I'm writing code for Arduino that I plan to distribute. But I worry about piracy (the .HEX can extracted from the board and reuploaded to another).

With that in mind, I am storing data to the EEPROM.

Since I am storing data to the EEPROM, can the data be extracted in some way?

  • 1
    You can set the lock fuses to prevent people from reading the flash memory containing your program. I’m not sure if these lock fuses will also protect the eeprom? You could add some very simple encryption. I’ve heard of companies XORing the data with a secret byte. – Gerben Aug 12 '18 at 8:45
  • the only way to protect your program is to not distribute it. .... if someone really wants to copy your program, and they have physical access to the device, then they will find a way to copy the program .... even if it is encrypted, they do not have to decrypt it to copy it – jsotola Aug 12 '18 at 17:23
  • IMHO, due to the amount of code you can fit on an AVR, I (or any coder) can recreate a sketch from hand in a few days (worst-case). The idea is the idea, not the code. – dandavis Aug 12 '18 at 20:10
  • @gre_gor - OP is asking if the EEPROM can be secured, not the firmware – PhillyNJ Aug 13 '18 at 20:01

Nothing is 100% secure. For example, EEPROM and flash can be read using techniques like Scanning Probe Microscopy & Scanning Electron Microscope, even if the security bit is set. IMO, the goal to safely securing your data is to make it extremely hard. You should take a look at the ATAES132a from MicroChip.

The first device in the AES family, the ATAES132A, is a high-speed, high-security, 32K Serial EEPROM that enables authentication and confidential nonvolatile data storage

It also boast a tamper resistant hardware

The ATAES132A device contains physical security features to prevent an attacker from determining the internal secrets. ATAES132A includes tamper detectors for voltage, temperature, frequency, and light, as well as an active metal shield over the circuitry, internal memory encryption, and other various features. The ATAES132A physical design and cryptographic protocol are designed to prevent or significantly complicate most algorithmic, timing, and side-channel attacks.

Not the answer you're looking for? Browse other questions tagged or ask your own question.