Breaking and Securing Memory Isolation in Texas Instruments Microcontrollers

No ratings

Presented at Ruhrsec 2025 by

Jo Bulck

Márton Bognár

Abstract. Texas Instruments has shipped millions of new-generation MSP430 microcontrollers featuring an advanced security feature (Intellectual Property Encapsulation, IPE) that isolates selected code and data from attackers. We first adapt attack techniques from higher-end systems to leak or inject data and extract side-channel information from IPE. Then we demonstrate controlled call corruption, a novel attack which completely bypasses the IPE protections by performing a simple function call. In the second part of the talk, we first demonstrate a software-only mitigation for existing devices which repurposes the memory protection unit to recover most of IPE’s security guarantees. We then introduce openIPE, our research prototype implementing IPE’s specification extended with a flexible firmware layer to enable rapid prototyping of security primitives more closely aligned with industry practices.