- 2K words program Flash
- 128 bytes SRAM
- 256 bytes data EEPROM
- Two 8-bit and one 16-bit timer
- Four-channel multiplexed 10 bit A/D converter
|PIC12F683 metal 3 with passivation, magnified 400x|
The glass layer (reddish) was quite annoying and made it hard to resolve traces so I decided to remove it using my standard wet-etch procedure (heating in 3% HF). I'll be writing about this process in more detail over the weekend.
|PIC12F683 metal 3 after wet etching, magnified 400x|
- The large block at bottom center (surrounded by power rails with 14 white capacitors at the bottom) is the program flash. Each capacitor is part of a charge pump used to generate high voltage for erasing one bit of flash.
- Immediately to the left is the RAM.
- Above the RAM is the EEPROM. As with the flash, there is one capacitor per bit of memory for high voltage generation.
- Above the flash, and slightly to the right, are the configuration fuses. Each of the small red plates is part of a single configuration bit.
- Analog peripherals are in an L-shape along the top and right sides
|Top portion of PIC12F683 configuration fuse array (metal 3 after etching off glass)|
EEPROM is typically susceptible to erasure (all bits set to 1) by strong UV light and the configuration fuses are no exception. If we can expose just the fuses (and not the flash or EEPROM, whose data we presumably want intact) to UV, the code protection can be removed and the firmware reverse-engineered using standard software RE tools. Note that PICs are thus a slightly easier target than Atmel chips. Atmel fuses in the "1" state indicates the chip is in the locked state (i.e. UV will set rather than clear the fuse).
Enough talking, time to try pwning the chip! As of this writing my decapping lab is offline, but Brooke Hill from Jimnson Research was kind enough to decap a few samples I sent him.
|Decapped PIC12F683, magnified 10x. Rotated 90 degrees counterclockwise from other photos.|
I then laid down a mask over the memory areas I wanted to protect. I used the old classic, black nail polish applied with a lint-free swab under a stereo microscope. The brand of polish I purchased turned out to be very thick and gooey; in the future I intend to thin it with acetone for a more even coating.
|Halfway through applying the mask|
|UV exposure system|
Although the code protection on the PIC12F683 is clearly broken I am not finished with it; as an educational subject has not outlived its usefulness. Stay tuned for a future post with gate- and transistor-level analysis of interesting areas!