuit. if its not success then perharps we all will be glad to analyze your picture why its cant. Cheers
if you have dismantled it from the circuit and still no success, then you can refer to the above posts indicating you have to buy 2way ticket

[dds]

I always wanted to see Shenzhen

[alm]

but i believe that kind of company (or more precisely... service) is not available in western or near our region country.

I believe it is also available within Silicon Valley.

perharps in China. so i should add, you have to buy 2way ticket to China to pay to the company ... with condition.... you are not in China!

Either that, or a stamp, whichever is cheaper .

[Mechatrommer]

I always wanted to see Shenzhen

I always wanted to see Shenzhen girls . (the real one, not in the net)

I believe it is also available within Silicon Valley.

and the silicon girls

[marianoapp]

I remember reading about a method to read the contents of a protected pic, it involved erasing the pic and measuring the current consumption change during the process. The idea is that when the pic is changing a bit from 1 to 0 (or the other way around, I can't remember) it uses more power than if the bit is already a 0.

The downside is that you have only one chance to do it right.


[if you're trying to steal someone else's work, don't]

[JohnS_AZ]

I'm trying to think of a reason to do this that doesn't involve stealing someone else's software.

Step 1- Learn PIC programming.
Step 2- Write your own code.

[dds]

I remember reading about a method to read the contents of a protected pic, it involved erasing the pic and measuring the current consumption change during the process. The idea is that when the pic is changing a bit from 1 to 0 (or the other way around, I can't remember) it uses more power than if the bit is already a 0.

Do you think of this: http://en.wikipedia.org/wiki/Power_analysis

?

[dds]

I'm trying to think of a reason to do this that doesn't involve stealing someone else's software.

Step 1- Learn PIC programming.
Step 2- Write your own code.

Nothing will be stealed or used commercially or published ..actually lot of *very* similar products are open sourced with blueprints flying all over Internet But you're right..I should go first through steps 1 and two

[migsantiago]

I remember reading about a method to read the contents of a protected pic, it involved erasing the pic and measuring the current consumption change during the process. The idea is that when the pic is changing a bit from 1 to 0 (or the other way around, I can't remember) it uses more power than if the bit is already a 0.

The downside is that you have only one chance to do it right.


[if you're trying to steal someone else's work, don't]

That's an interesting theory.

What I'm not so sure of is... in order to erase a PIC, a single command is sent, so you can't actually have an exact timing or clock source to sample the current consumption.

I mean, every PIC must have a different erasing time. So, how would you know when a 1 is being erased or a 0?

A neat theory... any one interested in working it out? 

[Mechatrommer]

That's an interesting theory.
What I'm not so sure of is... in order to erase a PIC, a single command is sent, so you can't actually have an exact timing or clock source to sample the current consumption.
I mean, every PIC must have a different erasing time. So, how would you know when a 1 is being erased or a 0?
A neat theory... any one interested in working it out? 

or maybe we make a device to sense the electromagnet around it. who knows, when erasing 0,1... there will be some electromagnet signature for it?

[joelby]

There's some good introductory information on reverse engineering at http://www.cl.cam.ac.uk/~sps32/mcu_lock.html . The invasive PIC attacks sound incredibly straightforward!

The remainder of this researcher's pages talk about more sophisticated attacks such as timing and power analysis.

[Mechatrommer]

good info! for criminal and soldiers in war i think.

[Zero999]

Bah, I don't like copy protection and will never use it myself, unless I have to do something for a company which pays me a lot. I see deliberatively stopping the customer from seeing how a product works is kind of deceitful in itself.

As far as so called code theft is concerned, you're not really stealing anything, yes it's breaking the law but it's classed as copyright violation not theft. Code protection doesn't actually stop big companies from using code written by others because they can afford to get the code protection circumvented. Code protection just makes it harder for hobbyists to learn and repair devices, like any other form of DRM it inconveniences the honest majority more than those who want to commit software piracy.

[cybergibbons]

I've attempted to use differential power analysis to look into what was going on inside a PIC clone. Hmm. It's not very easy to do really, especially with hobbyist level equipment.

You stick a small value resistor in the ground line of the processor and measure the voltage. Too low a resistance and you lose the data in the noise, too high and the processor drops out.

The memory depth (2Msamples) on my scope is very limiting, as well as the speed at which I can shift it out to my computer (10-15mins). I can't capture an entire sequence from start to finish (as I could really be doing simple power analysis if I could), so I need to carefully trigger the capture at several different points. Then I need to do this many times, and perform autocorrelation in both time and sample direction.

[Mechatrommer]

@cyber: so meaning, you are close... and there is possibility to observe the data, given a bit of higher spec'ed gear?

[Murphy]

Interesting!
What about using a comparator circuit and a logic analyzer (or bus pirate?)?

[cybergibbons]

It's not so much that you can work out the code inside the chip - really it is useful when you suspect the chip is using a certain algorithm. You can tell the difference between reading from registers, RAM, and flash. You can also identify different mathematical functions.