{{template>:project:infobox|
name=chip reverse engineering|
image=pprohd.jpg?200|
sw=-|
hw=-|
founder=[[user:biiter]]|
interested=[[user:biiter]]\\ [[user:nephirus]]\\ [[user:ruza]]\\ [[user:kxt]]|
}}

~~META:
status = active
&relation firstimage = :project:pprohd.jpg
~~

====== Chip reverse engineering ======

===== TODO =====
  * try a few [[http://siliconpr0n.org/wiki/doku.php?id=decap:epoxy_acid|decapping methods]]
  * build a probing station (rigid table with micromanipulators and stereo microscope, like [[http://2.bp.blogspot.com/-FjVxFKm7QxI/T_jYI95hFQI/AAAAAAAAAMc/CeNMcoWHO68/s1600/S7302820.JPG|this]]) for live analysis



===== Workflow =====

==== Decapsulation ====

For IC analysis, you first need to expose the die. This process is called decapsulation. Silicon pr0n wiki has an extensive [[http://siliconpr0n.org/wiki/doku.php?id=decap:start|overview of methods]]. Methods that do not require lots of expensive equipment and we should try are:

  * Cold [[wp>wfna|WFNA]] 
    * [[http://travisgoodspeed.blogspot.cz/2009/06/cold-labless-hno3-decapping-procedure.html]]
    * Pros: 
      * There is considerably less fumes, because all work is done at room temperature.
    * Cons: 
      * [[wp>wfna|WFNA]] is expensive
      * Not suitable for live analysis
  * Hot concentrated sulphuric acid
    * [[http://uvicrec.blogspot.cz/2010/11/sulphuric-acid-decapsulation.html]]
    * [[http://siliconpr0n.org/wiki/doku.php?id=decap:epoxy_acid#sulpheric_acid]]
    * Pros:
      * Concentrated sulphuric acid is quite cheap
    * Cons:
      * Boiling acid == corrosive and toxic fumes
      * Not suitable for live analysis
  * RFNA with preheated chip
    * [[http://siliconpr0n.org/wiki/doku.php?id=decap:epoxy_acid#rfna_preheated_chip]]
    * Pros:
      * This method is used by Atmel failure analysis lab ([[https://www.sparkfun.com/news/384|source]])
      * Suitable for live analysis
    * Cons:
      * Lots of [[wp>nitrogen dioxide|very toxic fumes]], fume hood is **absolutely** necessary
      * [[wp>RFNA|RFNA]] is a strong oxidizer, it has been used with kerosene as a rocket fuel


==== Delayering ====

Stripping individual layers of die to study underlying ones.

We have successfully used chemically assisted etching. It is combination of mechanical etching and chemical method to dissolve the die. This technique can be used only for some chips, but is worth to try.

=====  Required materials ===== 
  * fine sandpaper (2000 is ok)
  * potassium hydroxide (KOH)
  * steel cup
  * something to slowly stir the KOH solution (doing it by hand is annoying) 
  * micromesh (extra fine sandpaper, 8000 or 12000 is best)

===== Workflow ===== 

First use sandpaper to remove top layer(s), where you does not care about precission. Do not go too deep, stop t lest one layer above what you want to see. Do not press hard, be gentle. Hard press causes more rapid etching at the edges and the result is not uniform.

When you are done, use micro-mesh for a while to get rid of biggest unevenness. You can use the same spot on micro-mesh strip even if looks like unusable, the goal is just get some friction and remove easily removable materials. Then prepare  40% solution of KOH in water and heat it to ~50-70°C (do not boil it, you does not want to spread small droplets of this chemical all around and inhale them!). Start slowly stirring the solution and put the chip die into it. Keep reaction for some time (it can bee from few minutes up to tenth of minutes). You can hold the chip and keep the streem go along/against the surface you want to etch. KOH dissolves both silicone and glass. Unfortunately silicone is dissolved much faster so you can dissolve chip di before you gen to where You wanted. After a while take out the chip from bath with for example steel tweezer and wash it with water. Then use micro-mesh to clean the surface and to strip metalic layer if present (metals does no dissolve in KOH, except aluminium).

Then check the chip in microscope and repeat the procedure until you are happy with results.

You need a bit of practising to get best results, but the final product can be pretty good. You can see some of our results in [[project:weathersonde:cpu#delayered_rom_from_chip|VLSI ASIC reverse ingeneering page]]

==== Analysis ====

**FIXME**


===== References =====
  * http://www.bunniestudios.com/blog/?page_id=40
  * http://siliconpr0n.org/
  * http://siliconpr0n.wikispaces.com/References
  * http://siliconexposed.blogspot.cz/
  * http://www.flylogic.net/blog/
  * http://uvicrec.blogspot.cz/
  * http://visual6502.org/docs/6502_in_action_14_web.pdf
  * http://www.visual6502.org/JSSim/expert.html
  * http://siliconzoo.org
  * http://degate.org/
  * #homecmos @ freenode
  * http://www.youtube.com/watch?v=mT1FStxAVz4
  * http://www.youtube.com/watch?v=eoRVEw5gL8c
  * http://www.chipworks.com/blog/recentteardowns/?Itemid=104
  * http://www.chipworks.com/blog/technologyblog/?Itemid=103
===== Recommended stuff =====

This Micro-mesh is probably designed for plastic or other soft material and does not stay for long when used for regular sanding, but with chemically aided etching method can be used a bit longer.

  * http://www.guitarcentre.cz/prislusenstvi/pece-o-nehty/lesticky/produkt-lestici-platno-micro-mesh/