I would like to know if there is a 100% safe option today to prevent firmware copy from MCUs. Most MCUs can have an option set at programming that will block any code extraction, but this is usually easy to hack, specially if you use acids to get acess to the die and probe it.
I saw once that some MCUs use cryptographic solutions, but I am not sure how they work, I assume they probe some external hardware for specifc keys, but this is easy to change in the code once it's extracted.
If you know that your MCU will always have power, you could in theory keep your firmware in RAM and apply external measures which will cut power to the RAM/erase it so the firmware is lost if the user does something like remove a cover. This is done for some banking applications (though they usually just erase crypto keys). It's not 100% guaranteed, but it'll probably get you close enough there that it's in-feasible for nearly every attacker.
You can find more ideas from this teardown video of a credit card machine.
In reality, I don't see the need for this level of hardware protection for firmware. It won't be cheap to do and an opportunistic competitor could just as easily reverse-engineer the functionality and sell a cheaper product than you.
If you think acid die access is easy then there are few hard solutions :-).
An external "box" which processes supplied data with a useful and unknown algorithm or process and which is accessed by cryptographically secure means (eg public key cryptography) and returns a useful result makes the system as secure as either the external device or as the difficulty of replicating the algorithm or process. Both can be made "very hard". [eg an internally powered device with power or intrusion detection via a semi-randomly scrambled net of fine copper wire which is wrapped around the device with the whole set in a ceramic matrix would resist most sensible attack methods.]
Here is one such system from long ago {1987!} -
describing a system titled "Ninox"*. This paper was meant to also have my name attached but I failed to make the attachment cryptographically secure :-). The currently perceived merit of this 'suggestion' may be indicated by the fact that the paper is now available for purchase for $1.98.
Abstract:
This paper describes a software protection system which will probably become widely used over the next few years in an effort to control the software piracy problems experienced by the developers of microcomputer software.
The system described was developed by the author and an associate. A number of other researchers have independently come up with similar techniques, but we believe that the work described in this paper includes some useful new developments. We have called the system Ninox.
The system uses a serialized device in each computer system and provides facilities so that software supplied to the user will be able to execute only on the user's machine and it is effectively impossible for the software to be modified to execute on another machine.
Public key cryptography is used to encrypt programs and a method of program distribution is described. The paper also examines some of the difficulties with the system and suggests some of the methods by which the system might be attacked and how it stands up to these attacks. It is generally held (and supported by formal information theory analysis) that a totally secure system is impossible to create.
Recently I made a custom ARM board for my combat robot, and the Atmel SAM3S4 I used on it has an erase pin on it, which when exerted literally blanks your microcontroller.
This is intended as a safety feature for industrial espionage, where you can rig up a sensor/switch/tricky device that triggers this upon intrusion detection. All that is left is the SAMBA boot loader which these Atmel devices restore upon erasing everything else.
That feature is actually used to USB Flash programs onto the device as well, unless of course you have a JTAG connection that process is unnecessary.