Backdooring Hardware Devices by Injecting Malicious Payloads on Microcontrollers

## Overview

Shayla Berta (offensive security researcher, Argentina; specializes in assembly-language development for microcontrollers/microprocessors) presented practical techniques for backdooring embedded hardware devices through malicious firmware injection into microcontrollers. Most prior hardware backdoor research focuses on powerful microprocessors (Intel, AMD). This research addresses an understudied attack surface: microcontrollers, which are ubiquitously deployed across physical security systems, automotive fuel injection, industrial sensors, appliances, and robotics. Microcontrollers lack the computing power and memory of microprocessors but are more numerous and less scrutinized for security. Attack methodology combines firmware extraction (dumping program memory via standard programmer hardware), reverse engineering (disassembly to understand program flow), hex-file manipulation (injecting malicious assembly instructions), and firmware reloading to achieve persistent backdoors with full device control. Demonstrated on PIC18 microcontroller family (Microchip), applicable to any microcontroller with accessible programming interface.

## Microcontroller Architecture and Firmware Programming

**Microcontroller vs. Microprocessor**: Microprocessors (Intel, AMD, ARM) contain CPU and separate memory/I/O subsystems; 32-64 bit; high processing capacity; modified Harvard memory; used in multitasking systems requiring full OS. Microcontrollers integrate CPU, RAM, I/O ports, and peripherals on single die; 8-16 bit typical (32-bit variants exist using Cortex cores); lower processing capacity; Harvard memory organization; dedicated to specific repeated tasks (e.g., reading sensor, controlling motor). Cost/power/size tradeoffs favor microcontrollers for embedded applications where full OS unnecessary.

**PIC Microcontroller Family Progression**: (1) PIC12—basic I/O pins, minimal functionality; (2) PIC16—expanded peripherals, USART/CCP communication modules, increased program memory; (3) PIC18 (high-performance)—complex architecture with extensive peripherals, supports USART/CAN/SPI communication protocols, ADC converters, timer modules, multiple interrupt sources; (4) 32-bit variants—Cortex cores, approaching microprocessor capabilities but remaining in microcontroller form factor.

**Firmware Development Workflow**: Developers write firmware in assembly (preferred for performance-critical code) or C (for portability). Compiler/assembler generates hexadecimal (.hex) firmware file containing object code. Microchip provides free MPLAB IDE for development and compilation. Programmer software communicates with programmer hardware (PQZ3 programmer, ~$40) to load hex file into microcontroller program memory via ICSP (In-Circuit Serial Programming) pins (power, clock, data lines). Microcontroller executes loaded instructions via embedded CPU.

**Memory Architecture (PIC Example)**: (1) Program Memory—stores firmware instructions (non-volatile flash); (2) RAM—runtime data and special function registers (SFRs) controlling peripheral/CPU behavior (volatile); (3) EEPROM/ROM—persistent data storage, survives power loss. Program memory size ranges from kilobytes (PIC12) to hundreds of kilobytes (PIC18). SFR registers at fixed RAM addresses control all peripheral operations (timers, ADC, UART, interrupts).

## Firmware Extraction, Reverse Engineering, and Payload Injection

**Program Memory Dumping**: (1) Connect target microcontroller to PQZ3 programmer via ICSP pins (VCC, GND, CLK, DAT, MCLR); pins must match microcontroller pinout; (2) Connect programmer to computer via USB; (3) MPLAB IDE queries microcontroller identifier (printed on package) to determine device type; (4) IDE communicates with programmer to read entire program memory; (5) Program memory contents saved as hex file (little-endian encoding—bytes reversed in file). Complete firmware extracted with single operation accessible from IDE menu.

**Disassembly and Reverse Engineering**: MPLAB IDE includes integrated disassembler. Hex file loaded and disassembled to view all assembly instructions with: (1) mnemonic instruction names (MOVFF, GOTO, CALL, etc.); (2) operand values; (3) memory addresses of each instruction; (4) opcodes (raw binary encoding of instruction). Analysts map assembly to hex dump by examining little-endian byte order. Static disassembly reveals program logic, data flow, peripheral initialization sequences, and interrupt handlers. Function calls and jumps identify control flow.

**Malicious Payload Injection**: After understanding target firmware logic, attackers modify hex file to inject malicious assembly instructions. Injection strategies: (1) Replace benign instruction sequences with backdoor code (limited by available space); (2) Overwrite function prologue/epilogue with redirects to malicious code elsewhere; (3) Hijack interrupt handlers to execute attacker code periodically; (4) Modify peripheral initialization to enable unauthorized functionality. Modified hex file reloaded via programmer, overwriting original firmware. Microcontroller executes malicious payload, which persists across power cycles (non-volatile program memory). Resulting compromised device exhibits modified behavior—disarming security systems, misreporting sensor data, unauthorized command execution.