Author Topic: Reading out Maskrom Data The Hardway  (Read 1563 times)

0 Members and 1 Guest are viewing this topic.

Offline Sionyn

  • Frequent Contributor
  • **
  • Posts: 848
  • Country: gb
Reading out Maskrom Data The Hardway
« on: February 08, 2013, 10:35:04 am »
Recovering code or data is nothing new, but the old problem of recovering Masked ROM through visual inspection normally done by crowd sourcing this guy has automated this his new software tool.
eecs guy

Offline amyk

  • Super Contributor
  • ***
  • Posts: 7444
Re: Reading out Maskrom Data The Hardway
« Reply #1 on: February 08, 2013, 11:56:24 am »
Not particularly difficult compared to e.g. handwriting recognition or other visual processing tasks, as all the bits are already nicely arranged and ready to be read.

Offline free_electron

  • Super Contributor
  • ***
  • Posts: 7653
  • Country: us
    • SiliconValleyGarage
Re: Reading out Maskrom Data The Hardway
« Reply #2 on: February 08, 2013, 02:21:41 pm »
There's a far easier way.. Which is what the pro's use.

Get a hold of a blank chip. Scan
Set the 'read protect' fuse. Scan
Fuse coordinates are bo known.

Decapsulate the chip to be reverse engineered. Flip read protect fuse. Dump. Done.

Eeprom and flash rom cells can be scanned using an e-beam prober. This machine can detect the gate charges. They use an electron beam to sweep the chip surface. Current change means voltage change in the chip. So you get a clear map of the bits immediately. Once you got the coordinates of the fusebits you can use the e-beam to 'write' its state...

The reverse engineering shops have tables with the coordinates of the fuses for al ost anything out there.

A harder way is to use self decrypting code. Read crypto key from outside the chip and have the program instructions being decrypted on the fly. Then probing gets you nowhere as you don't have the key. Only the cypher code and the encrypted program code. The cypher itself is missing.
Professional Electron Wrangler.
Any comments, or points of view expressed, are my own and not endorsed , induced or compensated by my employer(s).

Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo