A Serial IO programmer for Renesas M16C, includes security PIN bypass.
Clone or download
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Type Name Latest commit message Commit time
Failed to load latest commit information.
adapter Move and comment adapter code. Jul 19, 2017
host Spellcheck. Jul 19, 2017
.gitignore Update .gitignore. Jul 19, 2017
COPYING Drop copy of license into root. Jul 19, 2017
README.md Grammar. Jul 19, 2017


Renesas M16C programmer

This is the code for a Renesas M16C SerialIO programmer, based on an iCEStick FPGA devboard and Python host software.

Its most interesting feature is being able to crack the security PIN of the bootloader using a simple timing attack on the busy line.

To build and connect the adapter to the target, see adapter/README.md.

To run the host software to dump the target flash, see host/README.md.

The code has been tested to work against a Renesas M306K9FCLRP pulled from a Toshiba R100 Portege laptop.


All the code in this repository is licensed under a BSD-style 2-clause license.