12c508a
Deprotection Tutorial
The Purpose of this
tutorial is to make known all the necessary techniques to allow
the successful deprotecting of a code protected PIC
12c508a microcontroller. Please note that if this procedure
in unsuccessful in any way then your chip will more than likely
by ruined and the code it contained will probably be lost. Please
do not balme me if you destroy your chip !
| Protected
Code |
Deprotected
Code |
 |
 |
Firstly, the chip is ground down to reduce the amount of acid and
time needed to expose the die. This simple procedure is carried
out with a bench grinder.
| Bench
Grinder |
Chip
Ground |
 |
 |
The
next stage is to heat a small amount of 100% Fuming Nitric Acid
to around 60 degrees C using a hotplate.
| Nitric
Acid |
Hotplate |
Acid
Warming |
 |
 |
 |
Once the
acid is heated we can secure the 12c508a in a small vice and begin
to apply the acid, a drop at a time, to the chip. After about
5-10 minutes the die will start to become visible as the epoxy
is disolved by the acid. After a further few minutes the die will
be fully exposed.
| Acid
on Chip |
Die
Showing |
Exposed
Die |
 |
 |
 |
Once the die is fully
exposed the chip is thoroughly cleaned in acetone and distilled
water in an ultrasonic bath. Be careful when touching the surface
of the die as it is easily damaged.
| Acetone |
Water |
Ultrasonic
Bath |
 |
 |
 |
Here are two pictures,
taken with an Intel QX3 microscope, of the exposed 12c508a die.
One picture was taken before the above cleaning procedure and
one after.
| Microscope |
Dirty
Chip Die |
Clean
Chip Die |
 |
 |
 |
The next step is
to mask off the EPROM array on the die (this information is not
given here), using tape or any suitable opaque material, so that
it cannot be erased when we expose the protection fuses to UV
light in order to reset them. Typically, 5-10 minutes exposure
to UV light will be sufficient to reset the protection fuses,
but in cases where the die is quite heavily fouled UV exposure
times up to 15-30 minutes may be required. Once the protection
fuses are reset you will be able to read the previously protected
code using a suitable reader/programmer.
| Data
Areas |
UV
Eraser |
PicStart
Plus |
 |
 |
 |
Thanks must go to
Sergei P. Skorobogatov for all the invaluable help and advice
he gave to me whilst I was gatering all the equipment and techniques
to carry out the above procedure. Sergei's excellent website can
be visited by clicking here.
The inspiration and the general layout of this webpage is based
upon Gazza's original ripped.htm
page which now no longer exists as part of the Channel
Technology website.
If in the meantime you wish to contact me then please email me
at admin@rampantapathy.co.uk.
|
