Security Mechanism of PIC16C558/PIC16C620/PIC16C621/PIC16C622
  
We wanted to leave you with a piece of logic taken out of an older PIC16C series microcontroller. We want you to guess which micro(s) this gate (well the pair of them) would be found in.
An AND gate in logic is basically a high (logic ’1′) on all inputs to the gate. For our example, we’re discussing the 2 input AND. It should be noted that this is being built from a NAND and that a NAND would require 2 less gates than an AND.
The truth table is all inputs must be a ’1′ to get a ’1′ on the output (Y). If any input is a ’0′, Y = ’0′.
The photo on the left shows the schematic layout using P and N type FETs. A P-FET is conducting between the source and the drain when a logic ’0′ is presented on its gate. The N-FET is the exact opposite (a ’1′ conducts).
As seen above, there are 2 signals we labeled ‘A’ and ‘B’ routed in the Poly layer of the substrate (under all the metal). This particular circuit is not on the top of the device and had another metal layer above it (Metal 2 or M2). So technically, you are seeing Metal 1 (M1) and lower (Poly, Diffusion).
It’s quickly obvious that this is an AND gate but it could also be a NAND by removing the INVERTER and taking the ‘!Y’ signal instead of ‘Y’.
The red box to the left is the NAND leaving the red box to the right being the inverter creating our AND gate.
The upper green area are PFET’s with the lower green area being NFET’s.
|
Above we talked about the snaileye structure of an AND-gate layed out in Silicon CMOS. Now, we present to you how this AND gate has been used in Microchip PICs such as PIC16C558, PIC16C620, PIC16C621, PIC16C622, and a variety of others.
If you wish to determine if this article relates to a particular plasma focused ion beam fib lab PIC you may be in possession of, you can take an windowed OTP part (/JW) and set the lock-bits. If after 10 minutes in UV, it still says it’s locked, this article applies to your PIC.Â
IF THE PART REMAINS LOCKED, IT CANNOT BE UNLOCKED SO TEST AT YOUR OWN RISK.
The picture above is the die of the PIC16C558 magnified 100x. The PIC16C620-622 look pretty much the same.  If there are letters after the final number, the die will be most likely, “shrunk” (e.g. PIC16C622 vs PIC16C622A).Â
Our area of concern is highlighted above along with a zoom of the area. Â
When magnified 500x, things become clear. Notice the top metal (M2) is covering our DUAL 2-Input AND gate in the red box above.
We previously showed you one half of the above area. Now you can see that there is a pair of 2-input AND gates. This was done to pcb hack offer two security lock-bits for memory regions (read the datasheet on special features of the CPU).
[Note: Clicking on pictures will give you a large file]
Stripping off that top metal (M2) now clearly shows us the bussing from two different areas to keep the part secure. Microchip went the extra step of covering the floating gate of the main easilly discoverable fuses with metal to prevent UV from erasing a locked state. The outputs of those maker together club two fuses also feed into logic on the left side of the picture to tell you that the part is locked during a device readback of the configuration fuses.
This type of fuse is protected by multiple set fuses of which only some are UV-erasable. The AND gates are ensuring all fuses are erased to a ’1′ to “unlock” the device.
What does this mean to an attacker? It means, go after the final AND gate if you want to forcefully unlock the CPU. The outputs of the final AND gate stage run underneather VDD!! (The big mistake Microchip made). Two shots witha laser-cutter and we can short the output stages “Y” from the AND-gate to a logic ’1′ allowing readback of the memories (the part will still say it is locked 聚焦离子束加工技术).Â
Stripping off the lower metal layer (M1) reveils the Poly-silicon layer.
What have we learned from all this?
- A lot of time and effort went into the design of this series of security mechanisms.
- These are the most secure Microchip PICs of ALL currently available. The latest ~350-400nm 3-4 metal layer PICs are less secure than these.
- Anything made by human can be torn down by human!
|
