Microcontroller Exploits

1 Basics of Memory Extraction

Before we jump into exploits that extract firmware from locked microcontrollers, let’s take a chapter to consider the basics. Let’s briefly race through many of the methods that might work, then in later chapters we will learn those same attacks in detail.

First, it’s important to collect all of the available documentation on the chip, its debugging mechanism, and its bootloaders.

For publicly documented chips, you’ll want the datasheet, the family guide, a few reference designs, and a working cross compiler. Only by first understanding how the chip would be programmed in a factory will you find the bug that dumps the firmware out.

Perhaps I should back up a little and explain these terms. A datasheet is a short ...