Microcontroller Firmware Extraction & PCB Clone
Professional MCU firmware extraction, IC reverse engineering, PCB duplication, schematic recovery and PCB manufacturing services for clients worldwide since 1998.
Professional MCU firmware extraction, IC reverse engineering, PCB duplication, schematic recovery and PCB manufacturing services for clients worldwide since 1998.
The Microchip PIC16F84 occupies a unique place in the history of hardware security as one of the first microcontrollers to be publicly compromised through a glitch attack. This 8-bit microcontroller, introduced in the late 1990s, became a favorite among hobbyists and embedded developers due to its EEPROM memory, simple architecture, and low cost. However, it also became the subject of pioneering security research by Dr. Sergei Skorobogatov at the University of Cambridge, who demonstrated that the chip's code protection mechanism could be bypassed using a combination of ultraviolet light exposure and glitch attacks. The PIC16F84 case marks the beginning of modern microcontroller security research, establishing many of the techniques and principles that would later be applied to more advanced chips. This case study examines the historical context of the PIC16F84 attack, the specific techniques used to defeat its code protection, and its lasting impact on the field of hardware security.
The PIC16F84 is an 8-bit microcontroller from Microchip Technology's PIC16 family, featuring 1 KB of flash program memory, 68 bytes of data EEPROM, and 36 bytes of SRAM. It uses a modified Harvard architecture with a 14-bit instruction word and a RISC-like instruction set, making it simple to program and understand. The chip's code protection mechanism is controlled by configuration bits stored in a dedicated memory location, which can be set to prevent the program memory from being read back through the programming interface. When code protection is enabled, the programming interface returns all zeros or undefined values when an attempt is made to read the program memory, effectively preventing firmware extraction through the standard ICSP (In-Circuit Serial Programming) interface. The PIC16F84 uses EPROM-style memory cells for its configuration bits, which can be erased by exposure to ultraviolet light through a quartz window on the chip package (in windowed versions) or by electrical erasure (in the flash-based PIC16F84A variant). The code protection bit is implemented as a single fuse that, when programmed, activates the memory access restrictions. Early versions of the chip had relatively simple protection mechanisms that were not designed to withstand sophisticated physical attacks, reflecting the general assumption at the time that physical access to a chip implied a level of trust that made strong security unnecessary.
Dr. Sergei Skorobogatov's research at the University of Cambridge's Computer Laboratory focused on developing techniques for attacking the security mechanisms of smart cards and microcontrollers. His work on the PIC16F84 demonstrated that the chip's code protection could be defeated through a two-stage process involving ultraviolet (UV) light exposure and microprobing. In the first stage, the chip package is decapsulated to expose the silicon die, a process that involves chemically etching away the plastic packaging using fuming nitric acid or a similar solvent. Once the die is exposed, the researcher uses a microscope to locate the code protection fuse, which is physically implemented as a single memory cell on the silicon. By exposing this specific memory cell to UV light from a focused source (such as a UV laser or a microscope-mounted UV lamp), the charge stored in the fuse's floating gate can be selectively erased, resetting the code protection bit to its unprotected state without erasing the program memory. This selective UV erasure is possible because the PIC16F84's code protection fuse is physically separate from the program memory array, and a sufficiently focused UV source can erase one without affecting the other. After the code protection bit is reset, the program memory can be read normally through the ICSP interface, yielding the complete firmware. This technique, while requiring specialized equipment and expertise, demonstrated for the first time that microcontroller code protection was not as secure as manufacturers had claimed, and that physical attacks could reliably defeat it.
In addition to the UV light attack, Skorobogatov also developed a glitch attack technique for the PIC16F84 that did not require decapsulation or UV exposure. This attack involves manipulating the chip's power supply or clock signal during a critical operation to cause the CPU to malfunction in a way that bypasses the code protection check. The PIC16F84's programming interface includes a sequence of operations that must be performed before program memory can be read, including a check of the code protection bit. By applying a precisely timed voltage glitch or clock glitch during this check, an attacker can cause the CPU to incorrectly determine that code protection is disabled, even though the configuration bit indicates it is enabled. The glitch is typically generated using a custom-built circuit that can produce sub-microsecond pulses on the power supply or clock line, synchronized to the chip's instruction execution. The attacker repeatedly attempts the read operation while varying the glitch timing and duration until a successful bypass is achieved. Once the protection is bypassed for a single read operation, the attacker can read the entire program memory by repeating the process for each memory location, or by finding a glitch that permanently disables the protection for the duration of the power-on session. The PIC16F84's relatively simple architecture and lack of glitch detection circuitry make it particularly susceptible to this type of attack, and the success rate can be quite high once the optimal glitch parameters are identified.
The PIC16F84 attacks represent a watershed moment in the history of hardware security research, marking the transition from ad-hoc attacks to systematic, scientifically rigorous analysis of microcontroller security mechanisms. Prior to this research, microcontroller code protection was widely considered to be an effective deterrent against firmware extraction, and many manufacturers relied on it as their primary means of protecting intellectual property. Skorobogatov's work demonstrated that these protections could be reliably defeated with relatively modest equipment and expertise, fundamentally changing the threat model for embedded systems. The techniques developed for the PIC16F84, including decapsulation, selective UV erasure, and voltage/clock glitching, became the foundation for subsequent attacks on more advanced microcontrollers, smart cards, and secure elements. The research also prompted Microchip and other manufacturers to improve the security of their chips, introducing features such as metal mesh shielding over security-sensitive memory cells, glitch detection circuits, and more robust code protection mechanisms. The PIC16F84 case established the principle that security through obscurity and reliance on a single protection bit are fundamentally inadequate for protecting firmware, and that a defense-in-depth approach combining multiple independent protection mechanisms is necessary. Today, the PIC16F84 is largely obsolete, having been replaced by more advanced PIC microcontrollers with significantly improved security features, but its place in the history of hardware security is assured as the chip that launched a thousand attacks and catalyzed the development of modern embedded security research.
In response to the vulnerabilities exposed by the PIC16F84 research and subsequent attacks, Microchip Technology has significantly improved the security features of its PIC microcontroller families over the past two decades. Modern PIC microcontrollers, such as the PIC18 and PIC24 families, include enhanced code protection mechanisms that use multiple configuration bits rather than a single fuse, and that implement access control at a more granular level. The introduction of the Programming and Debugging Interface Disable (PDID) feature provides a hardware-based mechanism for permanently disabling the programming and debug interface, preventing any access to the chip through these interfaces once enabled. Newer PIC chips also include on-chip voltage regulators and brownout detection circuits that make voltage glitching more difficult, and some models include active tamper detection that can erase sensitive data when abnormal conditions are detected. Microchip has also introduced the ATECC608 and other secure element companion chips that provide dedicated cryptographic functionality with certified side-channel and fault injection resistance, allowing designers to offload security-sensitive operations from the main microcontroller. Despite these improvements, researchers continue to find vulnerabilities in modern PIC microcontrollers, and the cat-and-mouse game between attackers and defenders that began with the PIC16F84 continues to this day. The PIC16F84's legacy is thus not merely as a vulnerable chip, but as the catalyst for an ongoing process of security improvement that has benefited the entire embedded systems industry.
The PIC16F84 case offers several enduring lessons for modern embedded security practitioners. First, it demonstrates that single-point security mechanisms, such as a single code protection bit, are inherently vulnerable to physical attacks and should never be relied upon as the sole means of protecting firmware or sensitive data. Second, it shows that physical access to a device fundamentally changes the security threat model, and that any security analysis must consider physical attack vectors including decapsulation, microprobing, UV exposure, and fault injection. Third, the case illustrates the value of open security research, as the public disclosure of the PIC16F84 vulnerabilities directly led to improvements in subsequent chip designs that have made modern microcontrollers significantly more secure. Fourth, it highlights the importance of considering the physical implementation of security mechanisms, not just their logical specification, as the PIC16F84's code protection was logically sound but physically vulnerable to selective erasure and glitching. Fifth, the case demonstrates that attacks only become easier and cheaper over time, as equipment improves and techniques are refined and shared, meaning that a protection mechanism that is adequate today may be inadequate in the future. Finally, the PIC16F84 story reminds us that security is a process, not a product, and that continuous evaluation, improvement, and adaptation are essential for maintaining security in the face of evolving threats. These lessons, first learned from a simple 8-bit microcontroller more than two decades ago, remain as relevant as ever for the complex system-on-chips and IoT devices of today.
The PIC16F84 attacks had a foundational impact on the field of hardware security research that extends far beyond the specific chip itself. The techniques developed for the PIC16F84, including decapsulation, selective UV erasure, and voltage glitching, became the standard toolkit for microcontroller security analysis and were subsequently applied to hundreds of other chip models. The research also established the methodological framework for evaluating microcontroller security, which involves identifying the protection mechanism, understanding its physical implementation, and developing attacks that exploit weaknesses in that implementation. This framework, first formalized in the context of the PIC16F84, is still used by security researchers today. The PIC16F84 case also demonstrated the value of open security research, as the public disclosure of the vulnerabilities directly led to improvements in subsequent microcontroller designs, benefiting the entire industry. The research also had a significant impact on the smart card industry, which was facing similar physical attack threats at the time. The techniques developed for attacking the PIC16F84 were adapted for attacking smart card microcontrollers, leading to a wave of security research in that domain and ultimately to the development of the Common Criteria security evaluation framework for smart cards and secure elements. The PIC16F84's role as a testbed for new attack techniques continued for many years after its initial compromise, with researchers using the chip to develop and demonstrate new fault injection techniques, side-channel analysis methods, and invasive attack tools. The chip's simple architecture and well-documented instruction set made it an ideal platform for this type of research, and many graduate students and early-career researchers cut their teeth on attacking the PIC16F84. The PIC16F84 case also influenced the development of hardware security education, with the chip becoming a standard teaching tool in university courses on embedded systems security and hardware reverse engineering. The relative simplicity of the PIC16F84's architecture and the availability of detailed attack documentation made it possible for students to gain hands-on experience with physical attacks without requiring advanced equipment or expertise. In the commercial sector, the PIC16F84 attacks led to the emergence of a specialized industry of chip decryption and firmware recovery services, which offered to extract firmware from protected microcontrollers for a fee. While some of these services operated legitimately, helping companies recover lost source code from legacy devices, others were used to facilitate product cloning and intellectual property theft. The existence of this commercial ecosystem demonstrated the real-world value of firmware extraction and the economic incentives for developing and refining attack techniques. The PIC16F84's place in the history of hardware security is thus multifaceted: it was the first microcontroller to be publicly compromised through glitch attacks, it catalyzed the development of an entire field of security research, it influenced the design of subsequent chips and security standards, and it became a foundational teaching tool for generations of security researchers. Even though the chip itself is now obsolete, its legacy continues to shape the field of hardware security, and the principles and techniques first demonstrated on the PIC16F84 remain as relevant as ever in the era of the Internet of Things and connected devices.
The PIC16F84 was one of the first microcontrollers publicly cracked by glitch attacks. Sergei Skorobogatov at Cambridge pioneered the attack techniques. UV light exposure can selectively erase the code protection fuse. Voltage and clock glitching can bypass the protection during reads. The chip uses a single code protection bit with no redundancy. Decapsulation is required for UV and microprobing attacks. The PIC16F84's simple architecture made it an ideal research target. Modern PIC chips include metal mesh shielding and glitch detection. The attack established the foundational methodology for MCU security research. Techniques developed here were applied to smart cards and secure elements. The case catalyzed the entire field of hardware security research. Commercial chip decryption services emerged from this research. The PIC16F84 is now largely obsolete but historically significant. Open security research led to improved chip designs. The case demonstrates that single-point protection is inadequate. Physical access demands a fundamentally different threat model. The legacy of the PIC16F84 attack endures in modern security practices. This chip launched a generation of hardware security researchers. The lessons remain relevant for today's complex SoCs. Security is a process, not a one-time design goal.
The PIC16F84 glitch attack stands as the foundational case study in modern microcontroller security research, demonstrating for the first time that the code protection mechanisms of commodity microcontrollers could be reliably defeated through physical attacks. The pioneering work of Sergei Skorobogatov at Cambridge established the techniques and principles that would guide hardware security research for decades, from decapsulation and UV erasure to voltage and clock glitching. While the PIC16F84 itself is now obsolete, its legacy lives on in the improved security features of modern microcontrollers, in the thriving field of hardware security research, and in the increased awareness of physical attack vectors among embedded systems designers. The PIC16F84 case serves as a timeless reminder that no security mechanism is invincible, that physical access demands a fundamentally different threat model, and that the pursuit of security requires constant vigilance, adaptation, and a willingness to learn from successful attacks. As embedded systems become increasingly pervasive and security-critical, the lessons of the PIC16F84 will continue to inform the design and evaluation of secure hardware for generations to come.