4 ms·

Interesting stuff. The method of inverting the die and bonding it to the processor carrier is called Flip-Chip (https://secure.wikimedia.org/wikipedia/en/wiki/

by shabble 15y ago

Interesting stuff. The method of inverting the die and bonding it to the processor carrier is called Flip-Chip (https://secure.wikimedia.org/wikipedia/en/wiki/Flip_chip https://secure.wikimedia.org/wikipedia/en/wiki/Flip_chip), and replaced bonding wires for higher density and better thermal properties (you get direct access to the back of the silicon substrate) The electron microscope images are all cross-sectional, because it appears he doesn't have the equipment to do surface etching, and just cleaved the chip. I've not generally seen good sectional images around though, so it's definitely an interesting look. http://www.flylogic.net/blog/ http://www.flylogic.net/blog/ has a lot of stuff about depackaging and reverse-engineering chips, as does "Dr Decapitator" (http://decap.mameworld.info/ http://decap.mameworld.info/), who decaps old arcade ROMs, and then extracts their actual data from micrograph images to produce romfiles for emulators. Edit: The Sparkfun Saga of the Fake MCUs: Part 1: https://webcache.googleusercontent.com/search?q=cache:kMgE8BEttl0J:www.sparkfun.com/news/350 https://webcache.googleusercontent.com/search?q=cache:kMgE8B... Part 2: https://webcache.googleusercontent.com/search?q=cache:mEZ-8gGcwukJ:www.sparkfun.com/news/364 https://webcache.googleusercontent.com/search?q=cache:mEZ-8g... Part 3: https://webcache.googleusercontent.com/search?q=cache:3Tlcu2MhTp0J:www.sparkfun.com/news/384 https://webcache.googleusercontent.com/search?q=cache:3Tlcu2... (Links via google cache because they seem to have broken their old news URL structure) Edit^2: I forgot I had this old image of a System-in-Package radio module that I made myself (Digital camera through optical microscope at, iirc, 20x) http://metavore.org/faff/chip.jpg http://metavore.org/faff/chip.jpg The thick black lines at the bottom are millimetre markings on a ruler. The processor is at the centre, and the various other modules are SAW filters (https://secure.wikimedia.org/wikipedia/en/wiki/SAW_filter#SAW_filters https://secure.wikimedia.org/wikipedia/en/wiki/SAW_filter#SA...)

soundsop 15y ago
I am a circuit designer and SEM cross-sections are quite commonly used by transistor device designers during design and debug. They also appear in papers about transistor device design. A relevant conference is International Electron Devices Meeting and the related journal paper is IEEE Transactions on Electron Devices. Unfortunately, most of those papers are behind the IEEE paywall. Chipworks is a company that reverse engineers chips for analysis by competitors. Their websites has lots of cool SEM cross-sections: http://www.google.com/search?cx=w&q=chipworks+SEM&tbm=isch http://www.google.com/search?cx=w&q=chipworks+SEM&tb... Even though I design circuits using these devices, I still find the SEMs mindblowing.
reemrevnivek 15y ago
You'll probably see this on the Sparkfun saga, but the way to remove it at the Atmega lab (with a hotplate and acetone) is quite dangerous. Don't try that at home. Instead, drop the whole chip in a test tube of fuming nitric acid at room temp, and let it work slowly overnight. Anything with fuming nitric acid is dangerous, but this is much safer than the hot plate method. See this tutorial by Travis Goodspeed: http://travisgoodspeed.blogspot.com/2009/06/cold-labless-hno3-decapping-procedure.html http://travisgoodspeed.blogspot.com/2009/06/cold-labless-hno...
- shabble 15y ago
  Yeah, it's not something I'd attempt without a fume hood and someone who knows what they're doing. The pic of mine had a simple brazed metal 'lid', which I managed to separate by scraping out the solder with a scalpel, and then finally a hot-air gun to melt the rest and pop the top off. I'm sure I've seen references to HF (Hydrofluoric acid) used in depackaging, but since it also etches silicon, I'd imagine you'd need to be pretty amazingly accurate with it.
  - reemrevnivek 15y ago
    Ordinarily, you use (fuming) nitric acid. This dissolves the epoxy packaging, but leaves silicon and metal intact. You need the HF to etch the top layers of metal/silicon from the die. These layers are above the actual circuitry, and help increase security so that an attacker can't steal IP by using nitric acid and microprobes or UV light to modify the operation of the IC. Flylogic has a special technique by which they selectively etch areas of the metal layers, but not the circuitry below.

by shabble 15y ago

soundsop 15y ago

I am a circuit designer and SEM cross-sections are quite commonly used by transistor device designers during design and debug. They also appear in papers about transistor device design. A relevant conference is International Electron Devices Meeting and the related journal paper is IEEE Transactions on Electron Devices. Unfortunately, most of those papers are behind the IEEE paywall. Chipworks is a company that reverse engineers chips for analysis by competitors. Their websites has lots of cool SEM cross-sections: http://www.google.com/search?cx=w&q=chipworks+SEM&tbm=isch http://www.google.com/search?cx=w&q=chipworks+SEM&tb... Even though I design circuits using these devices, I still find the SEMs mindblowing.

reemrevnivek 15y ago

You'll probably see this on the Sparkfun saga, but the way to remove it at the Atmega lab (with a hotplate and acetone) is quite dangerous. Don't try that at home. Instead, drop the whole chip in a test tube of fuming nitric acid at room temp, and let it work slowly overnight. Anything with fuming nitric acid is dangerous, but this is much safer than the hot plate method. See this tutorial by Travis Goodspeed: http://travisgoodspeed.blogspot.com/2009/06/cold-labless-hno3-decapping-procedure.html http://travisgoodspeed.blogspot.com/2009/06/cold-labless-hno...

shabble 15y ago
Yeah, it's not something I'd attempt without a fume hood and someone who knows what they're doing. The pic of mine had a simple brazed metal 'lid', which I managed to separate by scraping out the solder with a scalpel, and then finally a hot-air gun to melt the rest and pop the top off. I'm sure I've seen references to HF (Hydrofluoric acid) used in depackaging, but since it also etches silicon, I'd imagine you'd need to be pretty amazingly accurate with it.
- reemrevnivek 15y ago
  Ordinarily, you use (fuming) nitric acid. This dissolves the epoxy packaging, but leaves silicon and metal intact. You need the HF to etch the top layers of metal/silicon from the die. These layers are above the actual circuitry, and help increase security so that an attacker can't steal IP by using nitric acid and microprobes or UV light to modify the operation of the IC. Flylogic has a special technique by which they selectively etch areas of the metal layers, but not the circuitry below.