5 ms·

I've got to add that this is pretty much how Intel's x86 processors were reverse engineered [1] for use in Soviet IBM PC clones like Poisk [2]. Most resources o

I've got to add that this is pretty much how Intel's x86 processors were reverse engineered [1] for use in Soviet IBM PC clones like Poisk [2]. Most resources on the Web talk about clones of CPUs up to and including the 80286 but I am told there was at least one successful attempt at cloning an earlier version of the 80386. The smaller sub-1 µm process used by Intel for later 80386 and 80486 units proved too much, however. [1] http://www.cpu-world.com/info/exUSSR-chips.html http://www.cpu-world.com/info/exUSSR-chips.html [2] http://www.oldcomputermuseum.com/poisk.html http://www.oldcomputermuseum.com/poisk.html

jgw 14y ago
It's pretty much how modern ASICs are reverse-engineered today - mainly for patent infringement investigation.
- smalley 14y ago
  There are actually substantially more steps involved in reverse engineering more modern SOCs. After depackaging the chips you have to strip the metal layers, special protective layers etc to get to the base layers. Modern processes can have upwards of 8 metal layers along with a top layer composed of filled metal (there are issues with processing if a relatively uniform amount of metal isn't on each layer). After you get the images of the metal layers (you likely can't do this optically for things down near Metal1) you can image the poly and diffusions. You can probably guess which transistors are which based on which power rails they would have been connected to. Things might be easier if you know what standard cell library the designers used when laying out the chip, as then you'd more easily be able to identify the base logical functions faster. If you're being thorough you'd also have to make sure you obtain measurements of the widths of each of the transistors (so you can later figure out the relative drive strength which matters for things like identifying keeper circuits or more precision analog elements etc). Determining some transistor behavior make require even more complicated tests to identify doping levels and if you were trying to duplicate the process you'd have to identify a large number of other materials (for example if they use copper you'd want to find what chemical they used to control the diffusion etc). It's pretty interesting stuff though.
  - moeadham 14y ago
    Yes, and that does not even get into the extremely complex principle of the process technology itself, mixed with the design placement techniques that tend to be very closely tied to the process. Reverse engineering Digital can be conceivable by looking at blocks, but for analog it can be incredibly difficult.
BarsMonster 14y ago
I am the one who have done all these chip photos. I am still looking to find soviet 286 (КР1847ВМ286), but it seems it is extremely rare. If anyone have one - contact me ASAP :-) Just to be fair - I didn't find that soviet "clones" were clones - layout was changed significantly. Centralized planning demanded 100% compatible chips to make near-100% compatible computers, that's the root of all evils.
- terminus 14y ago
  Thanks for all the work. That was an amazing read. I've always wondered how people map chip-die photos into something like this: http://chip-architect.com/news/2007_02_19_Various_Images.html http://chip-architect.com/news/2007_02_19_Various_Images.htm... or this: http://chip-architect.com/news/2003_09_21_Detailed_Architecture_of_AMDs_64bit_Core.html http://chip-architect.com/news/2003_09_21_Detailed_Architect... I can see how figuring out the cache and the internal buses might be doable, but the rest... Any insights?
  - raphman 14y ago
    Maybe interesting: http://www.righto.com/2013/01/a-small-part-of-6502-chip-explained.html http://www.righto.com/2013/01/a-small-part-of-6502-chip-expl... http://www.visual6502.org/ http://www.visual6502.org/
- slug 14y ago
  Awesome work. A simple suggestion: make clear that the labels point to the right picture, say with a horizontal line separating them, since the description for the next image is right below the one before it.
- jfb 14y ago
  What sort of camera rig did you use? The pictures are lovely.
  - BarsMonster 14y ago
    It's metallographic microscope BM-158J with some unnamed 5 megapixel camera attachment. To make large photo I had to take 20-100 shots, and then stitch them into 1 large photo.
kamaal 14y ago
Whoa! Never knew a microprocessor/microcontroller/ASIC could be reverse engineered. How do they even tackle such complexity? Do you know of any resources which explain how it is done?
- BarsMonster 14y ago
  Check out these videos: http://www.youtube.com/user/Andorianin/videos?view=0&flow=grid http://www.youtube.com/user/Andorianin/videos?view=0&flo... There is also software for automatic photo->schematics conversion, but this is quite complicated & not something you can buy at store.
  - kanzure 14y ago
    > There is also software for automatic photo->schematics conversion, but this is quite complicated & not something you can buy at store. You're right, it's too cool for stores. https://github.com/nitram2342/degate https://github.com/nitram2342/degate
    - deleted 14y ago
      [deleted]
subsystem 14y ago
This is also how mifare security was reverse engineered and broken. If I remember correctly they sanded down each layer and used image recognition. https://www.youtube.com/watch?v=QJyxUvMGLr0 https://www.youtube.com/watch?v=QJyxUvMGLr0

jgw 14y ago

It's pretty much how modern ASICs are reverse-engineered today - mainly for patent infringement investigation.

smalley 14y ago
There are actually substantially more steps involved in reverse engineering more modern SOCs. After depackaging the chips you have to strip the metal layers, special protective layers etc to get to the base layers. Modern processes can have upwards of 8 metal layers along with a top layer composed of filled metal (there are issues with processing if a relatively uniform amount of metal isn't on each layer). After you get the images of the metal layers (you likely can't do this optically for things down near Metal1) you can image the poly and diffusions. You can probably guess which transistors are which based on which power rails they would have been connected to. Things might be easier if you know what standard cell library the designers used when laying out the chip, as then you'd more easily be able to identify the base logical functions faster. If you're being thorough you'd also have to make sure you obtain measurements of the widths of each of the transistors (so you can later figure out the relative drive strength which matters for things like identifying keeper circuits or more precision analog elements etc). Determining some transistor behavior make require even more complicated tests to identify doping levels and if you were trying to duplicate the process you'd have to identify a large number of other materials (for example if they use copper you'd want to find what chemical they used to control the diffusion etc). It's pretty interesting stuff though.
- moeadham 14y ago
  Yes, and that does not even get into the extremely complex principle of the process technology itself, mixed with the design placement techniques that tend to be very closely tied to the process. Reverse engineering Digital can be conceivable by looking at blocks, but for analog it can be incredibly difficult.

BarsMonster 14y ago

I am the one who have done all these chip photos. I am still looking to find soviet 286 (КР1847ВМ286), but it seems it is extremely rare. If anyone have one - contact me ASAP :-) Just to be fair - I didn't find that soviet "clones" were clones - layout was changed significantly. Centralized planning demanded 100% compatible chips to make near-100% compatible computers, that's the root of all evils.

terminus 14y ago
Thanks for all the work. That was an amazing read. I've always wondered how people map chip-die photos into something like this: http://chip-architect.com/news/2007_02_19_Various_Images.html http://chip-architect.com/news/2007_02_19_Various_Images.htm... or this: http://chip-architect.com/news/2003_09_21_Detailed_Architecture_of_AMDs_64bit_Core.html http://chip-architect.com/news/2003_09_21_Detailed_Architect... I can see how figuring out the cache and the internal buses might be doable, but the rest... Any insights?
- raphman 14y ago
  Maybe interesting: http://www.righto.com/2013/01/a-small-part-of-6502-chip-explained.html http://www.righto.com/2013/01/a-small-part-of-6502-chip-expl... http://www.visual6502.org/ http://www.visual6502.org/
slug 14y ago
Awesome work. A simple suggestion: make clear that the labels point to the right picture, say with a horizontal line separating them, since the description for the next image is right below the one before it.
jfb 14y ago
What sort of camera rig did you use? The pictures are lovely.
- BarsMonster 14y ago
  It's metallographic microscope BM-158J with some unnamed 5 megapixel camera attachment. To make large photo I had to take 20-100 shots, and then stitch them into 1 large photo.

kamaal 14y ago

Whoa! Never knew a microprocessor/microcontroller/ASIC could be reverse engineered. How do they even tackle such complexity? Do you know of any resources which explain how it is done?

BarsMonster 14y ago
Check out these videos: http://www.youtube.com/user/Andorianin/videos?view=0&flow=grid http://www.youtube.com/user/Andorianin/videos?view=0&flo... There is also software for automatic photo->schematics conversion, but this is quite complicated & not something you can buy at store.
- kanzure 14y ago
  > There is also software for automatic photo->schematics conversion, but this is quite complicated & not something you can buy at store. You're right, it's too cool for stores. https://github.com/nitram2342/degate https://github.com/nitram2342/degate
  - deleted 14y ago
    [deleted]

subsystem 14y ago

This is also how mifare security was reverse engineered and broken. If I remember correctly they sanded down each layer and used image recognition. https://www.youtube.com/watch?v=QJyxUvMGLr0 https://www.youtube.com/watch?v=QJyxUvMGLr0