A Security Assessment of Protected Execute-Only Firmware in Microcontrollers Through Selective Chemical Engraving

Execute-only memory acts as a security scheme intended to protect critical microcontroller firmware, including Intellectual Property (IP) and sensitive configuration functions related to system security. The execute-only firmware exclusively permits code execution and prevents any external attempts at reading the content. As part of a hardware security assessment, this research reveals a potential vulnerability in protected execute-only firmware, illustrating that its content can be fully extracted using the invasive selective chemical engraving technique. This technique relies on visualizing the data of '0' and '1' through electrochemical reactions. The subsequent firmware recovery process involves direct binary extraction, physical-to-Iogical mapping, and error correction to obtain machine code with 100% accuracy. The resulting machine code can be further disassembled to analyse various instructions, functions, and data libraries. This bottom-up approach of firmware recovery can be invaluable for assessing the integrity and authenticity of the execute-only memory. On the other hand, these findings demonstrate the significant threat posed by the invasive selective chemical engraving technique to protected execute-only firmware in widely deployed microcontrollers. Consequently, there is a pressing need to reassess the current hardware security schemes and implement robust measures to effectively counteract such invasive attacks.