I'm trying to get some practical experience on (side channel) attacks. First I want to note all possible vulnerabilities. I thought about:


I have physical access and I own/wrote the software, that will be run on that device. It is for academic purpose.

Attacking vectors

  • (no side channel) Adressing special secure memory. If there is a function/protocol on that µC, which is able to edit those information (say on a eeprom) and, therefore, can read such stored information (like keys), then I may be able to abuse that function/protocol. I thought about manipulating the firmware in such a manner, that I define the operating address and call the function.
  • Sending multibyte characters. Do such stuff has any effect? I will read some information from a smardcard, which sends a string of defined length (3mb). If there is an information set, like a multibyte character, could I enforce a restart while reading or displaying those? (Like iPhone..)
  • Starting with reduced power. (WDT is active..)
  • Starting with increased energy.
  • Typical errors? (I'm out of that for 6 month now, I do not know many specs of the PIC18 currently, while writing this post)


Could someone point out attacking vectors, I have missed, or which probably will fail or have no relevance? What do I have to check, if I want to ensure, that some Information, that are loaded through the smartcard, will have to effect?

The loaded information are a "string", those will be stored on memory, encrypted. If I want to display those, I need to decrypt first.

I hope, I'm not that much confusing right now and you get my issue.

  • $\begingroup$ I'm not sure the question is o,-topic, or even answerable. PIC18 is a family of micro-controllers. Lots of things (including part of the instruction set) depend on the model. Most if not all models have hardware support for a debugger, that can examine all memory; on most models the debugger can be inhibited, but de-inhibiting it thru fault injection has been a popular sport. Effect of multibyte characters depends entirely on the software running on the PIC18, that you write. $\endgroup$ – fgrieu Apr 3 '18 at 7:49
  • 2
    $\begingroup$ Generally speaking, unless you have differential registers, you'll be able to get something out by a power attack. If you can find lectures by Tom Collins (ece.gatech.edu/faculty-staff-directory/thomas-r-collins), he helped develop the PIC1x family and happens to know all of the undocumented hardware registers. If you want to pick a PIC apart, his labs are an excellent starting point. $\endgroup$ – b degnan Apr 3 '18 at 13:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.