IC unlock charge

Posted by

We often receive this kind of consultation. For a single chip microcomputer, we take the STC15 series chip as an example. Customer inquiries, whether the STC15 series microcontroller company can IC unlock how much the cost. The reply given by our company is: it can be done and the cost is 1.5W. The customer was surprised when he heard our offer, asked why we were so expensive, and the price of his product was only a few dozen yuan. In this case, I want to say that the IC unlock is the two development of the chip and the single chip computer program, the cost of the chip is not related to the value of the product itself.
Many times, even if it is just a small program within 10K, for our cracked, the cost is basically so much, nothing changed.
Many customers do not understand this, why only a few K small procedures still need to receive such a high cost. In fact, in the process of breaking the chip, we read the program through the FBI connection, and several K and several hundred pieces of K are the same cost as the same step for us, so the offer is also not much.

TMS320F MCU crack success

Posted by

My focus on chip reverse engineering is a project in the direction of MCU crack technology, which is based on MCU decryption, DSP decryption, CPLD chip decryption, ARM MCU crack and SCM software and hardware development.
The TMS320F28068M micro controller provides power supply for the C28x kernel and the parallel accelerator (CLA). The core technology is based on the TI C2000 as the basis for the in-depth study of the TMS320F28 series. The dspc2000 series micro controllers have been successfully MCU crack. Although the TMS320F28068M decryption is the latest product, the MCU crack technology is mature for the core technology and the decryption technology is mature. Under the circumstances, we can have more than 95% of the grasp, and can be equal, the decryption price is informed by the business personnel, the core and the CLA and low pin number devices of high integrated control peripherals to coupling. The code of this series is compatible with the previous C28x based code, and provides a high degree of analog integration.
An internal regulator realizes the operation of a single power supply rail. The HRPWM module has been improved to provide double edge control (FM). An analog comparator with internal 10 bit reference is added, and it can be directly routed to control PWM output. ADC can perform conversion operations within the fixed scale of 0V to 3.3V and support the metric scale VREFHI / VREFLO benchmark. The ADC interface is specifically optimized for low overhead / low latency.
Characteristic
High efficiency 32 bit CPU (TMS320C28x?)
90MHz (11.11ns periodic time)
16 x 16 and 32 x 32 medium access control (MAC) operation
16 x 16 double MAC
Harvard (Harvard) bus architecture
Continuous operation
Fast interruption response and processing
Unified memory programming model
High efficiency code (using C/C++ and assembly language)
floating point unit
Local single precision floating-point operation
Programmable parallel accelerator (CLA)
32 bit floating-point arithmetic accelerator
Code execution that is independent of the main CPU
Viterbi, complex arithmetic, cyclic redundancy check (CRC) unit (VCU)
Extend C28x? Instruction set to support complex multiplication, Viterbi operation, and cyclic redundancy check (CRC).
Embedded memory
Up to 256KB flash memory
Up to 100KB RAM
2KB one-time programmable (OTP) ROM
6 channel DMA
Low device and system cost
3.3 V single power supply
No power ordering
Integrated reset and undervoltage reduction
Low power operation mode
Non analog support pin
Byte order: small end order

DS28E01 IC unlock success

Posted by

Nowadays, more and more people are familiar with the decryption industry, engineers will pay more attention to the encryption of products, so many encryption chips on the market, such as ATSHA204 series, AT88 series, LKT4100 series, DS28E01 series, Korean ALPU series, TI BQ26100 Wait.
Our company focuses on the research of various encryption chips, the structure and assembly instructions of various singlechip, free disassembly, the successful cases of deciphering all kinds of encryption chips on the market. Recently, we have successfully IC unlock the DS28E01 chip, and welcome the customers to call for consultation.
A brief introduction to DS28E01:
DS28E01 communicate with MCU through 1 single buses. The single bus does not say much, and the time required is very strict, accurate to us level.
DS28E01 has four storage areas:
Data storage (EEPROM) (divided into 4 pages, 32 bytes per page).
Key memory (secret) (8 bytes)
Register pages containing specific functions and user bytes (register page)
Volatile register (scratchpad) (8 bytes)
MCU can read and write scratchpad only through single bus, but can not read and write other storage areas directly.
When writing data to the data memory, carrying the initial key or writing the data to the register page, the data is written to the register first, and then the IC unlock the data from the register to the destination address by the corresponding command.
Working principle:
There is a SHA-160 encryption module inside the chip, which participates in the data format of SHA algorithm in 55 byte format.
These data include 8 byte keys, 5 byte user specified random numbers, 32 byte EEPROM content, 7 byte ROMID, 2 byte fixed data (0xFF) and 1 byte EEPROM address TA1.
MCU can read the 20 byte hash value encrypted by the chip through SHA, and compare it with the hash value calculated by MCU itself through the same algorithm.
Since MCU wants to perform the same encryption operation, it must generate the 55 byte message exactly the same as the chip itself. How did it come from?
The 8 byte key is generated and written in itself. ->OK
The 5 byte random number is written to the register before the chip executes SHA. ->OK
The 32 byte EEPROM data will return the 32 byte content before the 20 byte hash value is read back. ->OK
7 bytes ROMID, you can read the ROMID. ->OK of the chip at any time.
2 bytes fixed value, see the handbook to know ->OK
1 bytes TA1, write it yourself. ->OK
Typical application process:
Process 1: initialize the DS28E01 key
The initialization key only operates in the factory before the product is produced, and only needs to be operated once.
Program flow:
1. read chip ROMID
2. generate a unique 64 bit key through a certain algorithm, ensuring that the keys generated by each motherboard are different.
3. write the key to the chip temporary storage area and read back to verify that the write is correct.
4. execute the chip loading key command, so that the chip saves the 64 bit key in the temporary storage area to the key storage area.
5. complete.
Process two: verify the DS28E01 key
The authentication key is carried out in the product application, and every time the product is started, it will verify the correctness of the DS28E01 key.
Validation is normal, and verification is incorrect, and the product is not working properly by certain means.
Program flow:
1. read chip ROMID
2. generate the 64 bit key through the same algorithm in the initialization process.
3. write 8 byte random numbers (only 5 bytes) to the chip temporary storage area, and read back the validation.
4. encrypting the authentication command to the chip, it can read back 32 byte EEPROM data and 20 byte hash value.
5. read data on top, generate 55 byte summary message, and perform SHA1 operations.
6. compare the calculated hash values with the hash values read from the chip.

ADUC7039 IC unlock success

Posted by

Flying star chip decryption center provides ADUC7039 IC unlock technology service, welcome to inquire.
ADuC7039 is a complete system solution for battery monitoring in 12V automotive electronic applications. It integrates all the necessary work energy for accurate intelligent monitoring, processing and diagnosis of 12 V battery parameters (such as battery current, voltage and temperature) under various working conditions.
Advantages and characteristics
High precision ADC
Dual channel, synchronous sampling, 16 bit sigma delta ADC
Programmable ADC throughput: 10 Hz to 1 kHz
5 ppm/ C reference voltage source in the chip
Current channel
Full differential and buffer input
Programmable gain
ADC input range: – 200 mV to +300 mV
Digital comparator, built-in current accumulator function
Voltage channel
Buffering and in chip attenuator are suitable for 12V battery input.
Temperature channel
External and internal temperature sensor scheme
Micro controller
ARM7TDMI-S kernel, 16/32 bit RISC architecture 20.48 MHz PLL on-chip precision oscillator
JTAG port support code download and debug
storage
64 kB Flash/EE memory option, 4 kB SRAM
Flash/EE durability: 10000 cycles, data retention time: 20 years.
Online download through JTAG and LIN
Internal and external settings
LIN 2.1 compatible slave machine
SPI
GPIO port
1 x universal timer
Wake-up and watchdog timer
On – chip power reduction

DS28E01 IC unlock success

Posted by

Nowadays, more and more people are familiar with the IC unlock industry, engineers will pay more attention to the encryption of products, so many encryption chips on the market, such as ATSHA204 series, AT88 series, LKT4100 series, DS28E01 series, Korean ALPU series, TI BQ26100 Wait.
Our company focuses on the research of various encryption chips, the structure and assembly instructions of various singlechip, free disassembly, the successful cases of deciphering all kinds of encryption chips on the market. Recently, we have successfully cracked the DS28E01 chip, and welcome the customers to call for consultation.
A brief introduction to DS28E01:
DS28E01 communicate with MCU through 1 single buses. The single bus does not say much, and the time required is very strict, accurate to us level.
DS28E01 has four storage areas:
Data storage (EEPROM) (divided into 4 pages, 32 bytes per page).
Key memory (secret) (8 bytes)
Register pages containing specific functions and user bytes (register page)
Volatile register (scratchpad) (8 bytes)
MCU can read and write scratchpad only through single bus, but can not read and write other storage areas directly.
When writing data to the data memory, carrying the initial key or writing the data to the register page, the data is written to the register first, and then the chip copies the data from the register to the destination address by the corresponding command.
Working principle:
There is a SHA-160 encryption module inside the chip, which participates in the data format of SHA algorithm in 55 byte format.
These data include 8 byte keys, 5 byte user specified random numbers, 32 byte EEPROM content, 7 byte ROMID, 2 byte fixed data (0xFF) and 1 byte EEPROM address TA1.
MCU can read the 20 byte hash value encrypted by the chip through SHA, and compare it with the hash value calculated by MCU itself through the same algorithm.
Since MCU wants to perform the same encryption operation, it must generate the 55 byte message exactly the same as the chip itself. How did it come from?
The 8 byte key is generated and written in itself. ->OK
The 5 byte random number is written to the register before the chip executes SHA. ->OK
The 32 byte EEPROM data will return the 32 byte content before the 20 byte hash value is read back. ->OK
7 bytes ROMID, you can read the ROMID. ->OK of the chip at any time.
2 bytes fixed value, see the handbook to know ->OK
1 bytes TA1, write it yourself. ->OK
Typical application process:
Process 1: initialize the DS28E01 key
The initialization key only operates in the factory before the product is produced, and only needs to be operated once.
Program flow:
1. read chip ROMID
2. generate a unique 64 bit key through a certain algorithm, ensuring that the keys generated by each motherboard are different.
3. write the key to the chip temporary storage area and read back to verify that the write is correct.
4. execute the chip loading key command, so that the chip saves the 64 bit key in the temporary storage area to the key storage area.
5. complete.
Process two: verify the DS28E01 key
The authentication key is carried out in the product application, and every time the product is started, it will verify the correctness of the DS28E01 key.
Validation is normal, and verification is incorrect, and the product is not working properly by certain means.
Program flow:
1. read chip ROMID
2. generate the 64 bit key through the same algorithm in the initialization process.
3. write 8 byte random numbers (only 5 bytes) to the chip temporary storage area, and read back the validation.
4. encrypting the authentication command to the chip, it can read back 32 byte EEPROM data and 20 byte hash value.
5. read data on top, generate 55 byte summary message, and perform SHA1 operations.
6. compare the calculated hash values with the hash values read from the chip.

ADUC7039 IC unlock success

Posted by

Flying star IC unlock center provides ADUC7039 IC unlock technology service, welcome to inquire.
ADuC7039 is a complete system solution for battery monitoring in 12V automotive electronic applications. It integrates all the necessary work energy for accurate intelligent monitoring, processing and diagnosis of 12 V battery parameters (such as battery current, voltage and temperature) under various working conditions.
Advantages and characteristics
High precision ADC
Dual channel, synchronous sampling, 16 bit sigma delta ADC
Programmable ADC throughput: 10 Hz to 1 kHz
5 ppm/ C reference voltage source in the chip
Current channel
Full differential and buffer input
Programmable gain
ADC input range: – 200 mV to +300 mV
Digital comparator, built-in current accumulator function
Voltage channel
Buffering and in chip attenuator are suitable for 12V battery input.
Temperature channel
External and internal temperature sensor scheme
Micro controller
ARM7TDMI-S kernel, 16/32 bit RISC architecture 20.48 MHz PLL on-chip precision oscillator
JTAG port support code download and debug
storage
64 kB Flash/EE memory option, 4 kB SRAM
Flash/EE durability: 10000 cycles, data retention time: 20 years.
Online download through JTAG and LIN
Internal and external settings
LIN 2.1 compatible slave machine
SPI
GPIO port
1 x universal timer
Wake-up and watchdog timer
On – chip power reduction

STM8S003/STM8S005/STM8S series IC unlock

Posted by

The whole series STM8S003/STM8S005/STM8S series IC unlock can be decrypted. The decryption success rate is almost 100%, the high difficulty chip can be successful in 1-15 days (emergency IC unlock time 1-2 hours), such as the need to welcome calls to consult!
ST expands the product lineup of the 8 bit microcontroller, and launches STM8S series products based on the new generation of STM8 core for the industrial temperature range. The new series of microcontrollers integrate the high speed, processing performance and code efficiency of the new generation kernel, as well as multipurpose peripherals, and have many special functions, which can improve the strength and reliability of the chip. Integrated memory (including real EEPROM) can simplify application simulation. In industrial control and appliance application, STM8S series products can reduce system cost, shorten application development cycle and improve processing performance.

ST expands the product lineup of the 8 bit microcontroller, and launches STM8S series products based on the new generation of STM8 core for the industrial temperature range. The new series of microcontrollers integrate the high speed, processing performance and code efficiency of the new generation kernel, as well as multipurpose peripherals, and have many special functions, which can improve the strength and reliability of the chip. Integrated memory (including real EEPROM) can simplify application simulation. In industrial control and appliance application, STM8S series products can reduce system cost, shorten application development cycle and improve processing performance.
The STM8 8 bit kernel has a 32 bit memory interface and three pipeline architecture, and the highest processing efficiency is up to 20 MIPS at 24MHz frequency. Stack pointer and 16 bit index register can improve the processing performance of tables. The 16MB linear storage address space of the kernel can simplify page operations above 64KB. In addition, the improvements in stack pointers, new addressable patterns, and new instructions enhance support for C programming and real-time performance, and improve code density and processor energy efficiency.
STM8S03F3P6 TSSOP20
STM8S103F3U6[UFQFN20]
STM8S103K3T6[LQFP32 ]
STM8S103K3U6[UFQFPN32 ]
STM8S105C4T6[LQFP48 ]
STM8S105C6T6[LQFP48 ]
STM8S105K4B6[SDIP3]
STM8S105K4T6[LQFP32 ]
STM8S105K4U6[UFQFPN32 ]
STM8S105K6B6[SDIP3]
STM8S105K6T6[LQFP32 ]
STM8S105K6U6[UFQFPN32 ]
STM8S105S4T6[LQFP44 ]
STM8S105S6T6[LQFP44 ]
STM8S207C6T6[LQFP48 ]
STM8S207C8T6[LQFP48 ]
STM8S207CBT6[LQFP48 ]
STM8S207K4T6[LQFP32 ]
STM8S207K6T6[LQFP32 ]
STM8S207K8T6[LQFP32 ]
STM8S207M8T6[LQFP80]
STM8S207MbT6[LQFP80]
STM8S207R6T6[LQFP64 ]
STM8S207R6T6C[LQFP64 ]
STM8S207R8T6[LQFP64 ]
STM8S207R8T6C[LQFP64 ]
STM8S207RBT6[LQFP64 ]
STM8S207RBT6C[LQFP64 ]
STM8S207S6T6[LQFP44 ]
STM8S207S8T6[LQFP44 ]
STM8S207SBT6[LQFP44 ]
STM8S208C6T6[LQFP48 ]
STM8S208C8T6[LQFP48 ]
STM8S208CBT6[LQFP48 ]
STM8S208M8T6[LQFP80]
STM8S208MbT6[LQFP80]
STM8S208R6T6[LQFP64 ]
STM8S208R6T6C[LQFP64 ]
STM8S208R8T〔LQFP64〕
STM8S208R8T6C[LQFP64 ]
STM8S208RBT6[LQFP64 ]
STM8S208RBT6C[LQFP64 ]
STM8S208S6T6[LQFP44 ]
STM8S208S8T6[LQFP44 ]
STM8S208SBT6[LQFP44 ]
STM8S903F3M6[SO20] 6
STM8S903F3P6[TSSOP20]
STM8S903K3B6[SDIP3]
STM8S903K3T6[LQFP32 ]
STM8S903K3U6[UFQFPN32 ]
STM8S903K3U6[VFQFN32 ]
STM8S105C6T6[LQFP48 ]
STM8S105K4B6[SDIP3]
STM8S105K4T6[LQFP32 ]
STM8S105K4U6[UFQFPN32 ]
STM8S105K6B6[SDIP3]
STM8S105K6T6[LQFP32 ]
STM8S105K6U6[UFQFPN32 ]
STM8S105S4T6[LQFP44 ]
STM8S105S6T6[LQFP44 ]
STM8S207C6T6[LQFP48 ]
STM8S207C8T6[LQFP48 ]
STM8S207CBT6[LQFP48 ]
STM8S207K4T6[LQFP32 ]
STM8S207K6T6[LQFP32 ]

HT66F30 IC unlock sucess

Posted by

Flying star technology is dedicated to chip decryption, single chip decryption, encrypted dog cracking, program extraction and other services, the company has a number of senior professional software and hardware R & D engineers and reverse research engineers, as well as advanced testing equipment and instruments. The latest HT66F30-1 has been one of the hard chips in the industry. Sac has now achieved effective results in HT66FXX series through the research of the open chip. It is a A/D type Flash single chip with 8 bit high performance and simple instruction set. The MCU has a series of functions and characteristics, and its Flash memory can be programmed many times to provide users with great convenience. On the memory side, it also contains a RAM data storage and a EEPROM memory that can be used to store non-volatile data such as ordinal and calibration data.
In terms of analog features, the MCU contains a multi-channel 12 bit A/D converter and dual comparator function. It also has a number of flexible timer modules, which can provide timing function, pulse generation function and PWM generation function. The built-in SPI and I2C functions provide a convenient interface for designers to communicate with external hardware. Internal watchdog timer, low voltage reset and low voltage detection and other internal protection characteristics, plus excellent anti-interference and ESD protection performance, to ensure the reliable operation of the MCU under the harsh electromagnetic interference environment. This MCU provides a wealth of HXT, LXT, ERC, HIRC and LIRC oscillator function options, and built-in complete system oscillator, without peripheral components. Its ability to switch dynamically between different modes of operation provides users with a means to optimize SCM operation and reduce power consumption.
HT66FUx0 Series MCU contains UART modules, which can support data communication networks such as singlechip, data connection between low cost PC and external equipment, communication between portable and battery powered equipment. It can be widely used in various products, such as electronic measuring instruments, environmental monitoring, handheld measuring tools, family applications, electronic control tools, motor control and so on, with other features such as time base function and flexible I/O use. If HT66F30-1 chips need to be decrypted, please contact us!

How to inherit and replace the IC unlock technology

Posted by

Peter Drucker, an observer in the industrial age, once summed up the past chip as the three revolution. The first time was the industrial revolution. The core was that machines replaced physical strength, and chip technology surpassed skills. The second time is the revolution of the productive forces, from the 1880 to the Second World War, the core of which is the popularization of scientific management represented by the IC unlock, the knowledge of work, and the concept of standardization and measurement. The new organization of the company is rising with the development of scientific management thought. The third is the management revolution. Knowledge has become the most important factor of production beyond capital and labor force. Compared with manual labor, it is difficult to directly observe and measure the work of the IC unlock. Accordingly, the center of gravity of the management is turned to the incentive, especially the matching of the motive. Option incentive is the most important organizational innovation in the development of high-tech enterprises in the past 20 years.
Along this way, the further development of the IC unlock is the identity of the culture. For most enterprises, the enterprise culture is natural and not artificial. Let like-minded people come together, and there is no need for traditional technology to assess and inspire. In essence, they are self driving and self organizing, and the recognition of IC unlock is very serious. In order to enjoy their own culture, they are willing to give, support and create. A chip deciphering with their values and sense of mission can make them come together and forge ahead, so the core functions of the organization will evolve into culture and values. All successful enterprises are different, because different enterprises have created different social genes or thought genes, and this IC unlock can cross the boundary of the enterprise, affect the whole industry and society, and realize the horizontal inheritance. The acquisition of GE reflects the radiation and influence of Si Chi decryption, and goes out of the boundary of the enterprise and realizes synergy in the industry.
The success of IC unlock is far beyond the scope of home appliances, and the impact is far from limited to Flying star. Building a “self – thought” enterprise culture and “building a single business model” let Flying star technology get rid of the long term price war in the household electrical appliance industry, or even say that the IC unlock created by Flying star has affected the social culture and concept. “A win-win model”, it liberates the staff from the traditional bureaucracy, combines the global resources, continuously iterates the product, finds the market demand, and achieves the goal by self performance, so that everyone is their own CEO. Having their own users is not an end. The ultimate goal is to create subversive products for the decryption of the chip, which will change in the future.

IC unlock uncovered the cat’s eye development

Posted by

Nowadays, the speed of smart cat eye update is very fast, so that people can see too much. The higher the performance of the product, the higher the price is, the less consumer acceptance. How to speed up the popularity of high-performance intelligent cat eyes, only by reducing the cost of research and development and improving the price of products to achieve, the IC unlock company must focus on the market trend, challenge the latest products, innovate the chip to crack technical means, ready to reverse surpass.
Let’s look at the first generation of intelligent electronic cat’s eye, also known as the cat’s eye without communication function. It is only a visible cat’s eye. When guests ring the doorbell, the screen shows the door, and also takes the function of taking pictures or videos. The disadvantage is that the owner can only check photos or videos after returning home, and the information can not be synchronized with the cell phone.
The second generation of intelligent electronic cat eye is called electronic cat eye with SIM communication. On the basis of the first generation, the mobile phone communication function is added, which can be prompted by short message, the photo is sent to the mobile phone in the way of MMS, and the call function of the mobile phone can be used with the guests outside the door. The drawback is that the cost is relatively high, and SMS, MMS, and calls need to be charged separately.
The third generation of intelligent electronic cat eye, also known as WiFi wireless cat eye. It has all the functions of the first generation cat’s eye. On this basis, we use WiFi and mobile Internet to achieve visitors’ visit, ring the bell and alarm, alarm the photos, push the video message to the mobile phone in real time, and also have the video call function. What is even more surprising is that these functions are free, without paying the high cost of mobile phone communication required by the second generation of smart cat’s eye.
As a professional IC unlock company with many years of experience and many successful cases, Flying star has made great achievements in the field of reverse research. Flying star can stand out in many chip decryption colleagues, and establish a partnership with hundreds of enterprises to provide a full range of chip cracking services for customers. To provide a series of IC unlock services such as professional chip decryption, the key is that Flying star has a complete set of integrated circuit board reading labs, chip decryption (semiconductor analysis) laboratory, electronic product mold profile imitation laboratory, component copying laboratory, software system reverse R & D (disassembly) laboratory, and other five colleges and universities. Industry laboratory and a large production and processing plant, and focus on continuous innovation and decryption technology, according to the customer’s IC unlock needs to complete the two development and personalized design.