5 ms·

Pulling Bits from ROM Silicon Die Images: Unknown Architecture

94 points by mariuz 6y ago

Scoundreller 6y ago
Will give this a more thorough read later, but definitely has a Chris Tarnovsky feel of what he had posted about paytv cards. Whenever dealing with HF (hydrofluoric acid, not high frequency!) make sure you have your calcium-based antidotes handy and get yourself to a hospital if exposed. It’s incredibly harmful, but may not feel that way.
- azalemeth 6y ago
  Indeed. HF causes life-long disfigurement and can be fatal. IV calcium gluconate is the antidote in question, often prescribed until ECG changes become limiting. It is a small ion and literally eats your bones. I'm amazed you can buy it in a product from Amazon in the US. That warning aside, this article is amazing --- very insightful. I've no idea how to begin reversing an unknown architecture's firmware. I'm still not entirely sure I know the point of this, but it's definitely fun...
  - Scoundreller 6y ago
    Industrially, I’ve seen calcium topical formulations as something to hold you over.
    - ryancor_ 6y ago
      You can get calcium gluconate gel on amazon, its good to keep that on hand!
  - ryancor_ 6y ago
    If you think there is anything I didn't stress enough in the article with the dangers of HF, please let me know i'll add. I mentioned calcium ion attraction, and eating bones, etc. I also mentioned that I have using whink which is 1.5% conc of HF and to not go to a higher conc
404mm 6y ago
This is pretty mind blowing. I’m barely grasping the idea of being capable of manufacturing something _this_ small. But reversing the process is straight up there with unscrambling eggs. Just wow.
- PaulHoule 6y ago
  From an image processing perspective I think this is just like reading a 2-d barcode like data matrix or QR or maybe reading a punchcard. Getting to the image though is an act of physical heroism that he builds up to gradually (e.g. how can you really be so afraid of H2SO4?) to the point where he is mixing acids with bleach at which point I'm intimidated.
  - kens 6y ago
    Two things make extracting the data more complex than something like a QR code or punchcard. First, the image quality from a die usually isn't perfect. There are often a few spots where it's hard to figure out visually, let alone with software. Second, the ROM layout isn't documented and there are a lot of possibilities. Big-endian or little-endian? Is a transistor a 1 or 0? What direction does the layout go? Are columns or rows more significant bits? So you end up with 2×2×2×... possibilities for interpretation. And that's assuming the ROM layout doesn't have something entirely unexpected, which happens quite often.
  - SAI_Peregrinus 6y ago
    H2SO4 isn't that intimidating. Neither is HCl. HF is VERY intimidating, if you're smart. And you *REALLY* don't want to encounter the anhydrous gaseous form.
    - ryancor_ 6y ago
      I would say SO2 fumes is not something you really want to be to relaxed with. But I agree with HCl, its nothing too scary compared. HF is scary as shit, even the low conc i use which is like 1.5%, im still in full PPE gear, even a respirator, it doesn't fume at room temp but still makes me that nervous.
superfamicom 6y ago
I was first introduced to this concept through emulation, specifically Super Nintendo & Arcade work and would eagerly watch change logs. It is amazing to see it really step by step, and even now it still feels like magic. - https://news.ycombinator.com/item?id=3675123 https://news.ycombinator.com/item?id=3675123
- monocasa 6y ago
  Before them, flylogic was publicly documenting the same kind of work in 2007. https://web.archive.org/web/20080612172433/http://www.flylogic.net/blog/?p=26 https://web.archive.org/web/20080612172433/http://www.flylog...
ece 6y ago
This reminds me of seeing a part of the chip from a scanning electron microscope: https://youtu.be/1kQUXpZpLXI?t=169 https://youtu.be/1kQUXpZpLXI?t=169 But I wonder how successful these methods are are extracting keys from a TPM or other hardware keys.
rasz 6y ago
Surprisingly references is missing http://caps0ff.blogspot.com http://caps0ff.blogspot.com <- guys recovering data from Arcade and old computer chips.
- ryancor_ 6y ago
  I work with him a lot, he's a friend, and he prefers to stay anonymous. :) why I didn't reference the site with the name

94 points by mariuz 6y ago

Will give this a more thorough read later, but definitely has a Chris Tarnovsky feel of what he had posted about paytv cards. Whenever dealing with HF (hydrofluoric acid, not high frequency!) make sure you have your calcium-based antidotes handy and get yourself to a hospital if exposed. It’s incredibly harmful, but may not feel that way.

azalemeth 6y ago
Indeed. HF causes life-long disfigurement and can be fatal. IV calcium gluconate is the antidote in question, often prescribed until ECG changes become limiting. It is a small ion and literally eats your bones. I'm amazed you can buy it in a product from Amazon in the US. That warning aside, this article is amazing --- very insightful. I've no idea how to begin reversing an unknown architecture's firmware. I'm still not entirely sure I know the point of this, but it's definitely fun...
- Scoundreller 6y ago
  Industrially, I’ve seen calcium topical formulations as something to hold you over.
  - ryancor_ 6y ago
    You can get calcium gluconate gel on amazon, its good to keep that on hand!
- ryancor_ 6y ago
  If you think there is anything I didn't stress enough in the article with the dangers of HF, please let me know i'll add. I mentioned calcium ion attraction, and eating bones, etc. I also mentioned that I have using whink which is 1.5% conc of HF and to not go to a higher conc

404mm 6y ago

This is pretty mind blowing. I’m barely grasping the idea of being capable of manufacturing something _this_ small. But reversing the process is straight up there with unscrambling eggs. Just wow.

PaulHoule 6y ago
From an image processing perspective I think this is just like reading a 2-d barcode like data matrix or QR or maybe reading a punchcard. Getting to the image though is an act of physical heroism that he builds up to gradually (e.g. how can you really be so afraid of H2SO4?) to the point where he is mixing acids with bleach at which point I'm intimidated.
- kens 6y ago
  Two things make extracting the data more complex than something like a QR code or punchcard. First, the image quality from a die usually isn't perfect. There are often a few spots where it's hard to figure out visually, let alone with software. Second, the ROM layout isn't documented and there are a lot of possibilities. Big-endian or little-endian? Is a transistor a 1 or 0? What direction does the layout go? Are columns or rows more significant bits? So you end up with 2×2×2×... possibilities for interpretation. And that's assuming the ROM layout doesn't have something entirely unexpected, which happens quite often.
- SAI_Peregrinus 6y ago
  H2SO4 isn't that intimidating. Neither is HCl. HF is VERY intimidating, if you're smart. And you *REALLY* don't want to encounter the anhydrous gaseous form.
  - ryancor_ 6y ago
    I would say SO2 fumes is not something you really want to be to relaxed with. But I agree with HCl, its nothing too scary compared. HF is scary as shit, even the low conc i use which is like 1.5%, im still in full PPE gear, even a respirator, it doesn't fume at room temp but still makes me that nervous.

superfamicom 6y ago

I was first introduced to this concept through emulation, specifically Super Nintendo & Arcade work and would eagerly watch change logs. It is amazing to see it really step by step, and even now it still feels like magic. - https://news.ycombinator.com/item?id=3675123 https://news.ycombinator.com/item?id=3675123

monocasa 6y ago
Before them, flylogic was publicly documenting the same kind of work in 2007. https://web.archive.org/web/20080612172433/http://www.flylogic.net/blog/?p=26 https://web.archive.org/web/20080612172433/http://www.flylog...

ece 6y ago

This reminds me of seeing a part of the chip from a scanning electron microscope: https://youtu.be/1kQUXpZpLXI?t=169 https://youtu.be/1kQUXpZpLXI?t=169 But I wonder how successful these methods are are extracting keys from a TPM or other hardware keys.

rasz 6y ago

Surprisingly references is missing http://caps0ff.blogspot.com http://caps0ff.blogspot.com <- guys recovering data from Arcade and old computer chips.

ryancor_ 6y ago
I work with him a lot, he's a friend, and he prefers to stay anonymous. :) why I didn't reference the site with the name