Microcontroller Firmware Extraction & PCB Clone
Professional MCU firmware extraction, IC reverse engineering, PCB duplication, schematic recovery and PCB manufacturing services for clients worldwide since 1998.
Professional MCU firmware extraction, IC reverse engineering, PCB duplication, schematic recovery and PCB manufacturing services for clients worldwide since 1998.
The NXP LPC1114 is an ARM Cortex-M0 based microcontroller widely used in industrial automation, consumer electronics, and automotive accessory applications. Like many microcontrollers, it includes a Code Read Protection (CRP) mechanism designed to prevent unauthorized extraction of firmware from the chip's flash memory. However, security researchers at NewAE Technology, creators of the ChipWhisperer side-channel analysis platform, demonstrated that the LPC1114's CRP mechanism can be reliably bypassed using a voltage glitch attack that corrupts the magic value used to indicate read protection status. This attack, documented as Tutorial A9 in the ChipWhisperer training curriculum, has become one of the most widely cited examples of fault injection against microcontroller readout protection. The attack is notable for its elegance and reliability, exploiting a fundamental design weakness in how the LPC1114 reads and evaluates its protection configuration during the boot sequence. This case study explores the technical details of the LPC1114 CRP bypass, the voltage glitching methodology used to defeat it, and the broader lessons it offers for microcontroller security design.
The LPC1114 is part of NXP's LPC11xx family of low-cost 32-bit microcontrollers based on the ARM Cortex-M0 core, operating at frequencies up to 50 MHz with up to 64 KB of flash memory and 8 KB of SRAM. The chip is designed as a cost-effective replacement for 8-bit and 16-bit microcontrollers, offering 32-bit performance at a comparable price point. To protect proprietary firmware from being dumped through the bootloader or debug interface, NXP implemented the Code Read Protection feature, which is controlled by a 32-bit value stored at a specific location in flash memory (address 0x2FC for the LPC1114). This "magic value" determines the level of read protection when the chip boots. There are four CRP levels: Level 0 (no protection), Level 1 (limited access, allows mass erase), Level 2 (full protection, no debug access), and Level 3 (maximum protection, disables ISP and most debug functions). The CRP value is read from flash during the boot sequence, and the boot ROM configures the memory protection and debug interface accordingly. If the CRP value is corrupted or reads as an unexpected value during boot, the chip defaults to an unprotected state, which is precisely the weakness that the glitch attack exploits. The LPC1114 also includes a Serial Wire Debug (SWD) interface and an In-System Programming (ISP) bootloader accessible via UART, both of which are restricted when CRP is active but can be used to extract firmware once the protection is bypassed.
The ChipWhisperer platform, developed by Colin O'Flynn and NewAE Technology, is an open-source toolchain for performing side-channel power analysis and fault injection attacks on embedded devices. The platform consists of a hardware capture device with programmable power supply control, a glitch generation circuit, and software tools for automating attacks and analyzing results. For the LPC1114 CRP bypass, the ChipWhisperer is used to generate precisely timed voltage glitches on the chip's power supply during the boot sequence. The glitch is created by briefly shorting the power supply to ground through a MOSFET switch, causing a rapid voltage drop that disrupts the CPU's operation for a single clock cycle or a fraction of a cycle. The ChipWhisperer software allows the attacker to precisely control the glitch timing (relative to a trigger event), the glitch width (duration of the voltage drop), and the glitch offset, and to automatically sweep these parameters to find the optimal settings for a successful attack. The platform also includes a Python-based API that allows the entire attack process, from glitch generation to firmware extraction, to be automated and scripted. The ChipWhisperer has played a crucial role in democratizing side-channel and fault injection research, making these techniques accessible to students, researchers, and security professionals who would otherwise require expensive custom equipment.
The LPC1114 CRP bypass attack follows a systematic methodology that begins with setting up the target chip on the ChipWhisperer target board and connecting the glitch output to the chip's power supply pin. The attacker first configures the LPC1114 with CRP Level 1 or Level 2 protection by programming the appropriate magic value at flash address 0x2FC, confirming that the chip is indeed protected by attempting to read flash through the ISP bootloader (which should be denied). The attack then proceeds by repeatedly resetting the chip and applying a voltage glitch at a specific time during the boot sequence. The critical insight is that the boot ROM reads the CRP value from flash at a known point in the boot process, and if a glitch is applied precisely when this read occurs, the value loaded into the CPU register can be corrupted. If the corrupted value does not match any of the valid CRP magic values, the boot ROM defaults to treating the chip as unprotected (CRP Level 0), allowing full access to flash memory through the ISP or SWD interface. The attacker uses the ChipWhisperer to sweep the glitch timing across the boot sequence, monitoring the ISP response to determine when the protection has been successfully bypassed. Once the correct glitch parameters are found, the attack is highly reliable, with success rates exceeding fifty percent in many cases. After a successful glitch, the attacker simply connects to the chip's UART ISP interface and uses the standard LPC ISP protocol commands to read the entire flash memory contents, producing a complete firmware dump. The entire process, from initial setup to successful extraction, can be completed in under an hour with the ChipWhisperer platform.
The fundamental vulnerability in the LPC1114's CRP implementation is the reliance on a single magic value stored in flash memory to determine the protection level, combined with a default-fail behavior that treats any unrecognized value as "no protection." During the boot sequence, the boot ROM reads the 32-bit value at address 0x2FC and compares it against the known CRP magic values (0x4E697370 for CRP1, 0x12345678 for CRP2, and 0x87654321 for CRP3). If the value matches one of these, the corresponding protection level is activated. If the value does not match any known magic value, the boot ROM assumes that no protection is configured and proceeds with full access enabled. This design creates a single point of failure: if an attacker can corrupt the read of this single 32-bit value, the entire protection mechanism is defeated. The voltage glitch achieves this corruption by disrupting the CPU's flash read operation at the exact moment the CRP value is being loaded into a register. The glitch causes the flash memory output to be momentarily unstable, resulting in an incorrect value being latched by the CPU. Because there are over four billion possible 32-bit values and only three are valid CRP magic values, the probability that a randomly corrupted value happens to match a valid magic value is extremely low, meaning that almost any successful corruption will result in the chip defaulting to unprotected mode. This "fail open" design is in contrast to more secure implementations that use a "fail closed" approach, where any error in reading the protection configuration results in maximum protection being applied. The LPC1114's design also lacks any redundancy or error checking for the CRP value read, such as reading the value multiple times and comparing the results, or using a checksum to detect corruption. These omissions make the attack both simple and highly effective.
The LPC1114 CRP bypass technique has been adapted and extended to attack other microcontrollers with similar protection mechanisms. Researchers have demonstrated that the same voltage glitching approach works on other members of the NXP LPC family, including the LPC1343, LPC1768, and LPC812, all of which use a similar magic-value-based CRP mechanism. The attack has also been replicated using low-cost DIY glitch generators based on the Raspberry Pi Pico and other microcontrollers, reducing the equipment cost from the several-hundred-dollar ChipWhisperer to under ten dollars. In addition to voltage glitching, researchers have explored using electromagnetic fault injection to corrupt the CRP value read, with the advantage that EMFI can be targeted more precisely at the flash memory controller without affecting the rest of the chip. The LPC1114 attack has also inspired research into more sophisticated fault injection techniques, such as clock glitching (manipulating the clock signal to cause setup time violations) and laser fault injection (using a focused laser beam to flip specific bits in the CRP value as it is read from flash). Each of these techniques exploits the same fundamental vulnerability, namely the single-point-of-failure in the CRP value read and the fail-open default behavior. The widespread applicability of this attack pattern across multiple chip families and vendors highlights a systemic weakness in microcontroller security design, where readout protection mechanisms often rely on simple configuration values that can be corrupted through physical attacks.
The LPC1114 CRP bypass has significant real-world implications given the chip's widespread deployment in industrial and consumer products. Firmware extraction from LPC1114-based devices can reveal proprietary control algorithms, manufacturing calibration data, network credentials, and encryption keys, enabling product cloning, counterfeiting, and further security attacks. In the automotive aftermarket industry, LPC1114 chips are commonly found in accessory modules such as lighting controllers, infotainment interfaces, and sensor interfaces, where firmware extraction can be used to develop competing products or to modify vehicle behavior in ways that may compromise safety. In industrial automation, the chip is used in PLC modules, sensor interfaces, and motor controllers, where extracted firmware can reveal trade secrets or be used to develop malicious firmware that disrupts industrial processes. The availability of the ChipWhisperer tutorial and the relative simplicity of the attack mean that this technique is well-documented and accessible to anyone with basic hardware skills. Commercial chip decryption services routinely offer LPC1114 firmware extraction as a standard service, often advertising guaranteed success and fast turnaround times. For manufacturers using the LPC1114 in products where firmware confidentiality is important, this attack represents a practical threat that must be addressed through additional security measures beyond the chip's built-in CRP mechanism.
Several mitigation strategies can reduce the risk of successful CRP bypass attacks on the LPC1114 and similar microcontrollers. At the chip level, the most effective mitigation is to use a microcontroller with a more robust readout protection implementation that does not rely on a single magic value with fail-open behavior. Newer NXP chips, such as the LPC55Sxx series, include a dedicated security subsystem (the PRINCE module for flash encryption and the PUF for key storage) and implement readout protection through hardware-enforced access control rather than a software-checked magic value. For existing LPC1114-based designs, several system-level mitigations can be applied. First, sensitive firmware functionality and cryptographic keys should not be stored in plaintext in flash memory, even with CRP enabled, since a successful bypass will expose everything. Instead, application-level encryption should be used to protect sensitive code and data, with the encryption key stored in a separate secure element or derived from a hardware unique key. Second, physical tamper resistance measures such as epoxy potting, security mesh layers, and tamper switches can make it more difficult for an attacker to access the chip and apply glitch attacks. Third, designers can add external voltage monitoring circuits that detect the rapid voltage drops characteristic of glitch attacks and trigger a device reset or erase sensitive data when an attack is detected. Finally, regular security audits should include physical attack surface assessment, and products that require strong firmware protection should be designed from the outset with security in mind, selecting chips with certified security features and implementing defense-in-depth strategies that do not rely on a single protection mechanism.
The NXP LPC1114 CRP bypass is part of a broader pattern of vulnerabilities in microcontroller readout protection mechanisms that rely on magic values or configuration words stored in flash memory. This design pattern, which is common across many microcontroller families from multiple vendors, creates a single point of failure that can be exploited through fault injection or other physical attacks. Researchers have identified similar vulnerabilities in chips from Microchip, Texas Instruments, Renesas, and STMicroelectronics, all of which use some variant of the magic-value approach to configure readout protection. The prevalence of this vulnerability pattern has led to calls for a fundamental redesign of how microcontroller readout protection is implemented, moving away from software-checked configuration values toward hardware-enforced access control that is activated at power-on and cannot be modified through fault injection. The LPC1114 attack has also contributed to the development of standardized fault injection testing methodologies, which are now being incorporated into security evaluation standards such as Common Criteria and FIPS 140-3. These standards require that products claiming a certain security level undergo testing for resistance to voltage glitching, clock glitching, electromagnetic fault injection, and laser fault injection, ensuring that the protection mechanisms have been evaluated against the full range of known physical attack techniques. The ChipWhisperer platform, which was used to demonstrate the LPC1114 attack, has played a crucial role in democratizing fault injection testing, making it possible for small companies and academic institutions to perform security evaluations that were previously only possible at large security laboratories. The LPC1114 case has also inspired the development of automated fault injection frameworks that can systematically search for vulnerable points in a chip's boot sequence, reducing the time and expertise required to perform successful attacks. These frameworks use machine learning algorithms to optimize glitch parameters in real-time, adapting to the specific characteristics of each target chip and achieving higher success rates than manual parameter searching. For the embedded security community, the LPC1114 CRP bypass serves as a classic example of how a simple design decision, such as using a magic value with fail-open behavior, can create a critical security vulnerability that undermines an entire protection mechanism. The case is frequently used in security training courses and textbooks to illustrate the principles of fault injection and the importance of fail-closed security design. The ongoing relevance of the LPC1114 attack, despite the chip's age, demonstrates that vulnerabilities in deployed microcontrollers persist for many years and that the lessons learned from early attacks remain applicable to modern chips. As the Internet of Things continues to expand and as microcontrollers become increasingly integrated into every aspect of modern life, the importance of robust readout protection and the need for thorough physical security testing will only grow. The LPC1114 case will continue to serve as a benchmark for evaluating the security of new microcontroller designs and as a reminder that the fundamental principles of secure hardware design, including fail-closed behavior and redundancy in security-critical operations, are as important today as they were when the chip was first introduced.
The NXP LPC1114 Code Read Protection uses a magic value at flash address 0x2FC. A voltage glitch during the CRP read corrupts the value and defaults to unprotected mode. The fail-open design makes almost any corruption successful. ChipWhisperer Tutorial A9 documents this attack in detail. The attack works on multiple LPC family members with similar CRP mechanisms. Low-cost DIY glitch generators can replicate the attack. The CRP magic value is a single point of failure. A fail-closed design would be significantly more secure. Newer NXP chips include hardware-enforced access control. The LPC1114 is widely used in industrial and consumer products. Firmware extraction enables cloning and reverse engineering. The attack is non-destructive and repeatable. Physical access is required but equipment costs are modest. This case is a classic example of fault injection in training. The magic-value pattern appears in many microcontroller families. Standardized fault injection testing is now part of security certifications. Automated glitch parameter optimization improves success rates. The LPC1114 attack inspired research into more sophisticated techniques. Designers should not rely solely on CRP for firmware protection. Physical security must be considered at the system level.
The NXP LPC1114 Code Read Protection bypass stands as a classic example of how a seemingly robust security mechanism can be defeated by a simple, well-timed physical attack. The voltage glitch attack exploits the chip's reliance on a single magic value stored in flash and its fail-open default behavior, allowing an attacker with a ChipWhisperer or even a low-cost DIY glitch generator to extract the complete firmware in under an hour. This case study underscores the importance of fail-closed security design, redundancy in security-critical operations, and defense-in-depth strategies that protect against the compromise of any single protection mechanism. For the embedded security community, the LPC1114 attack serves as both a practical demonstration of fault injection techniques and a cautionary tale about the limitations of microcontroller readout protection, reminding designers that physical access to a device fundamentally changes the security threat model and that no software-based protection can provide absolute security against a determined physical attacker.