Protecting Intellectual Property

[ow19m]

Hi ,
I am designing a Complex system and I was wondering about ways someone can protect  intellectual property to keep hackers from breaching in , can someone list possible ways I should be considering at the manufacture stage ?. Also if I remove labels from all the IC's , is it possible to track what IC it could possibly be from for example chinese companies  , for example if I remove a mcu's label ,would it be possible to know which company that mcu belonged to , let alone find what of all the possible controllers with the same footprint ,the exact chip number ?.

Thanks

[ataradov]

Forget about it, if you come up with anything really interesting, it will be copied within days if someone really wants. Figuring out ICs is trivial.

The only reliable protection is to have cloud connectivity and make the device useless without that connection. But this is extremely annoying to the customers.

Realistically, just do the bare minimum (set lock bits on the devices and stuff like that) and hope for the best.

Using more expensive parts and larger variety of parts may help too, but it will obviously make the product less attractive to your own customers.

[ow19m]

Well maybe your right, the design is basically a 3 phase 100KVA welding Inverter , only a handful of companies have designed such a beast , I'm doubtful it would be that easy to just breakopen everything with over 300+ parts , 8 PCBS. It's not easy to test something that doesnt do continous operation and 440v running through most of the boards  and we're talking about debugging different driver , IGBT boards , CPU.My question is the preventive measures I can take off and the hard truths I'm missing , off course otherwise anything is possible.

thanks,   

[ataradov]

Well, so you already follow my advice on making the device too complicated to copy because of many parts. And in your case mechanical design matters too.

You are already in a good place. Rubbing off IC marking is a waste of time. Don't bother, in all cases where is mattered ICs were figured out instantly. Just set lock bits on the MCUs and you will be fine.

[ow19m]

One possible way to hack into a processor is side channel attack , that too isn't possible without knowing the chip number  I believe  , Just for knowledges sake ? why do you think removing labels is a waste?

[elecman14]

Removing part numbers could slow down reverse engineering efforts. An advanced persistent threat could
just decap the chips and look at die markings and pinout on the PCB to determine what device you are using. It really depends on the threat model you are concerned about for cloning. After working in manufacturing having an operator with a tool capable of removing plastic near components is a thing that would keep me up at night. If you are serious about this you may want to look into fixturing the PCB with a shield to prevent damage to surrounding components.

[ataradov]

One possible way to hack into a processor is side channel attack , that too isn't possible without knowing the chip number  I believe  , Just for knowledges sake ?

It is trivial to find out the processor by pinout and package type. There are not too many combinations out there. Even if you are very confused, anyone can use a bit of acid and extract the die. It is not as trivial, but it is the level of effort I would expect if I were about to copy the device.

why do you think removing labels is a waste?

Because it has been historically shown to be a waste. I can't name a single case where removing the labels helped to hide the device type. Furthermore, people sometimes do it for fun just in spite. So erasing package marking attracts more attention than it should. And it also forces people to reverse engineer at least part of the board around your device to figure out what it is. Dave did it multiple times during the teardowns and there were multiple topics in this forum.

It is more productive to remove labels from power devices, especially in standard packages like TO-220. But again, it is a protection against straight up copy-paste. But anyone intelligent would adopt the design to their available parts anyway.

You have finite amount of time to spend on that product and its protection, but if your product is valuable, copying people will spend a lot more time on copying it.

Also, using more obscure parts like Holtek and Padauk may slow things down quite a bit, since they would be the last in line to be checked.

[free_electron]

put some components in it that are specifically designed for you.

[ataradov]

put some components in it that are specifically designed for you.

Is it really feasible for a small volume production?

Custom MCU pinouts are possible from most vendors, but your minimum order quantity would be 10K-100K units.

You may also want to consider creating custom epoxy filled sub-modules. It will not stop copying, but will certainly slow down the effort.

And as usual, in may cases there is no need to actually copy the low power stuff. Copy high power design and re-implement low power stuff using any MCU you like.  Even people in China rarely copy designs 1:1. They have plenty of smart people capable of taking the ideas and going with them.

[elecman14]

...
You may also want to consider creating custom epoxy filled sub-modules. It will not stop copying, but will certainly slow down the effort.
...

Epoxy filed modules (potting) are not super fun to deal with on the manufacturing side. It also complicates troubleshooting and failure analysis and has its own set of design issues like thermal expansion, temperature dissipation, mechanical stress, etc... If you want to live with all that it does make it harder to reverse engineer.

[Doctorandus_P]

How much intellectual property is there in a welding converter anyway?

As you already said, the 100kW market for these things probably is not very big and it probably is a "professional" market.
How many of your potential customers would even be interested in a cheap knockoff of your welder?

These things are going to cost an arm and a leg anyway. Maybe you will sell one or two of them to your direct competitors if your thing can do something that theirs version can't, and they will probably only be interested in some specific details.

Rubbing off type numbers only annoys hobbyists and repair people, as it may slow them down for 20 minutes to a few hours.

There are companies in reverse engineering stuff. Extracting machine code of almost any uC cost a few hundred EUR, and so does getting a set of Gerber files from a PCB. Layer count don't matter much, the PCB is just sanded down layer by layer, photographed and processed.

[ow19m]

@Doctorandus_P , where I live there are no competitors for welding inverters , firstly ,imported inverters are very expensive , also nothing last for ever , you know at some point you'll have maintenance issues in which case you'll have to send it back to the company  , they will charge you money and send it back which people aren't willing to do. I have contacts with automotive industries that are setup here like KIA , SUZUKI ,COROLLA, CHANGAN  , HONDA  and even more , non of them have inverters installed ,, hence big electricity bills and I'm sure it costs them the quality weld as well . trust me nobody wants to order 1000 welding inverters in a company  where your bound to have maintaince issues and nobody in the country is willing to fix it  , plus waste of time on the assembly line . and calling someones product a "cheap knockoff" is a harsh statement without even looking at the design . 

[JPortici]

Every piece of hardware can be copied / adapted / replicated.
Don't bother making it too difficult to do, instead you should focus on what CAN'T be copied which is support and customer care. Technical support, customer training, responsiveness in addressing problems/complaints/fixes/adding features, possibly customization.
The customer has to come to your company because they want to deal with your company, not just buy your product and that what lets you charge xxx more than the competitor/replica/knockoff

[PKTKS]

(.)
The only reliable protection is to have cloud connectivity and make the device useless without that connection. But this is extremely annoying to the customers.
(.)

... infrastructure as a service (IaaS) or software as a service (SaaS)...


Chinese security CAM are doing this...   it is a shit show...

The cams depend on Internet to setup  and promote a useless product 50% of times..

Consumers will eventually ditch that sort of CLOUD crap stored on someone else rack

Paul

[ow19m]

So basically if there were no copy violations , china would have made an exact copy of iphone ,ps4, with the exact same QUALITY and DURABILITY ? Last time I saw something copied ,was even worse then the original one  , anyone ? 

[PKTKS]

Not like that ...  a long time now...

For quite some time... all production of low level has moved ..
mostly to these facilities ... 

Not so long ago a folk published a trip made to China where he - armed with a list of parts - bought each one piece by piece...  mounted ....  all iphone parts...

He went back to hotel room and assembled the so called incredible iphone in hour or so...
Since the big corporations  decided to outsource production.. things are not  that simple...

Mostly moved by greed and some weird concepts attached to brand... instead of craftsman ...

Greed have bad side effects..

Paul

[PKTKS]

Here .. have fun with this...

I am not sure if this is the same folk of years ago...
because so many people copy that idea... a simple search will put dozen others...



Paul

[dietert1]

Fun to remember. Maybe 25 years ago i built a 3 KW inverter for a photovoltaic setup (island solution with 48 V lead battery as storage). It was a prototype and the contract was with an engineer who worked at Brown Boveri Corp. I remember setting up the MCU with part of the firmware in a battery backup RAM, where the battery was connected with an intrusion protection (mechanical switch). So as soon as anybody would lift the cover or pull the MCU card, it would be dead within seconds.
That happened more than once. Don't know whether they reengineered it or not.

Regards, Dieter

[ataradov]

china would have made an exact copy of iphone ,ps4, with the exact same QUALITY and DURABILITY ?

No, why wold they bother? They need their stuff to look close enough and last long enough to make a sale.

There are two goals of copying. First one is to make the product cheap and sell it at a good markup informed by the price of the original. This is what China does easily.

The second one is to make an off-brand replica with basically the same internals, but with modified physical design to distance from the original. That copy may be a bit cheaper than the original, but that would be mostly due to lower margin the maker is willing to take, since they did not spend any money on R&D. This is what "western" companies do.

And iPhone is a special case, since it is full of proprietary parts and tied to the cloud.

[SiliconWizard]

I am designing a Complex system and I was wondering about ways someone can protect  intellectual property to keep hackers from breaching in , (...)

Apart from what has already been said, I'm wondering what your goal exactly is. Do you want to protect your product so that it's not easily copied (which could harm your sales), or do you want to protect it against "hackers" for security reasons? Everyone has assumed it was for the first reason, and I guess it sounds so, but just to make sure.

One thought is that one of the main reasons your product may eventually get copied is if it's very successful. Apart from nerds in their basement, nobody (and especially no company) is going to bother copying a product unless it has already proven to be successful. That's the whole point: it saves R&D sure, but also all the marketing. And if this is the case, that would be good news for you, really. When one of your products becomes successful enough to get copied on a scale large enough to impact you, that means you did a good job and that it's time to design a new product (but don't wait for that, start right away!)

Now as with door locks and most security measures, the only thing you can do is to make it a bit slower to copy, you will never be able to prevent this completely. I agree with scratching labels on ICs being almost completely useless - that may work for amateurs not having much experience or equipement, but for professionals, this won't do much. Using "exotic" parts with hard to find documentation would already help a bit more, but even so, if you manage to get documentation for your chips and get ahold of them, someone else can as well. Unless you're going to design ASICs. Something that may be worthwhile only if you're going to sell millions of products, or more.

[james_s]

Hahah! Removing IC labels, I always wonder why anyone does that, do they really think it will stop me from identifying the IC? If anything it encourages me to try to reverse engineer something, it's a challenge, and it usually isn't very hard to identify what a part is by the pinout and how it's used in the circuit. The only thing it makes harder is repair. It's a speed bump that slows things down slightly, nothing more. 

[james_s]

You may also want to consider creating custom epoxy filled sub-modules. It will not stop copying, but will certainly slow down the effort.

That's no more effective than grinding the numbers off, it attracts me to find out what's inside the potted module. I have access to an xray machine and can quickly get an image of it. I have also become quite adept and de-potting using heat and various mechanical means. If I'm willing to sacrifice one of the modules I can expose the bottom of the PCB, heat it up and then peel the whole PCB off of the epoxy block leaving the components neatly laid out in the resin where they can be measured and/or removed individually.

[james_s]

Fun to remember. Maybe 25 years ago i built a 3 KW inverter for a photovoltaic setup (island solution with 48 V lead battery as storage). It was a prototype and the contract was with an engineer who worked at Brown Boveri Corp. I remember setting up the MCU with part of the firmware in a battery backup RAM, where the battery was connected with an intrusion protection (mechanical switch). So as soon as anybody would lift the cover or pull the MCU card, it would be dead within seconds.
That happened more than once. Don't know whether they reengineered it or not.

Regards, Dieter

Capcom used something similar in some arcade games, a battery backed RAM held the decryption key IIRC. For the inverter it seems like it would be fairly easy once you'd had this happen once. You then know where the intrusion detection switch is so you can drill a hole to access the switch or the wiring and disable it. Then solder a battery to the power pins of the RAM, pull it out and extract the code.

[dietert1]

Nowadays intrusion detection may be a 0805 photo sensor shielded from light. In a larger board this will cause quite some delay for RE. Also i like those one-wire EEPROMS. Those can be fairly small parts with just two pins. It's a good idea to combine chips of different brands so they block each others backdoors. RE resistance depends on adding something "strange" or "superfluous", that takes time to understand. E.g. non-standard hash codes or the like.

For our oximeter modules we separated system from application. We can distribute encrypted application firmware updates and users can apply, but not disassemble them. They cannot debug either as the system is well protected. So the whole firmware remains execute-only. Another method that can be used in industrial (non-consumer) markets are special configuration tools, so part of the IP is never distributed with the product.

In my opinion it's a waste of effort to develop a product and not protect it from the very beginning. If people write how easy it is to break protections, this may be a bit misleading, similar to those independence day or mission impossible movies..

Regards, Dieter

[james_s]

Well there are few things that make me happier than seeing a protection system cracked wide open. I absolutely hate them, and will do whatever I reasonably can to help crack something that is protected just for the sake of doing it. I still remember all the effort that went into protecting the original xbox console and then it was cracked wide open within days of hitting the retail shelves. LOL

[ataradov]

I do agree. If I see something protected, I'd be more inclined to reverse engineer it just for the fun of it. And chances are the results would be published. So, ironically, not bringing too much attention to your security system is a much better approach. People that want to copy something, will do it no matter what. And you don't want to bring in the people doing it just for fun.

And yes, Xbox story is a REALLY good read if you have any interest in the topic at all - https://xboxdevwiki.net/17_Mistakes_Microsoft_Made_in_the_Xbox_Security_System

[james_s]

I was in some of the meetings where the hardware design and protection of the xbox was being discussed while under development. I had absolutely no part in cracking it and obviously I didn't say so at the time but I do recall being amused at how quickly it happened and I did modify my own unit. IMHO the mod chip unlocked capabilities that made it what it should have been in the first place. To this day I have all my games loaded onto a large internal hard drive, I used to take it over to friends houses and I'd just bring the unit and leave all the discs at home. Games loaded much faster too.

[dietert1]

Yes, the xbox hack is a must-read demonstrating how necessary hack resistance level depends on the product and how easy it is to make mistakes. "They thought nobody would be able to sniff hypertransport." Anyway there are thousands of hackers who think that Microsoft engineers aren't very bright and who want the credit for hacking their products. Nowadays companies contract hackers to verfy protection designs at the desired level.

Regards, Dieter

[Doctorandus_P]

@Doctorandus_P
...  and calling someones product a "cheap knockoff" is a harsh statement without even looking at the design .

You have completely misunderstood my intentions.
I never implied your product would be a "cheap knockoff".
What I meant is that someone else were to make a cheap knockoff of your product, then it is unlikely they would be able to sell in a market where quality and reliability is more important than price.
So my intentions ware nearly opposite to what you made of it, and I wish you lots of success with your product.

[onsenwombat]

Saw this and brought back some nice memories, so had to register.
As said, scrubbing off whatever markings from any and all of your parts is as effective measure as leaving your door unlocked, but leaving a note asking people kindly not to enter.
If and when any parts of your product sets their feet in the manufacturing world of China, buckle up. If anyone senses that there's some  money to be made by copying quite literally anything in your design, trust me, they'll go for it, and they'll go for it hard. Your BOMs will be known in seconds, as will any PCB gerbers be available from the neighbour's copyhouse in matter of days. Firmware binaries, if you're nuts enough to have your stuff programmed at these houses, yep, same stuff there. Anything and everything will be out.
But our legal will have fancy NDAs and whatnots. Sure they will, that won't change a thing.
In my handful of years in related industries, I've seen our products being copied, sometimes in quite interesting ways. So called "strictly confidential" FW-protections have found their ways to clever counterfeit artists to earn their honest bucks to name but a few.
I haven't quite followed what's the modern day method of securing your SoC/MCU/DSP/CPU/whatever you have as the brains of your beauty, but focus there. And this means some heavyweight enough measures to slow down the hackers. How heavy exactly, well, goes back to square one. If there's money to be made, you need to invest on this.
The professional reverse-engineer copiers are something I can't comment much as I've no first hand experience, but the manufacturing houses alone can be a serious problem if taken lightly. Trust me when I say that every single file you share with them, regardless of the legal jargon that might have been bundled with it, will one day be found from some shop floor computers. You know those with no password protection, free access to whoever technician pleases to toy around. And from there, well, who knows where, into the wide blue yonder.
In short, whatever you want to keep in house, keep in house. Not a single one of those Chinese PCBA fabs will keep your precious data within the scope you'd desire.

[Warpspeed]

Its always fascinated me how the Chinese can show incredible ingenuity and persistence to copy something else exactly, but almost zero ability to invent something truly original or new.

They even copy known weaknesses in the original design rather than think of a way to do it better.

I think most of us here can probably look back at some past project  in retrospect, and think of ways it could have been simplified or improved. 
Even if we do admit to copying someone else's successful design concept, we probably  add our own personal improvements to it.

There must be something in the Chinese culture, I really do not know.

[ataradov]

but almost zero ability to invent something truly original or new.

It is not about the ability. Getting a well accepted and widely used design and implementing it instead of inventing new stuff is the right approach. It gets you a known design fast. You will copy some inefficiencies, but usually those are known and workarounds are also known.

Improving on the design is also important, of course. But that's what GigaDevice and other are doing. Their new devices have nothing to do with any other parts, they are unique, yet still maintain a degree of similarity. And new devices have RISC-V core, which would be a tough ask for ST or other established vendors.

[dietert1]

The ancient greek had this culture, too. Joining a discussion required being able to first reproduce arguments of others with own words. Japan has that culture, too. It has something to do with respect.
And maybe chinese engineers are influenced by the western supremacy ideology, such as "Mission impossible", "Independence day" and the like. Soon they will create their own myths.

Regards, Dieter

[CatalinaWOW]

Protection requires as much or more thought than design.  And there is no such thing as absolute protection.  If your protection causes it to take as long as a design or product cycle it may be worth it.

Different approaches work in different markets.  Self destruct schemes aren't effective for high volume products because the attacker can obtain as many samples as needed to find ways around the traps.  Products with very high margin or simple production options can set up clean facilities to avoid the various leaks at commercial production houses (not just Chinese by the way).

Thinking about your product can produces speed bumps in the reversers path.  Perhaps a critical element is heavily dependent on a devices parameters.  Mismarking that device with a similar but not quite up to snuff part number might be an example.  Depending on the reversers skill and experience this might lead to a few hours to a few weeks of delay.  Using circuits which require special fixtures and/or equipment to trim would be another example.  Anything which has an obvious and easily understood purpose, but also has a critical secondary function.

In the end you can only hope that what you have done slows people down enough to serve your purposes. 

[peter-h]

Depends on who the attacker is.

If you make a device which sells in 100k volume and makes millions of $$$, it will be copied by the chinese.

But a lot of lower volume stuff isn't going to draw so much attention. It is below the chinese radar and you just need to p*ss off a casual local (Western / 1st World) guy who wants to make a bit of money but isn't all that smart, and has a lot of other stuff to do.

I have been grinding off chip markings on thousands of £30 interface products. Sure they can guess the chip but they won't be 100% sure. A funny one, in the Z80 + EPROM days, was to randomly mix up the address and data lines. It worked; years later I met a guy who told me his boss got him to copy it but he spent day trying to work out what algorithm was used to encrypt the EPROM That was a £2M/year business, in the 1980s, and even today would be below the chinese radar.

Its always fascinated me how the Chinese can show incredible ingenuity and persistence to copy something else exactly, but almost zero ability to invent something truly original or new.

It is their mental culture, their business model, and where their tech resources are.

[james_s]

I have been grinding off chip markings on thousands of £30 interface products. Sure they can guess the chip but they won't be 100% sure. A funny one, in the Z80 + EPROM days, was to randomly mix up the address and data lines. It worked; years later I met a guy who told me his boss got him to copy it but he spent day trying to work out what algorithm was used to encrypt the EPROM That was a £2M/year business, in the 1980s, and even today would be below the chinese radar.

He didn't bother to map out the data and address bus wiring? That's the first thing I would have done if a cursory glance at the EPROM dump didn't make sense.

I'll say it again, nothing motivates me to figure out what an IC is than numbers ground off. It turns something I'd otherwise ignore into a challenge.

[peter-h]

He didn't bother to map out the data and address bus wiring?

He didn't realise that was the scheme used.

nothing motivates me to figure out what an IC is than numbers ground off. It turns something I'd otherwise ignore into a challenge.

Sure, but you are probably not the commercially relevant attacker.

[james_s]

He didn't realise that was the scheme used.

I find it very surprising that he didn't bother to check. I've seen data and address lines shuffled around many times, sometimes presumably to make routing the PCB easier, it didn't occur to me to use that technique as copy protection but I would never have made the assumption that they were connected logically in the first place. If a dump of the eprom doesn't make sense then the very first thing to suspect should be the bus wiring.

[peter-h]

Well, obviously, since there is absolutely no way to make any code run on a Z80 unless it is fed to it correctly But this shows there are just opportunists out there and you just need to p*ss them off for a day or two and they find something better to do.

Like I said, your product has to be above the chinese counterfeit radar in the first place. This applies to whole products in the same way it applies to chips. They don't bother counterfeiting obscure devices. They rip off stuff which is in good demand. I have seen fake Hitachi chips made years after Hitachi's last time buy; they were still in volume use and were being bought up from the US second tier "cowboy" disti scene.

The product in question was selling ~ 200 a month, at around $1000 each, in the 1980s. I never got rich because the company, of which I had 1/3, had 35 employees so money was p*ssing out of every orifice. But it was B2B, not retail and with a large media exposure (no internet back then!). And a lot of industrial stuff is like that. Not talking about anybody here, but I think a lot of designers have an inflated idea of their importance and in reality their product is just too damn obscure for anybody to notice.

You can also p*ss people off if you use BGA packages, buried vias, tracks between planes, etc. But then you make your own life hard, and basically anything which fails the factory test has to be scrapped.

Another old technique is to file a patent. You can file a patent on anything, and put Patent Pending xxxxxx on your product. That will discourage some. The patent may get chucked out on prior art grounds but that doesn't matter because few will check. I used to have a competitor who filed patents on everything and plastered the numbers all over their box. I looked them up and they were either bogus or just weird (irrelevant) ways of doing something.

[mikeselectricstuff]

You really need to start by analysing who your adversary might be, in order to evaluate the cost/benefit of any particular measure.
 If I see equipment, especially something big and expensive, with part numbers removed that makes me think the manufacturers are a bunch of amateurs who are dumb enough to think that makes a difference, while making repairs harder.

Something cheap and easy I'd suggest is to include some  hidden software functionality that can prove that it's your software if it did get copied. e.g. an obfuscated copyright text string that can be made to appear with an obscure key combination. If you don't have a display, morse code or binary on a LED or beeper would do.
That way if a manufacturer/importer did a straight copy you'd have a sure-fire legal win, probably before even getting to court.

[rsjsouza]

You really need to start by analysing who your adversary might be, in order to evaluate the cost/benefit of any particular measure.
 If I see equipment, especially something big and expensive, with part numbers removed that makes me think the manufacturers are a bunch of amateurs who are dumb enough to think that makes a difference, while making repairs harder.

Something cheap and easy I'd suggest is to include some  hidden software functionality that can prove that it's your software if it did get copied. e.g. an obfuscated copyright text string that can be made to appear with an obscure key combination. If you don't have a display, morse code or binary on a LED or beeper would do.
That way if a manufacturer/importer did a straight copy you'd have a sure-fire legal win, probably before even getting to court.

In the SW industry these are the famous "easter eggs", which (as I was told) enabled Apple to battle and win against clone manufacturers in foreign markets (Brazil being one of them). This was back in the 1980s.

[mikeselectricstuff]

You really need to start by analysing who your adversary might be, in order to evaluate the cost/benefit of any particular measure.
 If I see equipment, especially something big and expensive, with part numbers removed that makes me think the manufacturers are a bunch of amateurs who are dumb enough to think that makes a difference, while making repairs harder.

Something cheap and easy I'd suggest is to include some  hidden software functionality that can prove that it's your software if it did get copied. e.g. an obfuscated copyright text string that can be made to appear with an obscure key combination. If you don't have a display, morse code or binary on a LED or beeper would do.
That way if a manufacturer/importer did a straight copy you'd have a sure-fire legal win, probably before even getting to court.

In the SW industry these are the famous "easter eggs", which (as I was told) enabled Apple to battle and win against clone manufacturers in foreign markets (Brazil being one of them). This was back in the 1980s.

I know someone who got a substantial out-of-court settlement against a company who copied their software and thought they'd removed the original copright messages due to having the foresight to include an additional obfuscated message, though this was in an industry where piracy was very common.

[peter-h]

you'd have a sure-fire legal win

Only after spending the entry level competent-lawyer figure, 5 digits for 1-2 days' work

Apple etc can do it. "You" can't.

The only other way you can win is if a large company unwittingly ended up incorporating your code (perhaps due to a rogue engineer or contractor). Then, upon presentation of the evidence, they are fairly likely to give you some money in a settlement. A large company, in the 1st World, is not likely to knowingly use bootleg code.

And if a chinese company does anything, you can't sue them anyway. I managed to extract a $4k injection moulding tool from china by threatening the company with a) reporting them for theft to the chinese embassy in London and b) doing the same to their local police station. But had they called my bluff, I would have never got that tool back. Previous 3 versions of that tool were "stolen" when the companies vanished (over a 20 year period). The cost of using chinese suppliers...

In the old days, executing the copyright message was a fun trick. ASCII chars were mostly reg-reg moves and you could make it do something. So on "PC" software this was ok because a counterfeiter patched the copyright message right away.

In embedded systems, an attacker needs to be better equipped to start with.

I would not use BGA-anything. One cannot do any hardware development with it (not if one also obscures the interconnections) so one has to develop on some other board and then spin off the "real" board and hope it works. And then scrap some % of production; with luck it should be not more than 1%.