Monday, August 9, 2010

Atmel ATMEGA2560 Analysis (Blackhat follow-up)

At this years Blackhat USA briefings, the ATMEGA2560 was shown as an example of an unsecure vs. secure device.  We have received a few requests for more information on this research so here it goes...

The device did not even need to be stripped down because of designer lazyness back at Atmel HQ.  All we did was look for the metal plates we detailed back in our ATMEGA88 teardown last year and quickly deduced which outputs were the proper outputs in under 20 minutes.

Atmel likes to cover the AVR 'important' fuses with metal plating.  We assume to prevent the floating gate from getting hit with UV however the debunk to this theory is that UV will SET the fuses not clear them!

Image above shows you the location of the plates and two small red marks inside smaller, higher mag'd image.

For those who must absolutely know how to unlock the device, just click on the, "Money Shot!"


  1. I'm in no position to play around at the die level but still love reading about it, how do you go about mapping the internal connections?

  2. Do you use software packages like Degate or something custom made?

  3. Not for fuses. This is done manually (no need to use automated tools).

  4. I've always wanted to see what was under the resin in those really cheap 80s digital watches.. those with the four 7-segment and ':' liquid crystal. I mean the magnified view.

    For how cheap they were available back in the day (even in the 80s the very cheap ones cost $1), they were a marvel. The IC typically was not packaged, but had a blob of resin on it.

    I'm sure any kid with a little bit of imagination has taken one apart after it stopped working :)

  5. (cont. from my last comment)

    If you do intend to magnify a watch circuit, don't pick any fancy new watches.. go for that cheap old tech which were very common. Three buttons on the right:

    1) Top button would show the date and month for a few seconds..

    2) Middle allowed you to set date and time

    3) Bottom switched on a light