Microcontroller Firmware Extraction & PCB Clone
Professional MCU firmware extraction, IC reverse engineering, PCB duplication, schematic recovery and PCB manufacturing services for clients worldwide since 1998.
Professional MCU firmware extraction, IC reverse engineering, PCB duplication, schematic recovery and PCB manufacturing services for clients worldwide since 1998.
The Renesas RH850/P1M-E is a high-end automotive microcontroller designed for powertrain and chassis control applications, featuring a dual-core architecture where one core serves as a checker for the other to meet stringent functional safety requirements. This dual-core lockstep architecture, combined with the chip's read protection mechanism, was intended to provide a high level of security against both random hardware faults and malicious attacks. However, in November 2022, a security researcher operating under the handle "icanhack" published a detailed account of how voltage fault injection can be used to bypass the RH850/P1M-E's read protection, despite the dual-core checker architecture. The attack exploits the fact that the two cores, while designed to verify each other's operation, share a common power supply and can both be affected by a precisely timed voltage glitch. This case study examines the fault injection attack on the RH850/P1M-E, the specific challenges posed by the dual-core checker architecture, and the implications for functional safety and security in automotive microcontrollers.
The RH850/P1M-E is part of Renesas's RH850/P1x family of automotive microcontrollers, designed specifically for powertrain control applications such as engine management and transmission control. The chip features two RH850 CPU cores operating in a lockstep configuration, where the main core executes the application code and the checker core executes the same instructions with a delay, comparing its results against the main core to detect faults. This lockstep architecture is a common technique for achieving ISO 26262 ASIL-D functional safety, as it can detect both permanent and transient faults in the CPU logic. The chip includes up to 4 MB of flash memory, 256 KB of RAM, and a comprehensive set of automotive peripherals including multiple CAN interfaces, ADC converters, and motor control timers. For security, the RH850/P1M-E implements the same IDCODE-based debug authentication mechanism as other RH850 family members, requiring a 16-byte password before allowing debug access. The chip also includes a Secure Onboard Communication (SecOC) module for authenticating CAN messages, and a hardware security module for cryptographic operations. The dual-core architecture was widely assumed to provide inherent protection against fault injection attacks, as a glitch affecting one core would be detected by the other core, triggering a fault response. The icanhack attack demonstrated that this assumption was incorrect, and that a carefully designed voltage glitch could affect both cores in a coordinated way that bypasses the checker mechanism.
A key aspect of the RH850/P1M-E attack is the identification of the VCL pin as the optimal point for applying the voltage glitch. The VCL pin is the output of the chip's internal core voltage regulator, which provides the operating voltage for the CPU cores and code flash memory. This pin is brought out externally to allow a decoupling capacitor to be connected, which stabilizes the core voltage during operation. From an attacker's perspective, the VCL pin is an ideal fault injection point because it directly powers the CPU subsystem while having minimal effect on the chip's peripherals and, crucially, on the core voltage monitor circuit that would normally detect undervoltage conditions and trigger a reset. The RH850/P1M-E has two VCL pins, one for each CPU core, which are normally connected together externally. The attacker can choose to glitch one or both VCL pins, depending on the desired effect. The icanhack attack found that glitching both VCL pins simultaneously was the most effective approach, as it ensured that both the main core and the checker core were affected by the glitch. The glitch is generated by briefly pulling the VCL pin to ground through a MOSFET switch, creating a rapid voltage drop that disrupts the CPU's operation for a fraction of a clock cycle. The duration and timing of the glitch are critical: too short and the CPU is not affected, too long and the chip's brownout detector triggers a reset. The optimal glitch width for the RH850/P1M-E was found to be in the range of 10 to 50 nanoseconds, requiring a high-speed glitch generator with sub-nanosecond timing resolution.
The RH850/P1M-E fault injection attack begins with physical access to the target ECU and identification of the RH850/P1M-E chip and its debug interface. The attacker connects a glitch generator to the VCL pins and a debug adapter to the chip's serial programming interface. The attack targets the "programming enabled" check that the chip performs when it receives a debug command. Normally, when the chip is in read-protected mode, this check returns a value indicating that programming is disabled, and the command is rejected. The voltage glitch is applied at the precise moment when this check is being evaluated, causing the CPU to incorrectly determine that programming is enabled. The challenge with the dual-core architecture is that the checker core independently performs the same check and would detect the discrepancy with the main core, triggering a fault. The attack overcomes this by glitching both cores simultaneously, ensuring that both cores arrive at the same (incorrect) result, so the checker does not detect a fault. This requires precise synchronization of the glitch with the execution of both cores, which is achieved by using the chip's own clock signal as a reference and by carefully calibrating the glitch timing. Once the "programming enabled" check is bypassed, the attacker can use the chip's standard programming commands to read the entire flash memory contents, extracting the complete firmware. The researcher found that the attack has a moderate success rate of approximately one in fifty attempts, but that repeated attempts eventually yield a successful bypass. The attack is non-destructive and does not damage the chip, allowing the ECU to be returned to normal operation after the firmware has been extracted.
The dual-core lockstep architecture is designed to detect faults by comparing the outputs of two identical CPU cores executing the same code. If a transient fault (such as a voltage glitch) affects one core but not the other, the discrepancy in their outputs is detected and the chip enters a safe fault state. The icanhack attack defeats this mechanism by ensuring that the glitch affects both cores simultaneously and in the same way, so that both cores produce the same incorrect output and the checker sees no discrepancy. This is possible because both cores share the same VCL power supply, and a glitch applied to the VCL pin affects both cores equally. The key insight is that the lockstep checker detects asymmetric faults (affecting one core but not the other) but is blind to symmetric faults (affecting both cores in the same way). The RH850/P1M-E's designers likely assumed that a symmetric fault affecting both cores simultaneously was unlikely or impossible, but the voltage glitch attack demonstrates that it is both possible and practical. The attack also exploits the fact that the lockstep comparison has a finite latency, meaning that there is a brief window after a fault occurs before the checker detects it. If the glitch causes the "programming enabled" flag to be set incorrectly and the attacker can issue the read command before the checker detects the fault, the read operation can proceed even if the chip subsequently enters a fault state. This timing-based approach, combined with the symmetric glitch, makes the attack reliable enough for practical exploitation. The vulnerability highlights a fundamental limitation of lockstep architectures for security: they are designed to detect random, uncorrelated faults, not deliberate, coordinated attacks that affect both cores simultaneously.
The RH850/P1M-E fault injection attack has profound implications for the relationship between functional safety and cybersecurity in automotive systems. Functional safety standards such as ISO 26262 assume that hardware faults are random and uncorrelated, and that lockstep architectures can detect these faults by comparing the outputs of redundant cores. However, cybersecurity attacks are deliberate and coordinated, and can exploit the assumptions of safety mechanisms to bypass them. The RH850/P1M-E attack demonstrates that a safety mechanism (dual-core lockstep) that is effective against random faults may be ineffective against a deliberate attack that targets the mechanism's underlying assumptions. This convergence of safety and security is an increasingly important concern in the automotive industry, as vehicles become more connected and more vulnerable to remote attacks that can ultimately lead to physical safety compromises. The attack also demonstrates that chips designed for high functional safety levels (such as ASIL-D) do not automatically provide high security, and that safety and security must be considered as separate but related requirements. For automotive manufacturers, the RH850/P1M-E vulnerability means that ECUs based on this chip cannot be assumed to be secure against physical firmware extraction, even though they meet stringent functional safety requirements. This has implications for the protection of proprietary calibration data, the prevention of ECU cloning, and the security of over-the-air update mechanisms. The attack also contributes to the growing body of evidence that physical security must be an integral part of automotive cybersecurity, alongside network security and application security.
Mitigating the RH850/P1M-E fault injection attack requires a combination of chip-level, board-level, and system-level measures. At the chip level, Renesas has introduced enhanced glitch detection and countermeasures in newer RH850 families, including the RH850/U2A and RH850/E2x, which include dedicated voltage glitch detectors, redundant power supply monitoring, and a hardware security module that is isolated from the main CPU cores. These newer chips also implement asymmetric lockstep architectures where the checker core uses a different implementation or timing, making it more difficult to apply a symmetric glitch that affects both cores identically. At the board level, adding additional decoupling capacitance to the VCL pins can reduce the amplitude of glitch pulses, and implementing voltage monitoring circuits that detect rapid voltage transients can trigger a reset before an attack succeeds. Physical tamper resistance measures such as epoxy potting or metal shielding can make it more difficult for an attacker to access the VCL pins and debug interface. At the system level, sensitive firmware and calibration data should be encrypted, with decryption keys stored in a hardware security module or secure element that is not susceptible to the same glitch attack. Secure boot and runtime integrity checking can ensure that even if firmware is extracted, it cannot be modified and reflashed without detection. Finally, automotive manufacturers should conduct physical security assessments of their ECUs as part of the cybersecurity management system required by UNECE R155, and should prioritize the use of chips with certified security features for safety-critical applications. The RH850/P1M-E attack demonstrates that no single measure is sufficient, and that a defense-in-depth approach combining multiple layers of protection is essential for automotive cybersecurity.
The RH850/P1M-E fault injection attack is part of a broader trend of increasing scrutiny of automotive microcontroller security. As vehicles become more connected and automated, the security of the chips that control their operation has become a critical concern for manufacturers, regulators, and consumers. High-profile demonstrations of remote vehicle hacking, such as the 2015 Jeep Cherokee exploit, have raised awareness of the potential for cyberattacks to compromise vehicle safety, and have prompted regulatory action including the UNECE R155 and R156 regulations. Physical attacks such as the RH850/P1M-E fault injection represent a different but equally important threat vector, as they can be used to extract firmware, identify vulnerabilities, and develop attacks that can then be deployed remotely. The automotive industry has historically prioritized functional safety over cybersecurity, and many automotive microcontrollers were designed with safety features but without adequate security measures. The RH850/P1M-E attack, along with similar attacks on other automotive chips, demonstrates that this prioritization is no longer acceptable, and that security must be given equal weight in the design and evaluation of automotive electronics. The increasing availability of low-cost fault injection equipment and the growing body of published attack research mean that automotive chip security will continue to be an active area of research and concern for the foreseeable future.
The RH850/P1M-E fault injection attack highlights a critical and often overlooked tension in automotive chip design: the distinction between functional safety and cybersecurity. Functional safety, governed by standards such as ISO 26262, focuses on ensuring that systems behave correctly even in the presence of random hardware faults, and mechanisms such as dual-core lockstep are designed to detect these random faults. Cybersecurity, by contrast, focuses on protecting systems against deliberate attacks by intelligent adversaries who can adapt their techniques to exploit specific vulnerabilities. The RH850/P1M-E attack demonstrates that a mechanism designed for functional safety, such as dual-core lockstep, may not provide adequate cybersecurity protection, because an attacker can deliberately create a fault pattern that the safety mechanism is not designed to detect. This convergence of safety and security is an increasingly important concern in the automotive industry, as vehicles become more connected and more vulnerable to cyberattacks that can ultimately affect physical safety. The ISO/SAE 21434 cybersecurity standard and the upcoming revisions to ISO 26262 both recognize this convergence and require manufacturers to consider security implications in their safety analyses and vice versa. The RH850/P1M-E case also has implications for the design of safety-critical systems in other domains, including aerospace, medical devices, and industrial control, where dual-core lockstep and similar redundancy mechanisms are commonly used. In each of these domains, the assumption that random faults are the primary threat is increasingly being challenged by the growing threat of deliberate cyberattacks, and system designers must consider both types of threats when evaluating the effectiveness of their protection mechanisms. The attack has also spurred research into new architectures that provide both safety and security, including asymmetric lockstep where the checker core uses a different microarchitecture or implementation, making it more difficult to apply a symmetric fault that affects both cores identically. Other approaches include the use of diverse redundancy, where different algorithms or implementations are used to perform the same function, and the integration of dedicated security monitors that operate independently of the main CPU cores and can detect and respond to anomalous behavior indicative of an attack. The RH850/P1M-E case also underscores the importance of threat modeling that includes physical attack vectors, as many automotive security analyses focus exclusively on remote network attacks and neglect the risk of physical access to ECUs. For vehicle manufacturers, the case demonstrates that physical security must be an integral part of the vehicle's security architecture, and that ECUs in accessible locations (such as under the hood or in the cabin) must be designed to resist physical attacks. The ongoing development of automotive cybersecurity regulations, including UNECE R155 and the upcoming requirements for software update management (R156), will continue to drive improvements in automotive chip security, and the RH850/P1M-E attack will serve as an important reference point for evaluating the effectiveness of these improvements. As vehicles continue to evolve toward higher levels of automation and connectivity, the importance of integrating safety and security in chip design will only grow, and the lessons learned from the RH850/P1M-E fault injection attack will be essential for building vehicles that are both safe and secure in the face of evolving threats.
The RH850/P1M-E uses dual-core lockstep for ASIL-D functional safety. A symmetric voltage glitch affects both cores identically, bypassing the checker. The VCL pin is the optimal fault injection point. Both cores share the same power supply, enabling symmetric faults. Lockstep detects random but not coordinated deliberate faults. The attack was published by icanhack in November 2022. Glitching both VCL pins simultaneously is most effective. The checker core sees no discrepancy when both cores fault together. This case demonstrates that safety mechanisms are not security mechanisms. ISO 26262 and ISO/SAE 21434 address different threat models. Newer RH850 chips include asymmetric lockstep and glitch detection. Automotive ECUs are increasingly targeted by physical attacks. The extracted firmware enables vehicle modification and cloning. Physical security must be part of automotive cybersecurity. The attack is non-destructive and repeatable. Equipment costs are decreasing as DIY glitchers improve. This vulnerability affects powertrain and chassis controllers. Defense-in-depth includes chip, board, and system measures. The convergence of safety and security is a key industry challenge. This case will inform future automotive chip security design.
The Renesas RH850/P1M-E fault injection attack demonstrates that even dual-core lockstep architectures, designed for the highest levels of functional safety, can be defeated by coordinated voltage glitching that affects both cores simultaneously. The attack exploits the fundamental assumption of lockstep mechanisms, namely that faults are random and uncorrelated, by applying a deliberate, symmetric glitch that bypasses the checker. This case study highlights the critical distinction between functional safety and cybersecurity, and the need to design chips and systems that address both requirements. For the automotive industry, the RH850/P1M-E vulnerability serves as a wake-up call, demonstrating that physical security must be an integral part of automotive cybersecurity and that chips designed for safety-critical applications must also include robust security features. As vehicles continue to evolve toward greater connectivity and automation, the lessons learned from this and similar attacks will be essential for building the secure, safe vehicles of the future. The ongoing cat-and-mouse game between attackers and defenders in automotive chip security ensures that this will remain a dynamic and challenging field for years to come.