Author Topic: Need a help for chip dump  (Read 8575 times)

0 Members and 1 Guest are viewing this topic.

Offline xtremeloaderTopic starter

  • Newbie
  • Posts: 2
  • Country: be
Need a help for chip dump
« on: April 04, 2014, 05:11:54 pm »
Hi guys,

I'm new in this forum and new in chips world. I just have a problem to dump a chip (from Aoyue 968a+ soldering station) and I think it is protected with a lock bits. I need to dump it because I have another same soldering station that have a problem with its chip. It was breaked due a problem with some high voltages.

Situation: when I read it, it reads like a blank chip!
Programmer: MiniPro TL866A.

Can you guys help me with this please? Which technic or programmer to use for unlock this protection.

Thank you advance... :)
 

Offline amyk

  • Super Contributor
  • ***
  • Posts: 8539
Re: Need a help for chip dump
« Reply #1 on: April 05, 2014, 03:46:55 pm »
Is it similar to this model?
https://www.eevblog.com/forum/reviews/youyue-858d-some-reverse-engineering-custom-firmware/

Yes it's possible to break code protection, but for the $$$ it takes you'd probably be better off buying a new one or writing your own firmware.
 

Offline JoeN

  • Frequent Contributor
  • **
  • Posts: 991
  • Country: us
  • We Buy Trannies By The Truckload
Re: Need a help for chip dump
« Reply #2 on: April 06, 2014, 02:09:24 am »
I am not seeing a microcontroller model so I don't know how anyone can give you any advice on this.  But, just because you have an (E)(E)PROM programmer doesn't mean you will be able to program any particular microcontroller out there, most of them now use proprietary programming formats to allow debugging rather than just presenting a generic ROM programming parallel interface.  Of all the microcontrollers I have programmed over the last few years, only some old 8051s from Atmel forced me to use my (E)(E)PROM programmer.  Other than that, I tend to use it on actual (E)(E)PROMs.
Have You Been Triggered Today?
 

Offline xtremeloaderTopic starter

  • Newbie
  • Posts: 2
  • Country: be
Re: Need a help for chip dump
« Reply #3 on: April 08, 2014, 12:06:49 am »
Is it similar to this model?
https://www.eevblog.com/forum/reviews/youyue-858d-some-reverse-engineering-custom-firmware/

Yes it's possible to break code protection, but for the $$$ it takes you'd probably be better off buying a new one or writing your own firmware.

No I have a AT89C52.
 

Offline poorchava

  • Super Contributor
  • ***
  • Posts: 1673
  • Country: pl
  • Troll Cave Electronics!
Re: Need a help for chip dump
« Reply #4 on: April 08, 2014, 08:15:53 am »
Breaking code protection is difficult, expensive and resource consuming. In general you can't pull out the data from protected chip using a normal programmer. Most approach is to decap the chip without damaging it and then probe it (i suppose a ghetto setup could be made for a few thousand $).

In case there is a bootloader of some sort or other application with which you can communicate, you MAY be able to find some exploit, that gives you code execution, then load instructions to dump program memory byte by byte. With bootloader you can sometimes use some sort of borderline condition attack like power or reset line glitching. I may get you somewhere, it may not.

If it's aoyue you better buy new station or just frite FW yourself (it's gonna be better than the one in original station anyway)
I love the smell of FR4 in the morning!
 

Offline dannyf

  • Super Contributor
  • ***
  • Posts: 8221
  • Country: 00
Re: Need a help for chip dump
« Reply #5 on: April 08, 2014, 10:51:22 am »
Quote
Can you guys help me with this please?

Putting aside the legality of it, you are essentially asking people to provide you with free services that otherwise would fetch maybe a few hundred to a few thousand dollars on the market.

You have a better chance just asking for the money to pay for someone to hack it for you.
================================
https://dannyelectronics.wordpress.com/
 

Offline amyk

  • Super Contributor
  • ***
  • Posts: 8539
Re: Need a help for chip dump
« Reply #6 on: April 09, 2014, 01:46:29 pm »
Is it similar to this model?
https://www.eevblog.com/forum/reviews/youyue-858d-some-reverse-engineering-custom-firmware/

Yes it's possible to break code protection, but for the $$$ it takes you'd probably be better off buying a new one or writing your own firmware.
No I have a AT89C52.
http://www.cl.cam.ac.uk/~sps32/mcu_lock.html suggests "power glitch" might work.

http://russiansemiresearch.com/en/service/ will charge you $850 to do it.

For that cost, it might be worth investing into writing your own firmware instead. The TL866A supports the AT89C52.
 

Offline wraper

  • Supporter
  • ****
  • Posts: 18051
  • Country: lv
Re: Need a help for chip dump
« Reply #7 on: April 09, 2014, 02:41:31 pm »
Power glitch protection unlock worked on  very old date code AT89C51/52. That was fixed in early 2000's IIRC. Very unlikely that you have a microcontroller that old unless they used really old stock. The trick was to start erasing and shut down the power almost instantly. Lock bit became erased while firmware itself remained intact (first byte often got also corrupted but could be easily restored by manual brute force).
 

Offline JoeN

  • Frequent Contributor
  • **
  • Posts: 991
  • Country: us
  • We Buy Trannies By The Truckload
Re: Need a help for chip dump
« Reply #8 on: April 09, 2014, 06:31:58 pm »
http://russiansemiresearch.com/en/service/ will charge you $850 to do it.

WOW.  There are a lot of really current processors on their list.  Do you think they can pull this off, and how at this price?
Have You Been Triggered Today?
 

Offline amyk

  • Super Contributor
  • ***
  • Posts: 8539
Re: Need a help for chip dump
« Reply #9 on: April 09, 2014, 09:01:22 pm »
Probably decap + probe. I glanced through the list and none of those are high-security MCUs, so just resetting the lock bits is probably enough.

The Russians and Chinese almost seem to exclusively specialise in this stuff... here's one of the Chinese ones (with a most interesting name): http://www.mcu-crack.com/en/services.html
 

Offline casinada

  • Frequent Contributor
  • **
  • Posts: 599
  • Country: us
Re: Need a help for chip dump
« Reply #10 on: April 09, 2014, 09:15:03 pm »
I would suggest you to send it back for repairs. The unit costs between $150 and $200 new.
I have a similar unit based on the AVR processor (Gordak). They sent me a programmed microcontroller and didn't solve the problem. ($10)
I had to send the unit back for repair ($50 shipping)
Frustrating because the dead processor problem is not that uncommon. Please do a search on this blog.  :(
 
 

Offline GiskardReventlov

  • Frequent Contributor
  • **
  • Posts: 598
  • Country: 00
  • How many pseudonyms do you have?
Re: Need a help for chip dump
« Reply #11 on: April 10, 2014, 03:55:50 pm »
When they decap do they grind the chip down or do they split it open? Both?

Can STEM (scanning tunneling electron microscope) be used? What about ultrasound?

Why even bother for something $100-200 dollars. 
 

Offline poorchava

  • Super Contributor
  • ***
  • Posts: 1673
  • Country: pl
  • Troll Cave Electronics!
Re: Need a help for chip dump
« Reply #12 on: April 11, 2014, 08:01:05 am »
look it up on the internet. In general it goes like that:
-if you don't know the chip buy a dozen pieces to analyse and get familiar with chip layout and potential problems
-choose attack method. Most common approaches are to either reset the lock bit nvm cell or to spy the busses where data and code are fetched. More advanced techniques include chip modification with FIB, backside attacks etc

To open a chip the most common method is to use hot fuming nitric acid while also keeping the chip hot. Bulk of the material from the top of the die can be removed mechanically if necessary. There are also specialized epoxy strippers, which may be be necessary if the chip uses copper bonding wire. While gold is impervious to nitric acid, the copper will get eaten away and the chip will have to be re-bonded which is not trivial and very expensive.

Ultrasonic microscopes are more useful for diagnosing internal physical damage for example when die delamination/popcorning is suspected. It's a part of almost every company's failure analysis procedure.


Check youtube for Christopher Tarnovsky
I love the smell of FR4 in the morning!
 

Offline GiskardReventlov

  • Frequent Contributor
  • **
  • Posts: 598
  • Country: 00
  • How many pseudonyms do you have?
Re: Need a help for chip dump
« Reply #13 on: April 11, 2014, 10:25:13 pm »
look it up on the internet. In general it goes like that:
-if you don't know the chip buy a dozen pieces to analyse and get familiar with chip layout and potential problems

Ok, I guess I can "look it up on the internet".  But then we'd all stop conversing/discussing things.

But back to the topic, for the OP purposes, it's like using a wrecking ball to hang a picture on a wall.

I will check that out on utube.
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf