I have a dsPIC33 series micro that I believe is "code protected" because when I try to read back the data on the micro, I get all zeros using a PICKit2 programmer. The PICKit2 programmer is one I purchased from Microchip and I know it works as I've programmed other micros with it.
I'm fairly new to the field of embedded and micro and I'm trying to learn. So various devices I have in my possession, I've successfully tapped the micro and read it's code but the dsPICs I'm not able to get anything but zeros.
I have two questions:
-
If the micro is, in fact, code protected then is there a way to unprotect and extract the image? According to Microchip's web site it states it might be possible but such methods involve subjecting their products beyond their normal operating limits. I'm guessing they are referring to messing with the voltage levels and what not.
-
What is actually going on when I code protect a micro?
As an interesting side note, this particular dsPIC33 I have is programmed in the clear over the USB bus. I could, theoretically, sniff the output of the FTDI chip that sits in front of the Micro and get the code that way but I'm more interested in knowing if reading back all zeros means the chip is code protected and, if so, if it's possible to break the protection, and how this protection is accomplished.
I plan on working on a small gaget as a proof of concept and I would like to ensure the code I write and flash in my own device is protected and so I'm trying to understand how secure this really is.
And for the purist out there, I do realize anything can be broken into — I'm just trying to see what kind of effort is involved in this particular case.
The exact part number is dsPIC33FJ256GP710A from Microchip.
Thanks for reading!
Best Answer
The code protect is (optionally) set using a configuration bit when programming. If not set then you can read back as normal, if set you read back all zeros and the only way to clear it is by erasing the chip.
The bit will control something like a couple of AND gates to control access to the flash memory lines - this page at Flylogic discusses the security bit structure of a PIC16 (how to defeat it here)
To defeat it usually requires access to the die itself - e.g decapping of the chip, a powerful microscope and some idea of what to look for.
This link describes the process of clearing the security bit on a PIC18F.