Microcontroller Firmware Extraction & PCB Clone
Professional MCU firmware extraction, IC reverse engineering, PCB duplication, schematic recovery and PCB manufacturing services for clients worldwide since 1998.
Professional MCU firmware extraction, IC reverse engineering, PCB duplication, schematic recovery and PCB manufacturing services for clients worldwide since 1998.
The Microchip PIC16F874 is a powerful 8-bit flash microcontroller that found widespread use in industrial control, automotive, and consumer applications due to its generous memory, rich peripheral set, and robust code protection features. Unlike the simpler PIC16F84, the PIC16F874 uses shielded EEPROM cells for its code protection configuration, making it immune to the ultraviolet light attacks that defeated its predecessor. However, security researchers at the University of Cambridge demonstrated that the PIC16F874 could still be compromised through a more sophisticated invasive attack involving decapsulation and microprobing of the silicon die. This attack, documented in the seminal paper "Copy Protection in Modern Microcontrollers" by Sergei Skorobogatov, showed that even chips with improved code protection could be defeated by directly accessing the internal memory bus through microscopic probes. The PIC16F874 case represents an important evolution in microcontroller attack techniques, moving from non-invasive glitching and UV exposure to fully invasive die-level manipulation. This case study examines the microprobing attack methodology, the specific vulnerabilities of the PIC16F874, and the implications for invasive chip security.
The PIC16F874 is part of Microchip's PIC16F87x family of high-end 8-bit microcontrollers, featuring up to 14 KB of flash program memory, 368 bytes of SRAM, and 256 bytes of data EEPROM. It includes a comprehensive set of peripherals including USART, SPI, I2C, ADC, PWM, and timers, making it suitable for complex embedded applications. The chip's code protection mechanism is significantly more advanced than that of the PIC16F84, using shielded EEPROM cells for the protection configuration bits rather than simple EPROM fuses. The shielding consists of a metal layer covering the protection cells, which blocks UV light from reaching the floating gates and prevents the selective erasure technique that worked on the PIC16F84. The PIC16F874 also implements code protection at multiple levels, allowing different regions of program memory to be protected independently, and includes a configuration bit that disables the in-circuit serial programming interface entirely when maximum protection is enabled. These improvements were specifically designed to address the vulnerabilities discovered in earlier PIC chips, and they represented the state of the art in microcontroller code protection at the time of the chip's release. Despite these measures, the PIC16F874's designers did not anticipate the possibility of direct microprobing of the internal memory bus, a technique that bypasses all logical protection mechanisms by accessing the data at the physical level before it reaches the protection circuitry.
The first step in the microprobing attack is decapsulation, the process of removing the chip's plastic packaging to expose the silicon die. This is typically performed using chemical etching with fuming nitric acid, which dissolves the epoxy molding compound that surrounds the die without damaging the silicon itself. The process requires careful control of temperature and timing, as excessive exposure can damage the die's metal layers and bond wires. The chip is first mounted on a suitable substrate, and the nitric acid is applied drop by drop to the top of the package until the die surface is visible. Once the die is exposed, it is rinsed with isopropyl alcohol or deionized water to remove any residual acid, and then examined under a microscope to identify the key functional blocks. For the PIC16F874, the researcher needs to locate the program memory array, the memory controller, and the internal data bus that connects the memory to the CPU. The die layout can be determined through visual inspection, as the different functional blocks have distinctive visual characteristics under magnification, and by referencing the chip's floorplan if available from reverse engineering or manufacturer documentation. The decapsulation process is a prerequisite for all invasive attacks, as it provides physical access to the chip's internal circuitry. While it requires some specialized equipment and chemicals, the process is well-documented and can be performed in a moderately equipped laboratory with appropriate safety precautions.
Once the die is exposed, the microprobing attack involves using microscopic probe needles to make electrical contact with specific metal traces on the chip's surface. These probes, typically made of tungsten or platinum-iridium with tip diameters of less than one micrometer, are mounted on precision micromanipulators that allow them to be positioned with sub-micrometer accuracy. For the PIC16F874 attack, the researcher identifies the internal data bus traces that carry program memory data from the flash array to the CPU. By placing probes on these traces, the attacker can directly observe the data being read from memory, bypassing the code protection circuitry entirely. The attack works by placing the chip in a mode where it sequentially reads from program memory (such as by executing a loop that reads from each memory location), and capturing the data on the internal bus using the microprobes connected to a logic analyzer or oscilloscope. Because the data is observed at the physical level before it reaches the code protection logic, the protection mechanism has no effect on the attack. The researcher can also use microprobes to manipulate the chip's behavior, such as by forcing the code protection configuration lines to their unprotected state, or by injecting signals onto the control bus to change the chip's operating mode. The PIC16F874's relatively large process technology (it was manufactured on a 1 micrometer or larger process) makes the metal traces wide enough to be probed with standard microprobing equipment, though the technique becomes significantly more challenging on smaller process nodes where traces may be only tens of nanometers wide.
The key insight behind the PIC16F874 microprobing attack is that code protection mechanisms, no matter how sophisticated, are implemented as logic circuits that operate on the data after it has been read from the memory array. If an attacker can access the data at a point in the circuit that is before the protection logic, the protection is effectively irrelevant. In the PIC16F874, the program memory data flows from the flash array through sense amplifiers, then through a data latch, and then onto the internal data bus that connects to the CPU. The code protection logic is implemented as a gating circuit on this data bus that replaces the actual data with zeros or undefined values when a read operation is attempted through the programming interface. However, when the CPU itself reads from program memory during normal execution, the protection logic does not gate the data, as the CPU must be able to execute the protected code. The microprobing attack exploits this by observing the data on the internal bus during CPU-initiated read operations, when the protection logic is not active. The attacker can either use the existing firmware to perform reads from all memory locations (if the firmware contains a suitable loop or can be manipulated to do so), or can use additional probes to control the CPU's execution and force it to read from arbitrary addresses. The shielded EEPROM cells that protect the configuration bits are irrelevant to this attack, because the attacker is not attempting to modify or reset the protection configuration, but rather is bypassing it entirely by observing data at a physical point where the protection is not enforced. This represents a fundamental principle of invasive chip attacks: any data that exists in an unprotected form somewhere on the die can potentially be observed by a determined attacker with physical access.
The microprobing attack on the PIC16F874 requires significantly more specialized equipment and expertise than non-invasive attacks such as voltage glitching or UV exposure. The essential equipment includes a chemical decapsulation setup with fuming nitric acid and appropriate safety gear (fume hood, acid-resistant gloves, eye protection), a high-quality optical microscope with at least 1000x magnification and coaxial illumination, a microprobing station with multiple precision micromanipulators and probe needles, and a logic analyzer or high-bandwidth oscilloscope for capturing the probed signals. The total cost of this equipment can range from several thousand to tens of thousands of dollars, depending on the quality and capabilities of the instruments. In addition to equipment, the attack requires considerable expertise in semiconductor physics, microcontroller architecture, and laboratory techniques. The decapsulation process must be performed carefully to avoid damaging the die, and the microprobing requires steady hands and considerable patience to position the probes accurately on the microscopic metal traces. The attacker must also be able to interpret the die layout to identify the correct traces to probe, which may require reverse engineering the chip's floorplan through visual inspection and functional testing. Despite these barriers, the attack is well within the capabilities of university research labs, specialized security companies, and well-funded adversaries. The decreasing cost of used semiconductor testing equipment and the increasing availability of tutorials and open-source tools for chip decapsulation and microprobing have also made these techniques more accessible in recent years.
The disclosure of the PIC16F874 microprobing attack had a significant impact on the microcontroller industry, demonstrating that even chips with advanced code protection features could be compromised through invasive physical attacks. The attack prompted Microchip and other manufacturers to introduce additional physical security features in their chips, including metal mesh shielding over the entire die surface (not just the protection cells), active tamper detection circuits that erase sensitive data when probing is detected, and the use of smaller process technologies that make microprobing more difficult. Metal mesh shielding, in particular, has become a standard feature in high-security microcontrollers and smart cards, consisting of a dense grid of metal lines on the top metal layer that is continuously monitored for breaks or shorts. If an attacker attempts to probe through the mesh, the resulting break or short is detected and triggers a security response such as erasing encryption keys or permanently disabling the chip. The PIC16F874 attack also contributed to the development of dedicated secure element chips and hardware security modules (HSMs) that are specifically designed to resist invasive attacks, with features such as sensor meshes, glitch detectors, side-channel resistant cryptographic implementations, and active shielding. For designers using commodity microcontrollers like the PIC16F874, the attack underscored the importance of not relying solely on the chip's built-in code protection for security-sensitive applications, and of implementing additional measures such as application-level encryption and secure element companions.
While the PIC16F874 is now an older chip and has been largely superseded by more modern microcontrollers with improved security features, the microprobing attack technique remains relevant today. Modern chips manufactured on smaller process nodes are more difficult to probe due to their narrower metal traces and multiple layers of metal interconnect, but advances in probing technology, including the use of focused ion beam (FIB) systems to create access holes through metal layers and the development of nanoprobing stations with atomic-scale positioning, have kept pace with these challenges. Invasive attacks using FIB and microprobing are now standard techniques in the security evaluation of high-security chips, and are used by both attackers and defenders to assess and improve physical security. The PIC16F874 case also established the principle that complete physical security is extremely difficult to achieve in commodity microcontrollers, and that designers should assume that a determined attacker with sufficient resources can eventually extract firmware from any chip that does not include dedicated anti-tamper features. This principle has led to the widespread adoption of defense-in-depth strategies in embedded security, where firmware confidentiality is protected through a combination of chip-level readout protection, application-level encryption, secure key storage in dedicated hardware, and physical tamper resistance at the product level. The PIC16F874's place in the history of hardware security is thus as a milestone in the development of invasive attack techniques, demonstrating the limits of logical protection when faced with physical access to the silicon die.
The PIC16F874 microprobing attack represents an important milestone in the evolution of invasive chip attack techniques, demonstrating that even chips with improved physical protection can be compromised through direct access to the silicon die. The techniques developed for this attack, including chemical decapsulation, die layout analysis, and microprobing of internal buses, have been refined and applied to increasingly complex chips over the past two decades. Modern invasive attacks now routinely use focused ion beam (FIB) systems to create access holes through multiple metal layers, allowing probes to reach specific internal nodes even on chips manufactured on advanced process nodes with ten or more layers of metal interconnect. The FIB technique has also been used to modify chip circuitry, cutting or connecting specific traces to bypass security mechanisms or to add backdoor functionality. The PIC16F874 case also contributed to the development of automated microprobing systems that can position multiple probes simultaneously and acquire data at high speeds, significantly reducing the time required for invasive firmware extraction. These systems, which combine precision robotics with machine vision and real-time signal analysis, are now standard equipment in semiconductor reverse engineering laboratories and in the security evaluation labs of government agencies and large corporations. The attack also highlighted the importance of physical layout security in chip design, leading to the adoption of design-for-security (DFS) practices that make invasive attacks more difficult. These practices include the use of top-layer metal meshes that cover security-sensitive circuitry, the randomization of layout patterns to make reverse engineering more difficult, and the use of dummy circuitry and obfuscation to hide the true function of specific circuit blocks. The PIC16F874 case also influenced the development of anti-tamper technologies, including active mesh sensors that detect probing attempts and trigger a security response, and micro-bump packaging that makes it more difficult to access the die without damaging the chip. While these countermeasures have raised the bar for invasive attacks, they have not eliminated the threat, as determined attackers with sufficient resources can still defeat them. The ongoing cat-and-mouse game between invasive attack techniques and physical security countermeasures ensures that this remains an active area of research and development. The PIC16F874 case also has implications for the security of supply chains, as it demonstrates that chips with improved security features can still be compromised if the physical implementation is not sufficiently robust. For manufacturers and designers, the case underscores the importance of selecting chips with certified physical security features for high-security applications, and of implementing defense-in-depth strategies that do not rely solely on the chip's built-in protection. The PIC16F874's legacy in the field of hardware security is thus as a milestone in the development of invasive attack techniques and as a catalyst for the adoption of physical security countermeasures in modern microcontrollers. The principles established by this case, including the importance of physical implementation security and the limitations of logical protection when physical access is available, continue to guide chip designers and security professionals in their efforts to build more secure embedded systems.
The PIC16F874 uses shielded EEPROM cells that resist UV light attacks. Microprobing bypasses all logical protection by accessing the internal data bus. Decapsulation exposes the silicon die for physical manipulation. The attack requires specialized equipment and expertise. Probe needles make contact with microscopic metal traces on the die. Data is observed at the physical level before protection logic is applied. The shielded protection cells are irrelevant to this attack vector. FIB systems can access nodes on modern process nodes. Metal mesh shielding is the primary countermeasure. Active tamper detection can erase data when probing is detected. The attack is fully invasive and destructive to the chip package. Smaller process nodes make probing more difficult but not impossible. The case established principles of invasive chip security. Design-for-security practices emerged from this research. Automotive and industrial chips commonly use this family. Firmware extraction enables product cloning and IP theft. Physical security must be part of the chip design process. The PIC16F874 case influenced smart card security standards. Invasive attacks remain a threat to high-security devices. Defense-in-depth includes physical and logical protections.
The PIC16F874 microprobing attack represents a significant advancement in the art of microcontroller compromise, demonstrating that even shielded code protection can be defeated through direct physical access to the chip's internal data bus. The invasive technique of decapsulation followed by microprobing bypasses all logical security mechanisms by observing data at the physical level, before it reaches the protection circuitry. While this attack requires more sophisticated equipment and expertise than non-invasive methods, it is a powerful reminder that physical access to a chip provides an attacker with capabilities that cannot be fully mitigated through software or logical protection alone. The PIC16F874 case catalyzed the development of physical security features such as metal mesh shielding and active tamper detection that are now standard in high-security chips, and it established the principle that defense-in-depth is essential for protecting sensitive firmware and data. As semiconductor technology continues to evolve and attack techniques become more sophisticated, the lessons learned from the PIC16F874 microprobing attack remain as relevant as ever for chip designers, security researchers, and embedded systems developers.