8 ms·
Reconnecting the fuse isn't a thing, as the other comment notes it's just a bunch of atoms somewhere in the chip. But in case of ROM protection for microcontrol
by stefan_ 5y ago
Reconnecting the fuse isn't a thing, as the other comment notes it's just a bunch of atoms somewhere in the chip. But in case of ROM protection for microcontrollers the fuse doesn't directly, in silicon, prevent reading the ROM - after all the controller still needs to be able to read its code! So in practice the fuse only disables e.g. JTAG access, and often that isn't even done in silicon but through a manufacturer boot ROM that checks the fuse state, then either disables or enables JTAG.
So often the easiest way to still read the ROM is to find some vulnerability in the code the chip is running and use that to run some code that can leak the ROM contents. Beyond that it's possible with voltage glitching and similar fault injection methods to get the chip to skip the fuse check or put it in some other indeterminate state that allows access - there are some well documented methods for popular microcontrollers:
https://www.aisec.fraunhofer.de/en/FirmwareProtection.html https://www.aisec.fraunhofer.de/en/FirmwareProtection.html