5 ms·

How does one identify which regions of a die-shot is the CPU or GPU? Are the structures on silicon easily recognizable from such pictures? How far can someone

How does one identify which regions of a die-shot is the CPU or GPU? Are the structures on silicon easily recognizable from such pictures? How far can someone with time and money go towards reverse engineering a chip from such pictures?

wmf 6y ago
For very old chips reverse engineering is relatively easy; here's one example: http://www.righto.com/2020/04/inside-am2901-amds-1970s-bit-slice.html http://www.righto.com/2020/04/inside-am2901-amds-1970s-bit-s... For modern chips you need an electron microscope and there are a lot of metal layers to deal with.
- wtallis 6y ago
  You don't need an electron microscope to discern large-scale repeated structures like CPU and GPU cores, or to tell the difference between random logic and highly regular memory arrays (usually cache, but sometimes you can see microcode or register files if you look at a small enough area). An electron microscope is only useful if you want to fully reverse-engineer the entire circuit schematic, but that's overkill for basically any purpose except manufacturing your own clone.
  - MichaelZuo 6y ago
    So none of the underlying layers matter much for the large and intermediate scale structures?
    - wtallis 6y ago
      With the right camera modifications, you don't have to remove any layers from a chip to discern the core count: https://www.flickr.com/photos/130561288@N04/48258310027/ https://www.flickr.com/photos/130561288@N04/48258310027/ That's an IR photograph taken with a Sony APS-C camera that the IR-blocking filter has been removed from. That's enough to make out the cores and L3 cache slices. (The rest of Fritzchens Fritz's flickr uploads are worth checking out too, especially the video showing how he preps a die for visible light photography.)
      - MichaelZuo 6y ago
        That’s cool! How would the major companies reverse engineer these chips?
        ngcc_hk 6y ago
        Why not underestimate the engineering effort, could the problem is higher up in the chain (software api like Apple os) and lower (the equipment to produce the chip). Would the IP that important?
        dismalpedigree 6y ago
        TechInsights employee here. The chip design and fabrication firms have their own internal RE divisions mostly to QA their own chips. They do competitive RE, but its often less expensive for them to get a subscription to TechInsights. Economies of scale and all that. In terms of how its done, its very proprietary. I can tell you it involves clean rooms, ion beams, electron microscopes, chemistry, and bleeding edge software. If you want to come work for us (its enjoyable, you should :) ) check out our careers page. We are hiring like crazy in many positions. https://www.techinsights.com/about-techinsights/overview/careers-techinsights https://www.techinsights.com/about-techinsights/overview/car...
duskwuff 6y ago
In short: educated guesswork. The lighter blocky regions in the die shot are recognizable as memory; a lot of the rest is based on recognizing duplicated or mirrored elements (like the two CPU1 cores) and making guesses based on their number, relative size, and what they're close to. Identifying the GPU, for example, is based on recognizing that there are eight repeated elements within it, and matching that with the known fact that there are eight GPU cores.
mhh__ 6y ago
I assume you could at least make an educated guess based on the layout and ratios of the area of the caches (assuming you know their topology and sizes) and therefore their proximity to non-cache stuff.
sydney6 6y ago
This [1] is a Talk from John McMaster about "Low-Cost IC Emission Reverse Engineering" using, iirc, commodity cameras. [1]https://www.youtube.com/watch?v=iAuLXg2fVz0 https://www.youtube.com/watch?v=iAuLXg2fVz0
saagarjha 6y ago
In general, the other comments give an idea of how to do it. But Apple shared their own die shots in their presentation ;)
- ogre_codes 6y ago
  And they were actually accurate which is unusual for this sort of thing.
baybal2 6y ago
> How does one identify which regions of a die-shot is the CPU or GPU? Are the structures on silicon easily recognizable from such pictures? Infrared camera
- deleted 6y ago
  [deleted]

wmf 6y ago

For very old chips reverse engineering is relatively easy; here's one example: http://www.righto.com/2020/04/inside-am2901-amds-1970s-bit-slice.html http://www.righto.com/2020/04/inside-am2901-amds-1970s-bit-s... For modern chips you need an electron microscope and there are a lot of metal layers to deal with.

wtallis 6y ago
You don't need an electron microscope to discern large-scale repeated structures like CPU and GPU cores, or to tell the difference between random logic and highly regular memory arrays (usually cache, but sometimes you can see microcode or register files if you look at a small enough area). An electron microscope is only useful if you want to fully reverse-engineer the entire circuit schematic, but that's overkill for basically any purpose except manufacturing your own clone.
- MichaelZuo 6y ago
  So none of the underlying layers matter much for the large and intermediate scale structures?
  - wtallis 6y ago
    With the right camera modifications, you don't have to remove any layers from a chip to discern the core count: https://www.flickr.com/photos/130561288@N04/48258310027/ https://www.flickr.com/photos/130561288@N04/48258310027/ That's an IR photograph taken with a Sony APS-C camera that the IR-blocking filter has been removed from. That's enough to make out the cores and L3 cache slices. (The rest of Fritzchens Fritz's flickr uploads are worth checking out too, especially the video showing how he preps a die for visible light photography.)
    - MichaelZuo 6y ago
      That’s cool! How would the major companies reverse engineer these chips?
      - ngcc_hk 6y ago
        Why not underestimate the engineering effort, could the problem is higher up in the chain (software api like Apple os) and lower (the equipment to produce the chip). Would the IP that important?
      - dismalpedigree 6y ago
        TechInsights employee here. The chip design and fabrication firms have their own internal RE divisions mostly to QA their own chips. They do competitive RE, but its often less expensive for them to get a subscription to TechInsights. Economies of scale and all that. In terms of how its done, its very proprietary. I can tell you it involves clean rooms, ion beams, electron microscopes, chemistry, and bleeding edge software. If you want to come work for us (its enjoyable, you should :) ) check out our careers page. We are hiring like crazy in many positions. https://www.techinsights.com/about-techinsights/overview/careers-techinsights https://www.techinsights.com/about-techinsights/overview/car...

duskwuff 6y ago

In short: educated guesswork. The lighter blocky regions in the die shot are recognizable as memory; a lot of the rest is based on recognizing duplicated or mirrored elements (like the two CPU1 cores) and making guesses based on their number, relative size, and what they're close to. Identifying the GPU, for example, is based on recognizing that there are eight repeated elements within it, and matching that with the known fact that there are eight GPU cores.

mhh__ 6y ago

I assume you could at least make an educated guess based on the layout and ratios of the area of the caches (assuming you know their topology and sizes) and therefore their proximity to non-cache stuff.

sydney6 6y ago

This [1] is a Talk from John McMaster about "Low-Cost IC Emission Reverse Engineering" using, iirc, commodity cameras. [1]https://www.youtube.com/watch?v=iAuLXg2fVz0 https://www.youtube.com/watch?v=iAuLXg2fVz0

saagarjha 6y ago

In general, the other comments give an idea of how to do it. But Apple shared their own die shots in their presentation ;)

ogre_codes 6y ago
And they were actually accurate which is unusual for this sort of thing.

baybal2 6y ago

> How does one identify which regions of a die-shot is the CPU or GPU? Are the structures on silicon easily recognizable from such pictures? Infrared camera

deleted 6y ago
[deleted]