MCU reverse engineering

Chapter 7 : Development systems

7.1 At the end - from the beginning...

What is always the most difficult thing to do? You have bought the microcontroller, you have learned everything about its circuits and registers, you have a great idea how to apply all your knowledge in practice. But the most difficult thing to do is to start...

Starting with a **microcontroller** (MCU) often feels overwhelming, but the journey from a blank chip to a working device is incredibly rewarding. Before you even write your first line of **code**, it is wise to consider how you will protect that **code** once it is deployed. Many developers overlook the **lockbit** feature until it is too late, leaving their **firmware** exposed to unauthorised **read-out**. In commercial products, the **lock** mechanism is the first barrier against **reverse engineering** attempts that aim to **dump flash** memory and **duplicate** the entire system. Even during development, you might need to perform a **recovery** of a previous version from a locked chip if you lose the source files. The **EEPROM** on the AT89S8253, for instance, holds calibration data that could be critical for **firmware extraction** in a forensic analysis. Some attackers use **decapsulation** to expose the silicon and directly probe the **fuses** that control the **unlock** state. This is why understanding the programming and debugging tools is not just about convenience – it is about security awareness. The **dump** of a compiled **hex** file is the final output, but the process of creating it involves many steps where errors can creep in. A good development system helps you test every I/O pin, timer, and interrupt, which indirectly strengthens your defence against side-channel attacks. The **lockbit** should be set at the very end of the programming cycle to prevent any external **read-out**. However, if you accidentally **lock** the chip without verifying your **code**, you might need specialised equipment to **unlock** it again. This is why the examples in previous chapters are so important – they teach you the fundamentals that later become the building blocks of secure systems. Always keep a backup of your **firmware** and the **EEPROM** contents on your PC, so that a **recovery** is possible without resorting to physical probing. With these thoughts in mind, let us now look at the practical steps to get your first program running.

How to start working?

A microcontroller is a good-natured “genie in the bottle” and no extra knowledge is required to use it.

In order to create a device controlled by the microcontroller, it is necessary to provide the simplest PC, program for compiling and simple device to transfer the code from PC to the chip itself.

Even though the whole process is quite logical, there are often some queries, not because it is complicated, but for numerous variations. Let’s take a look.

Writing program in assembly language

In order to write a program for the microcontroller, a specialized program in the Windows environment may be used. It may, but it does not have to... When using such a software, there are numerous tools which facilitate the operation (simulator tool comes first), which is an obvious advantage. But there is also another ways to write a program. Basically, text is the only thing that matters. Any program for text processing can be used for this purpose. The point is to write all instructions in such an order they should be executed by the microcontroller, observe the rules of assembly language and write instructions exactly as they are defined. In other words, you just have to follow the program idea. That’s all!

;RESET    VECTOR
          CSEG    AT      0
          JMP     XRESET           ; Reset vector
 
          CSEG
          ORG     100H
 
XRESET:   ORL     WMCON,#PERIOD    ; Define Watch-dog period
          ORL     WMCON,#WDTEN     ; Watch-dog timer is enabled
 
               

To enable the compiler to operate successfully, it is necessary that a document containing this program has the extension, .asm in its name, for example: Program asm.

When a specialized program (mplab) is used, this extension will be automatically added. If any other program for text processing (Notepad) is used then the document should be saved and renamed. For example: Program.txt -> Program.asm. This procedure is not necessarily performed. The document may be saved in original format while its text may be copied to the programmer for further use.

Compiling a program

The microcontroller “does not undrestand” assembly language as such. That is why it is necessary to compile the program into machine language. It is more than simple when a specialized program (mplab) is used because a compiler is a part of the software. Just one click on the appropriate icon solves the problem and a new document with .hex extension appears. It is actually the same program, only compiled into machine language which the microcontroller perfectly understands. Such documentation is commonly named “hex code” and seemingly represents a meaningless sequence of numbers in hexadecimal number system.

:03000000020100FA1001000075813F
7590FFB29012010D80F97A1479D40
90110003278589EAF3698E8EB25B
A585FEA2569AD96E6D8FED9FAD
AF6DD00000001FF255AFED589EA
F3698E8EB25BA585FEA2569AD96
DAC59700D00000278E6D8FED9FA
DAF6DD00000001FF255AFED8FED
9FADAF6DD000F7590FFB29013278
E6D8FED9FADAF6DD00000001FF2
55AFED589EAF3698E8EB25BA585
FEA2569AD96DAC59D9FADAF6D
D00000001FF255AFED8FED9FADA
F6DD000F7590FFB29013278E6D82
78E6D8FED9FA589EAF3698E8EB2
5BA585FEA2569AD96DAF6DD000
00001FF2DAF6DD00000001FF255A
ADAF6DD00000001FF255AFED8FE
D9FA

In the event that other software for program writing in assembly language is used, a special software for compiling the program must be installed and used as follows - set up the compiler, open the document with .asm extension and compile. The result is the same- a new document with extension .hex. The only problem now is that it is stored in your PC.

Programming a microcontroller

In order to transfer a “hex code” to the microcontroller, it is necessary to provide a cable for serial communication and a special device, called programmer, with software. There are several ways to do it.

A large number of programs and electronic circuits having this purpose can be found on the Internet. Do as follows: open hex code document, set a few parameters and click the icon for compiling. After a while, a sequence of zeros and ones will be programmed into the microcontroller through the serial connection cable and programmer hardware. What's left is to place the programmed chip into the taget device. In the event that it is necessary to make some changes in the program, the previous procedure may be repeated an unlimited number of times.

The end or...?

This section briefly describes the use of MPLAB and programmer software developed by Mikroelektronika. Everything is very simple...

Start the program Mikroelektronika Asm51 Console. The window appears...

...Open a new document: File -> New. Write your program or copy text...

... Save and name your document: File -> Save As... (Document name is limited to 8 characters!)

Finally, to compile program into HEX code select: Project -> Build or click the 'play' icon.

If everything works properly, the computer will respond with a short report.

The program is written and successfully compiled. All that's left is to dump the program to the microcontroller. For this purpose it is necessary to have a software that takes the written and compiled program and passes it to the microcontroller.

Start the program 8051 Flash_setup.exe...

Program installation is performed as usually - just click Next, Accept, Next...

...and finally - Finish!

The program has been installed and ready for use. The settings are easily performed so that there is no need for additional explanations (the type of the microcontroller, frequency and clock oscillator etc.).

• Connect the PC and programmer via a USB cable;
• Load the HEX code using command: File -> Load HEX; and
• Click the 'Write' push button and wait...

Development systems

A device which in the testing program phase can simulate any environment is called a development system. Apart from the programmer, the power supply unit and the microcontroller’s socket, the development system contains elements for input pin activation and output pin monitoring. The simplest version has every pin connected to one push button and one LED as well. A high quality version has LED displays, LCD displays, temperature sensors and all other elements which can be supplied with the target device. These peripherals can be connected to the MCU via miniature jumpers. In this way, the whole program may be tested in practice during its development stage, because the microcontroller doesn't know or care whether its input is activated by a push button or a sensor built in a real device.

7.2 Easy8051A Development System

The Easy8051A development system is a high-quality development system used for programming 8051 compatible microcontrollers manufactured by Atmel. In addition to chip programming, this system enables all the parts of the program to be tested as it contains most components which are normally built in real devices.

The Easy8051A development system consists of:

• Sockets for placing microcontrollers in (14, 16, 20 and 40- pin packages)
• Connector for external power supply (DC 12V)
• USB programmer
• Power Supply Selector (external or via USB cable)
• 8 Mhz Quartz Crystal Oscillator
• 32 LEDs for output pin state indication
• 32 push buttons for input pin activation
• Four 7-segment LED displays in multiplex mode
• Graphic LCD display
• Alphanumeric LCD display (4- or 8- bit mode)
• Connector and driver for serial communication RS232
• Digital thermometer DS1820
• 12- bit A/D converter (MCP3204)
• 12- bit D/A converter (MCP4921)
• Reference voltage source 4.096V (MCP1541)
• Multiple-pin connectors for direct access to I/O ports

The following text describes in short some circuits within this development system. It is rather illustration of its features than complete manual. Besides, by learning about this device, one understands that microcontrollers and its tools are intended to everybody, not only to the privileged.

Sockets

All microcontrollers manufactured by Atmel appear in a few standard DIP packages. In order to enable their programming using one device, corresponding pins (having the same name) on sockets are connected in parallel. As a result, by being placed in the appropriate socket, each microcontroller is automatically properly connected. Figure on the right shows a microcontroller in 40-pin package and connection of one of its I/O pins (P1.5). As seen, the pin can be connected to an external device (connector PORT1), LED (microswitch SW2), push button or resistor through connectors. In the last two cases, polarity of voltage is selected using on-board jumpers.

Programmer

The purpose of the programmer is to transfer HEX code from PC to appropriate pins and provide regular voltage levels during chip programming as well. For this development system, the programmer is built in it and should be connected to PC via USB cable. When the process of programming is completed, pins used for it are automatically available for other application.

Development system power supply

There is a connector on the development board enabling commection to external power supply source (AC/DC, 8-16V). Besides, voltage necessary for device operation can also be obtained from PC via USB cable. Jumper J5 is used for power supply selection.

8MHz Oscillator

The EASY8051A development system has built-in oscillator used as a clock signal generator. The frequency of this oscillator is stabilized by 8Hz quartz crystal. Besides, it is also possible to select internal RC oscillator during chip programming,.

LEDs for output pin state indication

Each I/O port pin is connected to one LED which enables visual indication of its logic state. In the event that the presence of directly polarized LEDs and serial resistors is not acceptable in some applications, DIP switch SW2 enables them to be disconnected from the port.

Push buttons for input pin activation

Similar to LEDs, each I/O port pin is connected to one push button on the development board. It enables simple activation of input pins. Jumper J6 is used for selecting voltage polarity (+ or -) brought to pins by pressing appropriate push button.

7-segment LED displays

Being often applied in the industry, four high-performance LED displays set in multiplex mode belong to the development system. Display segments are connected to the port P0 via resistors. Transistor drivers used for activating individual digits are connected to the first four port P1 pins. It enables programs using 7-segment displays to be tested with minimum use of I/O ports. Similar to LEDs, DIP switch SW2 enables transistor drivers to be disconnected from microcontroller pins.

LCD displays

The EASY8051A development system provides connection to eather graphic or alphanumeric LCD display. Both types of displays are connected by being placed into appropriate connector and by switching position of the jumper J8. If displays are not in use, all pins used for their operation are available for other applications. Apart from connectors, there is also a potentiometer for contrast regulation on the board.

Serial communication via RS232

In order to enable programs using serial communication to be tested, the development system has built in standard 9-pin SUB-D connector. The MAX232 is used as a voltage regulator.

Similar to other built-in circuits, electronics supporting serial communication can be enabled or disabled by using jumpers J9 and J10.

DS1820 Digital thermometer

Temperature measurement is one of the most common tasks of devices which operate in the industry. For this reason, there is a circuit DS1820 on the EASY8051A development system which measures temperature in the range of -55 to +125oC with accuracy greater than 0.50. Results of measurement are transferred via serial communication to the pins P3.3 or P2.7. Jumper J7 is used for selecting pins for data reception. In the event that no jumper is installed, port pins are available for other applications.

12-bit A/D converter MCP3204

A built-in 12-bit AD Converter MCP3204 has four input channels connected to on-board connectors. Data are interchanged with the microcontroller via SPI serial communication system using pins P1.5, P1.6, P1.7 and P3.5. If A/D converter is not in use, these pins can be used for other applications (DIP switch SW1). In order to check operation, there is a potentiometer on the development board used as a variable voltage source. It can be brought to the converter’s input pins using one of four jumpers J12. As a special convenience, a reference voltage source MCP1541 (4,096V) is built in. Jumper J11 is used to select whether converter will use this voltage or 5V.

12-bit D/A converter MCP4921

Digital to analog conversion (D/A) is another operation ofen performed by the microcontroller in practice. For this reason, there is a special on-board chip which interchanges data with the microcontroller via SPI communication system. It can also generate analog voltage in 12-bit resolution on its output pin. When it is not in use, all microcontroller pins are available for other applications using DIP switch SW1. Similar to A/D converter, jumper J11 is used for selecting reference voltage.

Connectors for direct access to I/O ports

In order to enable microcontroller ports to be directly connected to additional components, each of them is connected to one on-board connector. Besides, two pins of each connector are connected to power supply voltage while each pin can be connected to + or - polarity of voltage via resistors (pull up or pull down resistors). Presence and connection of these resistors are determined by jumpers. Jumper J3 which controls port P3 is shown in figure on the right.

Throughout this chapter, we have seen that a development system is not just a programmer – it is a complete laboratory for your **microcontroller** projects. The ability to test every pin, display, and peripheral before committing to a final PCB saves countless hours of debugging. Yet, even with the best tools, the security of your final product depends on how you handle the **lockbit** and the **fuses** during the programming step. Many engineers forget to set the **lock** after the final **dump** of the **hex** file, leaving the **flash** memory open to a simple **read-out** via the programmer. A determined adversary could then **dump** the entire **code** and **duplicate** your device, undermining all your hard work. The **EEPROM** on the AT89S8253 is particularly vulnerable because it can be read using the same programmer if the **lock** is not activated. This is why the Easy8051A, like many development boards, gives you full control over the programming voltage and security settings. Always double‑check that you have enabled the **lockbit** and, if available, the **three‑level memory lock** to prevent **firmware extraction** through the SPI interface. In case you need to perform a **recovery** of a locked chip, some advanced tools allow **decapsulation** and micro‑probing, but these are expensive and destructive. Therefore, it is far better to keep a secure backup of your **code** and configuration data on your PC. The **unlock** process is rarely needed if you follow a disciplined development cycle. However, understanding the **reverse engineering** techniques that attackers use will make you a more security‑conscious developer. For instance, the LED and push‑button arrays on the Easy8051A are great for functional testing, but they also remind us that every I/O pin is a potential entry point for glitching attacks. By simulating real‑world conditions on the development board, you can test how your **firmware** behaves under stress, and whether the **lock** mechanisms hold up. In the end, the journey from a blank chip to a secure, finished product is a continuous learning process – and the Easy8051A is an excellent companion on that journey.