We have noticed a few different die revisions on various Microchip’s substrates that caught our attention. In most case when a company executes any type of change to the die, they change the nomenclature slightly. An example is the elder PIC16C622. After some changes, the later part was named the PIC16C622A and there was major silicon layout changes to the newer ‘A’ part.
The PIC16C54 has been through three known silicon revs (‘A’ – ‘C’) and has now been replaced by the PIC16F54.
However, we’ve noticed two different devices from them (PIC12F683 and PIC18F1320) that caught our eye. The PIC12F683 changes seem purely security related concerns. The code protection output track was rerouted.
Our guess- They were concerned the magic track was too easilly accessable.
We will focus this article to the PIC18F1320 and consider this as a follow-up to our friends at Bunnie Studios, LLC. A few years ago Bunnie wrote an article about being able to reset the fuses of the PIC18F1320 to a ‘1’ thus unlocking the once protected PIC.
The newly improvised second generation PIC18F1320 with fill patterns place over open areas.
You might ask yourself: What are they hiding? The part contains three metal layers however, the top layer has been partially removed by wet-etching techniques. This allows us to see below in denser areas.The newly improvised second generation PIC18F1320 now has these cells covered aka Bunnie attack prevention!
Conclusion: Did they archieve their goal? From an optical attack, sort-of. They are not expecting the attacker to be able to selectively remove this covering metal. Stay tuned for part II of this report where we show you this area with the covering metal removed and the fuses exposed once again!