STM32F IC unlock

Posted by

STM32F030C8T6 microcontroller is a 32-bit M0 series LQFP-48 microcontroller, high cost-effective ARM microcontroller, in the electric vehicle and household appliances industry is more widely used, for the STM32F030C8T6 microcontroller, our company IC unlock center, has fully grasped the chip decryption algorithm, has completely broken through the technical difficulties can be successfully broken STM32F030C8T6 MCU solution, welcome customers who need to contact us.
The following are the main features and pin definition of STM32F030C8T6 microcontroller.



STM8L IC unlock

Posted by

STM8L051F3P6 TSSOP-20 package is a low-power 8-bit microcontroller, at present we can provide STM8L051F3P6 IC unlock welcome customers in need to contact us. For the STM8 series of chips, our company decryption center has many successful cases, in this series of IC unlock technology has made a breakthrough success, to ensure that it can be 100% cracked, and provide customers with soft encryption cracking, chip decompilation and other services, welcome to consult inspection.
The following are the main features of this chip:

stm8l ic unlock

IC unlock development and program modification

Posted by

IC unlock development and program modification
According to their hobbies and professional ability of SCM soft decryption, seek the cooperation of scientific research units and research institutes, study and analyze foreign advanced SCM programming experience and excellent logic algorithm, in order to enhance the domestic SCM application research strength, provide better performance, lower cost military and civil electronic products and struggle!
Professional quality, sincere service uuu SCM program disassembly; SCM program decompilation; SCM decryption; SCM HEX disassembly modification; program serial number modification; LCD, LED interface characters, graphics modification;
SCM disassembly, binary code modification, SCM assembly code analysis, SCM disassembly analysis, SCM reverse engineering, bin or hex SCM program restore to C code, SCM software encryption and decryption. MCU series: 51 series, AVR series, PIC series, MSP430 series. (if there are other series of singlechip needs analysis, please call the hotline first).
AVR MCU can analyze and decrypt software:
Tiny series:
ATtiny11, ATtiny12, ATtiny13, ATtiny 15L, ATtiny2313, ATtiny24, ATtiny25, ATtiny25 Automotive, ATtiny26, ATtiny261, ATtiny28L, ATtiny44, ATtiny45, ATtiny45 Automotive, ATtiny461, ATtiny84, ATtiny85, ATtiny85, ATtiny861, Q: 1239284072
Mega series:
ATmega 128, ATmega 1280, ATmega 1281, ATmega 128RZA, ATmega 128RZB, ATmega 16, ATmega 162, ATmega 164P, ATmega 165, ATmega 165P, ATmega 168, ATmega 168 Automotive, ATmega 169, ATmega 169P, ATmega 2560, ATmega 2561, ATmega 256RZA, ATmega 256RZB, ATmega 32, ATmega 324P, ATmega 325, ATmega 325, ATmegaga 3250 ATmega 3290, ATmega406, ATmega48, ATmega48 Automotive, ATmega64, ATmega640, ATmega644, ATmega644P, ATmega645, ATmega6450, ATmega649, ATmega6490, ATmega64RZA, ATmega8, ATmega8515, ATmega8535, ATmega88, ATmega88, ATmega88, ATmega88 Automotive, Q: 1239284072
Other special series:
AT90CAN128 Automotive, AT90PWM1, AT90PWM2, AT90PWM3
Note: Unlisted AVR microcontroller can be disassembled analysis, software can be modified, but the analysis cycle is longer.
PIC MCU can analyze and decrypt software:

N76E IC unlock

Posted by

In view of STM8S003F3P6 price rise and market shortage, Xintang withdraws from 8051 MCU N76E003 development board pin compatible with STM8S003. At present, for the N76E003AT20 IC unlock, our company decryption center has fully grasped the IC unlock scheme.
New Tang 8051 single chip microcomputer N76E003 development board pin compatible with STM8S003 original genuine IC, 18K flash, dual serial port, 6 PWM, 12 AD, quality assurance, original genuine, stable supply,
Compared with the N76E003AT20 of new Tang Dynasty, it has more classical advantages.
1T/8051:1T super value microcontroller, 8051 we are more familiar with the classic kernel;
* 18KB Flash ROM: better than 8KB Flash, and 18KB of flash memory space, all can be used as data storage space;
• 1024B SRAM;
• 17 +1 input ports: better than 16 GPIO at most.
• 2*UART, I2C, SPI: superior to SPI/I2C/UART (more than one UART);
8CH of 12bit ADC: better than 5 channel 10bit ADC;
6ch of individual duty PWM: better than 3 way PWM output;
• 10KHz LIRC for WDT reset / WKT;
• 16MHz HIRC + 1% Room temp. + 2% full condition;
The temperature range of -40~105 C is wider.
A wider supply voltage range from 2.4V to 5.5V;
TSSOP20 / QFN20;
• ed & E: MM/400V, Over 4KV, excellent ESD and EFT, anti-interference and ESD protection capabilities;
STM8S003F3P6: A total of 20 feet, up to 16 GPIOs, 16 external interrupts; 2 16-bit timers [TIM1/TIM2], up to three PWM outputs; 5 ADC channels, supporting SPI/I2C/UART; 8KBYTE FLASH, 1KRAM, 128BYTE EEPROM; and built-in 16M high-speed oscillator, WDG, etc.

M306 IC unlock

Posted by

M30620FCAGP IC unlock
Product outline
The M16C/26A group is based on the M16C/60 CPU kernel. When using the PLL synthesizer, the maximum working frequency is 24MHz. Provide mask ROM version and flash edition.
The internal flash memory can be programmed under a single power supply.
Key characteristics
16 bit multifunction timer (including timer A, B, three phase converter motor control function): 8 channel
Clock asynchronous / synchronous serial interface: 3 channel *
10 bit A/D converter: 12 channels *
DMAC:2 channel
CRC arithmetic circuit
Watchdog timer
Clock generation circuit: main clock generation circuit, sub clock generation circuit, internal oscillator, PLL synthesizer.
Oscillation stop detection function
Voltage detection circuit (except for T and V)
Input / output port: 39 *
External interrupt pins: 11
Data flash: 2KB x 2 block (flash only)
Specification of *:48 pin version.
Key applications
Audio, Camera, Office Equipment, Communication Equipment / Portable Equipment, Household Appliances (Converter Household Appliances), Automobile, Motor Control

LATTICE series IC unlock

Posted by

Professional provide a series of IC unlock  services, customers are welcome to contact us.
Recently, we successfully cracked the LATTICE series ispLSI 1048E chips at the request of customers. We can provide IC unlock  services for all series of Lattiec chips, such as ISP2032VE ispLSI 2064VE.
The following are the main parameters of the ispLSI1048E chip:


dsPIC30F IC unlock

Posted by

This decryption center provides dsPIC30F3011 IC unlock service, welcome to consult.
High performance modified RISC CPU:
Improved Harvard architecture
C compiler optimized instruction set architecture
Flexible addressing mode
• 84 basic instructions
24 bit wide instruction, 16 bit width data path.
• 144 KB on chip flash program space
(instruction word)
• 8 bytes of on-chip data RAM
• 4 byte nonvolatile data EEPROM
Work up to 30 MIPS:
– external clock input from DC to 40 MHz
– input for 4 MHz-10 MHz oscillator
Active phase locked loop (4X, 8X, 16X)
• 44 interrupt sources
– 5 external interrupt sources
– 8 users, the priority of each choice.
Interruption source
– 4 processor trap sources
• 16 x 16 bit work register array
The characteristics of the DSP engine are:
Double access data
Accumulator write back for DSP operation
Module and bit inversion addressing mode
Two, 40 bit optional wide battery
Saturation logic
• 17 bit x 17 bit single cycle hardware decimal /
Integer multiplier
• all DSP instruction cycles
+ 16 bit single cycle transition
Peripheral features:
• high pour / pull current I / O pin: 25 mA/25 Ma
• timer module with programmable prescaler:
– 5 16 bit timer / counters;
16 to 32 timer module timer
16 bit capture input function
• 16 bit comparison / PWM output function
• 3 line SPI module (support 4 frame mode)
The I2CTM module supports multiple modes.
And 7-bit/10-bit solution
• 2 UART modules, FIFO buffers
2 CAN modules, 2.0B compatible
The features of the motor control PWM module are:
• 8 PWM output channels
Complementary or independent output
– edge and center alignment mode
• 4 duty cycle generators
Dedicated time base
Programmable output polarity
• dead time control for complementary mode
Manual output control
A / D conversion triggering
Quadrature encoder interface module
A phase, B phase and index pulse input.
• 16 position up / down position counters
Counting direction state
Position measurement (x2 and x4) mode
• programmable digital noise filter on input terminals
• standby 16 bit timer / counter mode
Position counter full / underflow interrupt

IC decryption request source

Posted by

IC decryption request source: that is, external interrupt 0 and 1, introduced through the external pin, there are two pins on the microcontroller, named INT0, INT1, namely P3.2, P3.3 these two pins. In the internal TCON, four bits are related to external interruption. IT0: INT0 trigger mode control bit, can be programmed and reset by software, IT0 = 0, INT0 for low level trigger mode, IT0 = 1, INT0 for negative jump trigger mode. The differences between the two methods will be discussed later. IE0:INT0 interrupt request flag bit. When there is an external interrupt request, this is set to 1 (which is done by the hardware), which clears IE0 by the hardware after the CPU responds to the interrupt. The use of IT1 and IE1 is the same as that of IT0 and IE0. (2) Internal interrupt request source TF0: Overflow interrupt flag of timer T0. When T0 count overflows, TF0 is set by hardware. When the CPU response is interrupted, the TF0 is cleared by the hardware 0. TF1: similar to TF0. TI, RI: serial port sending and receiving interruption, and then explained in serial port. In MCS-51 interrupt system, interrupt allowance register IE is controlled by 8-bit interrupt allowance register IE which can be bit-addressable in chip. Where EA is the master switch, if it is equal to 0, all interrupts are not allowed. The interruption of the e serial port allows the interrupt of the timer 1 1, allowing EX1 interrupt 1 interrupt. ET0 timer 0 interrupt allows EX0 – out interrupt 0 interrupt allowed. If we set the allowable external interrupt 1, timer 1 interrupt allowable, other not allowed, then IE can be EAX, that is, 8CH, of course, we can also use the bit operation instruction SETB EA SETB ET1SETB EX1 to achieve it. Natural Priority of Five Interrupt Sources and Outside Interrupt Service Entry Address 0:0003H Timer 0:000BH Outside Interrupt 1:0013H Timer 1:001BH Serial Port: 0023H Their Natural Priority Ranges from High to Low. Write here, you should understand why there are some programs before we start to write this way: ORG 0000HLJMP START ORG 0030H START:. The purpose of this is to make the vector address occupied by the interrupt source. Of course, when there is no interruption in the program, it is not wrong in principle to write the program directly from 0000H, but it is better not to do so in practice. Priority: SCM adopts the strategy of natural priority and manual setting of high and low priority, that is, programmers can set which interrupts are high priority and which interrupts are low priority, because there are only two levels, there must be some interrupts at the same level, at the same level, determined by natural priority. When starting, every interrupt is low priority, and we can set the priority with instructions. Look at Table 2 where the interrupt priority is set high by the interrupt priority register IP, and one bit in the IP is set to 1. The corresponding interrupt is high priority, otherwise it is low priority. XX X PS PT1 PX1 PT0 PX0

DSPIC30F IC unlock

Posted by

IC unlock may occur when second instructions are executed. In this case, second instructions and additional stopping cycles are allowed to execute before ISR. In this way, the stopping period associated with the second instructions will normally execute. However, the stopping cycle will actually be embedded in the sequence of abnormal processes. If a normal double cycle instruction is interrupted, the abnormal process will continue.
Three, instruction stop cycle and process change instruction
CALL and RCALL instructions use W15 to write to the stack, and if the source read by the next instruction uses W15, execution of the instructions may therefore be forced to stop before the next instruction. RETFIE and RETURN instructions can never be forced to stop before the next instruction, because these instructions can only perform read operations. However, users should be aware that the RETLW instruction can force a stop because it writes to the W register in the last cycle. Because GOTO and transfer instructions do not perform write operations, they can never force instruction to stop.
Four, instruction stop and DO and REPEAT cycles.
In addition to increasing the instruction stop cycle, RAW data dependency does not affect the work of DO or REPEAT loops. The prefetching instructions in the REPEAT loop will not change until the loop completes or occurs. Although register correlation checks cross instruction boundaries, dsPIC30F actually compares the source and destination addresses of the same instruction in a REPEAT loop. The last instruction of the DO loop prefetches the instruction at the start address of the loop or the next instruction (outside the loop). The decision to stop the instruction is made by the last instruction of the loop and the contents of the prefetch instruction.
Five, instruction stop and program space visibility (PSV)
When the program space (PS) is mapped to the data space by enabling the PSV (CORCON < 2 >) bit, and the X space EA is within the visible program space range, the read or write cycle is redirected to the address in the program space. It takes up to 3 instruction cycles to access data from program space. Instruction operations in PSV address space, like any other instruction, are affected by RAW data correlation and subsequent instruction stops.

MCU crack chip decryption methods

Posted by

Source: IC declassified. The attacker took advantage of the loophole in the timing design of erasure operation of the series of microcontrollers. After erasing the encrypted lock bits, the self-programmed program was used to stop the next erasing operation of the on-chip program memory data, thus turning the encrypted microcontrollers into non-encrypted microcontrollers, and then using the programmer to read out the on-chip program.

2. Electronic detection attack usually monitors the analog characteristics of all power supply and interface connections when the processor is in normal operation with high time resolution, and attacks are carried out by monitoring its electromagnetic radiation characteristics. Because MCU is an active electronic device, when it executes different instructions, the corresponding power consumption also changes accordingly. In this way, by using special electronic measuring instruments and mathematical statistical methods to analyze and detect these changes, the specific key information in the MCU microcomputer can be obtained.

3. Fault Generation Technology This technology uses abnormal working conditions to make the processor error, and then provides additional access to attack. The most widely used means of attack include voltage impact and clock impact. Low voltage and high voltage attacks can be used to prohibit protection of circuits or force processors to perform erroneous operations. Clock transient hopping may reset the protection circuit without damaging the protected information. The transient hopping of power and clock can affect the decoding and execution of single instruction in some processors.

4. Probe technology. This technology directly exposes the internal connection of the chip, and then observes, manipulates and interferes with the microcontroller to achieve the purpose of attack.