Possible code/copy protection ItsyBitsy M0?

[Mandel]

Hi :)

I would like to make sure that the code from one Itsy Bitsy M0 cannot be downloaded and put on another. I have generally read for SAMD21 chips that you can set the security bit to 1. However, if I do that, I can still download the UF2 file and just play it on another Itsy Bitsy M0.

Am I doing something wrong?
Or does this not work with the Itsy Bitsy M0?
What alternatives are there to prevent my code from being copied?

[adafruit_support_mike]

The SAMD21 has a memory lock that can be set with a JTAG programmer, but it won't work with a bootloader. Those allow reading so the IDE can verify the code after uploading it.

What alternatives are there to prevent my code from being copied?

Honest answer: don't bother.

It's nearly impossible to prevent a determined attacker from getting whatever they want if they have physical access to the hardware. Any exploit or glitch that allows extraction is theirs to use, and they have as much time to try as they want.

And as a practical matter, intellectual property rights are only worth the time and money you're willing to spend defending them in court. That's why we're an Open Source/Open Hardware company: the people likely to copy our work are small groups that can disappear faster than we could litigate them, and most are international, which makes jurisdiction complicated. The time and effort we'd have to spend chasing copiers is time and effort we prefer to spend developing new products and code.

We find that it's far more cost-effective to protect our place in the market with the things that can't be done in bulk and don't scale easily, like support. Copiers out for a fast buck aren't going to spend time learning the quirks of what they've lifted, and they won't answer questions that don't generate any payment. That means they aren't willing to compete, so they disappear without making all that much money, while and we remain.

[Mandel]

Sure, I get the point. There is no such thing as 100% certainty. But I would like to make it as difficult as possible to copy my software. Are there any ways (without buying additional hardware or similar) to make downloading and copying more difficult?

[adafruit_support_mike]

Programming the microcontroller directly with a JTAG pod will put things at about the same level as the average house door lock: enough to keep basically honest people from finding themselves in a situation where they're tempted to do something stupid.

Anyone who wants to extract the firmware will have to own a JTAG pod and know how to use it, and what they get will be an ELF binary. The number of people who can read code at that level is small, and they know other ways to work around copy prevention if they really want to.

The next step in reverse-engineering the code would be to run it through a disassembler to get high-level functions tagged with any strings you may have left in the code when you compiled it. That's more readable, but is a far cry from documented source code. The attacker would have to read through the generated code to find out what it does, gradually building their way to a working understanding of the system.

At that point they've invested the equivalent of several hundred dollars in specialist time. You have to weigh that cost against the cost of just buying another device.


You can make the reverse-engineering process more annoying by saving a few small but critical pieces of configuration data in external memory.. either QSPI RAM, an I2C EEPROM, or most irritatingly: something like an RTC with a few bytes of scratchpad for user data. The disassembled code will be incomplete, and the attacker will have to do a fair amount of high-level analysis to figure out where the missing piece is.

Building a hash table of function or object pointers, then using externally-stored values to configure the hash function is a simple but effective trick.. especially if you give the hash functions default config values that will run, but won't look up the functions/objects correctly until you load the externally stored data. Cloners who try to download the firmware from the microcontroller and write it to an identical microcontroller will get a copy that runs when connected to a debugger, but doesn't do what it's supposed to.

That will stop most cloners because they aren't interested in spending a lot of time and effort to understand things. They want to spit out fast and easy copies.

[Mandel]

Thank you very much for the useful hints!
Do you maybe have a link to a tutorial how to do this with the ItsyBitsy M0 or comparable MCUs?

[adafruit_support_mike]

Nope.. sorry. I was just listing some things that tend to be a pain in the neck in reverse engineering.