Adventures in glitching PIC microcontrollers to defeat firmware copy protection

No ratings

Presented at Wahckcon 2016 by

Silvio Cesare

Glitching is a non-invasive fault injection attack. For microcontrollers, the clock and the voltage are typical vectors for glitching. In some previous talks, I came across PIC microcontrollers that were found in home alarm systems and remote keyless entry keyfobs. These PICs had copy protection enabled. Defeating that copy protection and getting the code and data would be pretty useful . It would allow me to hunt for vulnerabilities in firmware. In this talk, I'll document my approach and results having built a glitcher to attack these PIC microcontrollers. I tried clock glitching and voltage glitching using an FPGA coded with Verilog, a Pickit3 PIC programmer and custom electronics. I didn't get a complete result, but so far I've been able to partially defeat the data protection of a PIC16F883.