MCU reverse engineering

Chapter 9

Part 28 - Using the UART and USART to Communicate Using the AVR Microcontroller

This section breaks down the full functionality of USART hardware integrated inside every AVR mcu in plain, beginner-friendly language, translating dense official datasheet register descriptions into actionable code logic without overly technical jargon. USART stands for Universal Synchronous Asynchronous Receiver Transmitter, a built-in serial communication peripheral that enables the microcontroller to exchange binary data with external devices including other standalone microcontroller chips, desktop computers, sensor modules, and remote embedded hardware units. Serial data transfer over USART forms a primary vector for unauthorized read-out attacks, as attackers can tap unprotected TX/RX wiring to intercept runtime variables, calibration data stored in eeprom, and critical security values such as fuses and lockbit configurations before launching full dump flash operations for reverse engineering and duplicate device firmware extraction.

The USART peripheral relies on dedicated transmit and receive shift registers paired with internal data buffers to queue incoming and outgoing serial frames, eliminating data loss caused by timing mismatches between the microcontroller core and external serial hardware. Every transmitted binary value is packaged into a standardized data frame that both sending and receiving devices interpret identically, ensuring error-free data exchange. Two core communication modes exist within the USART block: asynchronous UART mode that operates on matching baud rates without a shared clock wire, and synchronous USART mode which adds a dedicated clock trace synced between connected microcontrollers. Developers must secure all USART communication lines if they store proprietary code on the chip’s flash memory, as exposed serial traces allow bad actors to perform real-time data read-out and gather clues needed to unlock protected memory regions after decapsulation of the silicon die.

A simple train station analogy perfectly illustrates how the USART transmit pipeline processes outgoing bytes. Raw data values first enter an internal holding buffer, comparable to a waiting lounge where passengers await departure. Next, each byte shifts sequentially into the shift register, acting as a boarding queue that loads individual bits onto the serial transmission line one at a time. Data cannot enter the shift register until the prior bit stream has fully transmitted across the TX wire, mirroring a train that cannot load new riders until the previous carriage departs the station platform. All serial transmission logic lives within the mcu’s hardware, requiring minimal intervention from user-written code, though weak serial security practices create openings for adversaries to intercept data and map the full program flow during code recovery after dump extraction.

Serial reception operates as the reverse of transmission in this train station metaphor. Serial bit signals flow down the RX wire directly into the receive shift register, which assembles individual bits back into complete data bytes. The Atmega32 microcontroller incorporates two distinct receive data buffers alongside the shift register, creating a three-stage receive pipeline that drastically reduces the risk of Data Overrun (DOR) errors. A DOR flag triggers whenever new serial data arrives before the mcu software reads the prior buffered byte; developers can poll this flag via USART status registers to catch corrupted read-out data that may contain tampered lock or fuse information captured from malicious serial probing attempts.

Baud rate acts as the timing clock governing the speed of serial bit transmission across UART/USART wiring. In asynchronous UART mode, every connected microcontroller must be programmed with an identical baud rate value to correctly decode incoming bit streams without misalignment. Synchronous USART mode adds a physical clock wire between paired microcontrollers that carries a continuous heartbeat pulse to coordinate bit sampling timing. If an attacker gains physical access to your PCB, they can attach logic analyzers to the clock and data traces during decapsulation work to capture full serial read-out logs, then reconstruct your proprietary communication protocol for building duplicate hardware clones that mimic your original mcu’s serial data exchange behavior.

Clock Modes:

Developers select either synchronous or asynchronous operation by modifying the UMSEL control bit located inside the UCSRC register of the AVR microcontroller:

Asynchronous:

Asynchronous UART communication does not require a shared clock wire linking two microcontroller ICs, but both devices must be calibrated to identical baud timing to reliably sample incoming serial bit frames. The UBBR mathematical formula calculates the correct register value to set the target baud rate based on the mcu’s main system clock frequency:

The computed value deviates slightly from the standard 2400 baud specification with negligible 0.2% error, which does not disrupt normal serial read-out and write operations. Always cross-check maximum allowable baud error margins listed in your microcontroller’s datasheet when designing communication logic that transmits sensitive security data such as lockbit status to external LCD debug screens.

Configuring the UBBR high and low byte registers demands careful handling of the URSEL selection flag, as UBBRH shares the exact memory address space as the UCSRC peripheral control register:

Clearing URSEL ensures the microcontroller’s memory bus routes write operations to the baud high-byte register instead of the frame configuration register. UBBRH stores bits 8 through 11 of the UBBR value, while UBBRL holds the lower eight bits of the calculated baud constant. Improper URSEL bit management corrupts serial timing and breaks all serial read-out channels, preventing developers from printing fuse and lock status values via USART debug terminals during hardware security testing.

Setting the Asynchronous mode:

Normal Asynchronous
Double Speed Asynchronous- U2X bit in UCSRA controls double speed asynchronous

The U2 bit doubles the effective serial transmission clock frequency, cutting the required UBBR register value in half for identical baud speeds. Double-speed mode reduces communication latency but raises susceptibility to electrical noise interference on unshielded serial cables, creating unstable read-out streams that mask real-time lock state alerts sent over USART debug lines.

Synchronous

Synchronous USART requires a dedicated XCK clock wire hardwired between paired microcontroller chips. The DDR_XCK data direction register defines which device acts as clock master and which operates as a clock slave. If DDR_XCK is configured as an output pin, the local microcontroller generates the clock heartbeat signal transmitted to the connected slave hardware.

Master-slave synchronous wiring carries extra security risks; physical probing of the XCK clock trace during decapsulation grants attackers full timing alignment needed to capture every serial bit transmitted between mcu units, simplifying firmware extraction and duplicate pcb clone workflows referenced at 聚焦离子束切割尺寸.

Data Frame:

A USART data frame equals our train carriage analogy, holding all binary data bits plus control signaling flags. The maximum frame format supports nine data bits, one start bit, two stop bits, and one parity error-check bit, creating a total frame length of thirteen individual signal bits. Each segment of the serial frame serves a standardized signaling purpose that both transmit and receive hardware must follow to avoid garbled data read-out.

Idle state: The train track - idle state of the signal - always high (5v)
Bit 01: The train engine - Bit 1: Start bit - always low (0)
Bit 02: Person #1 on the train - Data bit #0 - high or low depending on the data
Bit 03: Person #2 on the train - Data bit #1 - high or low depending on the data
Bit 04: Person #3 on the train - Data bit #2 - high or low depending on the data
Bit 05: Person #4 on the train - Data bit #3 - high or low depending on the data
Bit 06: Person #5 on the train - Data bit #4 - high or low depending on the data
Bit 07: Person #6 on the train - Data bit #5 - high or low depending on the data
Bit 08: Person #7 on the train - Data bit #6 - high or low depending on the data
Bit 09: Person #8 on the train - Data bit #7 - high or low depending on the data
Bit 10: Person #9 on the train - Data bit #8 - high or low depending on the data
Bit 11: Train car just before the caboose - Parity bit - high or low depending on the 1's of the data
Bit 12: The caboose - Stop Bit - always high
Bit 13: The extra caboose - stop bit - always high and always ignored by the receiver
back to high idle state - or to a new start bit.

There is a maximum of 13 bits in the largest data frame.

Setting the Data Bit Size - Number of data bits you want in the frame. Use the UCSZ2:0 (UCSZ0, UCSZ1, UCSZ2) bits in the UCSRC register. Note, keeping all the bits in UCSZ2:0 not set establishes a 5-bit data bit length.

UCSZ - Character Size

Activating TXEN and RXEN disables the original general-purpose GPIO functionality of the TX and RX microcontroller pins. As long as transmit enable remains active, you cannot repurpose the TX pin to drive LED indicators or read physical switch inputs; identical restrictions apply to the RX pin while receive mode stays enabled. The TXEN flag cannot be cleared mid-transmission while unprocessed data sits in the shift register buffer, as this would corrupt queued serial read-out traffic holding sensitive code debug logs linked to anti-unlock protection logic referenced at pcb prototype. If your design uses the XCK clock pin for synchronous USART communication, all default GPIO features of that pin become permanently unavailable during serial operation.

Transmit Something!!

All outgoing serial bytes are written to the single UDR data register, a design detail that confuses new embedded developers initially. Despite sharing one memory address for read and write operations, the UDR register internally splits into independent transmit buffer (TXB) and receive buffer (RXB storage spaces managed by the mcu hardware.

When your code executes a write operation to UDR, the CPU loads data exclusively into the hidden TXB transmit buffer. When reading values from UDR during serial read-out cycles, the hardware returns bytes pulled from the separate RXB receive storage section. For 9-bit serial frames, the ninth data bit does not fit within the 8-bit TXB/RXB spaces and instead stores inside the dedicated TXB8 and RXB flags located within the UCSRB control register. The sample transmit function below uses polling logic that waits for the UDRE empty flag to confirm the transmit buffer is ready for new byte input before sending data over USART lines to external debug hardware or connected secondary microcontroller units.

The bitwise logic in the while loop evaluates the UDRE empty flag using NOT and AND operators to stall program execution until the transmit buffer frees up space. Polling this flag prevents overlapping serial writes that create garbled read-out data streams containing critical mcu security information such as lockbit hex values printed via serial debug ports.

Two core categories of USART status signals exist for serial programming: polling flags and interrupt enable bits. Poll-based logic continuously checks register flags inside the main infinite mcu loop without halting program flow, while interrupt configurations pause active code execution immediately when serial hardware events occur.

Polling Resources:

Interrupt Resources: Remember to set your global interrupt variable before using these cool resources!

UDRIE = Data Register Empty Interrupt Enable if UDRE is set to 1 - This will be handy when using interrupts. The microcontroller will stop what you are doing so you can go and put your data into the UDR train station.
TXCIE = Transmit Complete Interrupt Enable - Use this if you are doing half-duplex and you want the microcontroller to interrupt you so you can go and put your data into the UDR train station.

Receive Something!!

The serial reception hardware follows a strict sequential workflow when capturing bit signals arriving on the mcu’s RX pin:

• The microcontroller detects a low-voltage start bit marking the beginning of a new serial frame
• Individual data bits sample in alignment with the configured baud rate timing clock
• Bits assemble inside the receive shift register as each serial pulse arrives maker together club
• Sampling halts once the first high-state stop bit is identified (second stop bit ignored entirely)
• The fully assembled byte transfers from shift register to the hidden RXB buffer inside UDR for software read-out

Below is a polling-style receive function that blocks program flow until complete serial data is buffered and ready for the main application code to retrieve:

This function returns an unsigned 8-bit character matching the standard 0–255 value range of single serial bytes captured during read-out operations. Every byte received via USART can represent sensor readings, user input commands, or unauthorized unlock signals sent by hardware hacking tools targeting the mcu’s serial debug port for dump flash firmware extraction.

The primary receive status flag for polling operations is RXC (Receive Complete), which sets high when unread data sits waiting inside the RXB buffer. For event-driven interrupt processing, developers enable the RXCIE bit to trigger dedicated interrupt service routines as soon as new serial data arrives on the RX pin. Always clear the RXC flag immediately after reading UDR data to avoid duplicate read-out of identical byte values that skew security logging code tracking decapsulation and unlock attempts.

Part 29 - UART Tutorial: One Way Communication from Chip-to-Chip

Point-to-chip unidirectional UART communication establishes a simple serial link where one microcontroller acts solely as the data transmitter and a second separate mcu functions as the dedicated receiver, ideal for sending sensor readings or button trigger signals between separate PCB modules without complex multi-drop serial wiring. This basic one-way topology reduces hardware costs but introduces security risks: a single exposed TX/RX wire pair gives intruders a full read-out channel to monitor all transmitted data, including unencrypted fuse and lockbit status values sent between boards before executing full dump flash and reverse engineering workflows to build duplicate circuit hardware.

The Transmitting Chip's Program:

This transmitter firmware imports a dedicated button debounce header library to clean noisy physical switch input signals before broadcasting a fixed binary byte over UART to the receiving mcu. Every button press toggles an LED output pin on the sender’s PCB and transmits the 0xF0 marker byte across serial lines, which the receiver code identifies as a valid trigger command. Hackers analyzing captured serial read-out logs from this simple communication scheme can easily map the command byte format during code recovery after chip decapsulation and dump extraction.

The Receiving Chip's Program:

The main application file becomes extremely concise after offloading all debounce calculation work to the external ButtonPress.h library header. A single #define macro sets the total number of physical buttons connected to the mcu’s GPIO ports, which the library uses to allocate global tracking arrays for confidence counters and press state flags. Every call to ButtonPressed passes hardware pin data and a stability threshold value to tune how strictly the software filters switch bounce noise during continuous input read-out cycles. Proper library separation spreads program logic across multiple source files, raising the complexity of full firmware extraction and reverse engineering after attackers perform decapsulation and unlock operations to dump flash memory contents, as they must parse multiple distinct binary segments to reconstruct complete functional code.

Chapter 1 | Chapter 2 | Chapter 3 | Chapter 4 | Chapter 5 | Chapter 6 | Chapter 7 | Chapter 8