When Data Shines - Leaking Data from Microcontrollers Through Photon Emission Analysis

The switching transistors of an Integrated Circuit (IC) emit photons in a phenomenon known as photon emission. This emission allows for the observation of a circuit's activity and the reverse-engineering of its internal components. Under certain conditions, the data being processed can be retrieved using a technique called Photon Emission Analysis (PEA). This paper demonstrates how PEA may be employed to reverse-engineer and retrieve data from the Flash memory embedded in Microcontroller Units (MCUs). It describes the constraints and limitations of PEA while offering a comprehensive explanation of the mechanisms governing light emission in ICs. Detailed insights are provided into the optical setup, sensors used, and operational nuances of embedded MCU memory. To capitalize on the information presented, various scenarios for reverse-engineering the Flash array of an MCU are demonstrated using Space-Resolved Photon Emission Analysis. Additionally, an attack scenario exploiting the memory architecture asserted during the characterization phase is presented, demonstrating how secret data stored in the Flash can be retrieved by an attacker with the equipment detailed in this work.