6 ms·

Just curious. Recently I have picked up the hobby of reverse engineering and I read that some electronics components such as a ROM can be protected by blowing t

Just curious. Recently I have picked up the hobby of reverse engineering and I read that some electronics components such as a ROM can be protected by blowing the fuse after writing to it. Is there a physical, affordable way (under 5K USD let's say) to reconnect the fuse somehow?

zaarn 5y ago
The cheapest way to reprogram a blown efuse is to buy a new efuse. In some cases, the efuse is a separated chip but it can be integrated into the CPU or Microcontroller, in which case your only option is to find one of those without the efuse blown. The fuse generally is basically the size of a normal transistor on the IC, good luck getting that repaired otherwise :)
- avian 5y ago
  > The cheapest way to reprogram a blown efuse is to buy a new efuse. I think this somewhat undersells what a monumental task un-blowing an e-fuse on a chip would be (e.g. resetting something like the USB boot enable bit on the RaspberryPi's SoC). If it's even feasible with today's technology, it would take a top-class semiconductor research facility and significant effort to pull it off. It's $millions compared to taking a new ~$1 chip off the shelf.
- userbinator 5y ago
  The fuse generally is basically the size of a normal transistor on the IC, good luck getting that repaired otherwise https://en.wikipedia.org/wiki/Focused_ion_beam https://en.wikipedia.org/wiki/Focused_ion_beam I'm not sure what resolution they've achieved now, but it's definitely possible to either cut or repair connections using such a machine. It's a very expensive process, but definitely within the capabilities of even the far-East "MCU break" companies.
fhars 5y ago
No, that is usually not possible. Sometines you can reset write-once-bits by shining UV light in the right part of the processor die, or you can try to circunvent the fuse checks by fault injection during, https://media.ccc.de/search/?q=fault+injection https://media.ccc.de/search/?q=fault+injection
stefan_ 5y ago
Reconnecting the fuse isn't a thing, as the other comment notes it's just a bunch of atoms somewhere in the chip. But in case of ROM protection for microcontrollers the fuse doesn't directly, in silicon, prevent reading the ROM - after all the controller still needs to be able to read its code! So in practice the fuse only disables e.g. JTAG access, and often that isn't even done in silicon but through a manufacturer boot ROM that checks the fuse state, then either disables or enables JTAG. So often the easiest way to still read the ROM is to find some vulnerability in the code the chip is running and use that to run some code that can leak the ROM contents. Beyond that it's possible with voltage glitching and similar fault injection methods to get the chip to skip the fuse check or put it in some other indeterminate state that allows access - there are some well documented methods for popular microcontrollers: https://www.aisec.fraunhofer.de/en/FirmwareProtection.html https://www.aisec.fraunhofer.de/en/FirmwareProtection.html

zaarn 5y ago

The cheapest way to reprogram a blown efuse is to buy a new efuse. In some cases, the efuse is a separated chip but it can be integrated into the CPU or Microcontroller, in which case your only option is to find one of those without the efuse blown. The fuse generally is basically the size of a normal transistor on the IC, good luck getting that repaired otherwise :)

avian 5y ago
> The cheapest way to reprogram a blown efuse is to buy a new efuse. I think this somewhat undersells what a monumental task un-blowing an e-fuse on a chip would be (e.g. resetting something like the USB boot enable bit on the RaspberryPi's SoC). If it's even feasible with today's technology, it would take a top-class semiconductor research facility and significant effort to pull it off. It's $millions compared to taking a new ~$1 chip off the shelf.
userbinator 5y ago
The fuse generally is basically the size of a normal transistor on the IC, good luck getting that repaired otherwise https://en.wikipedia.org/wiki/Focused_ion_beam https://en.wikipedia.org/wiki/Focused_ion_beam I'm not sure what resolution they've achieved now, but it's definitely possible to either cut or repair connections using such a machine. It's a very expensive process, but definitely within the capabilities of even the far-East "MCU break" companies.

fhars 5y ago

No, that is usually not possible. Sometines you can reset write-once-bits by shining UV light in the right part of the processor die, or you can try to circunvent the fuse checks by fault injection during, https://media.ccc.de/search/?q=fault+injection https://media.ccc.de/search/?q=fault+injection

stefan_ 5y ago

Reconnecting the fuse isn't a thing, as the other comment notes it's just a bunch of atoms somewhere in the chip. But in case of ROM protection for microcontrollers the fuse doesn't directly, in silicon, prevent reading the ROM - after all the controller still needs to be able to read its code! So in practice the fuse only disables e.g. JTAG access, and often that isn't even done in silicon but through a manufacturer boot ROM that checks the fuse state, then either disables or enables JTAG. So often the easiest way to still read the ROM is to find some vulnerability in the code the chip is running and use that to run some code that can leak the ROM contents. Beyond that it's possible with voltage glitching and similar fault injection methods to get the chip to skip the fuse check or put it in some other indeterminate state that allows access - there are some well documented methods for popular microcontrollers: https://www.aisec.fraunhofer.de/en/FirmwareProtection.html https://www.aisec.fraunhofer.de/en/FirmwareProtection.html