NEC 78K0 - reading program from chip

Short of decapsulating the chip, it can't be done. The flash programming system is apparently actually a little masked program on the main section of the die. It can't send data back to the host at all. In fact the only way to verify a chip is by sending the same data twice and having the target system do the verification.

Does the bootloader tell you as soon as there's a byte mismatch? If so, it's fairly straightforward to write a program that can work out the contents of each byte, one at a time. On the average, it takes roughly 64*n times as long as doing a "normal" verify (where n is the number of bytes), but if you can leave it running overnight, it should be doable. If you can start the verify at points other than the beginning of memory, then this improves considerably, approaching 128 times as long as a normal verify.

-- Dave Tweed

In article , David Tweed writes: |> Does the bootloader tell you as soon as there's a byte mismatch? |> If so, it's fairly straightforward to write a program that can |> work out the contents of each byte, one at a time.

Does anyone by chance know some "secret" verification process of R6500/11 microcontrollers? Those employ a 3kB mask-programmable ROM area -- I guess correct function/programming is tested after assembly of the entire chip and not only on die level.

Rainer

It's not documented, but verifying a chip full of 0x00 against a file full of 0xFF takes the same time as verifying a chip full of 0x00 against a file full of 0x00.

Well, it's not a straightforward case as the bootloader doesn't have readback facility. Verify operation can be applied to a relatively large group of data (something like 128 or 256 bytes). There are several ways of extracting the code but they require well qualified engineers and special knowledge. The whole story of various security protections and attacks on microcontrollers are in the book called "Semi-Invasive Attacks - A New Approach to Hardware Security Analysis". It won't help you to solve the problem but it'll give you some idea on how it can be done. Alternatively, there are some commercial companies around the world which provide code extraction service if you can prove good intentions.

Sergei

No hits on this title. ISBN or author / publisher, please?

I recall a recent book with a section on this topic, but I'm not finding it at the moment.