Stockly.com Forums

Stockly.com Forums (http://www.stockly.com/forums/index.php)
-   Electronics (http://www.stockly.com/forums/forumdisplay.php?f=7)
-   -   Microscope examination of a PLD (http://www.stockly.com/forums/showthread.php?t=17)

Grant Stockly 09-05-2005 02:49 PM

Microscope examination of a PLD
 
Article: 77917
Subject: Microscope examination of a PLD
From: "logjam" <grant@cmosxray.com>
Date: 22 Jan 2005 02:13:56 -0800
Links: << >> << T >> << A >>
I'm probably going to attempt a distructive test on a PLD to determine
its function. I'm wondering if anyone has tried this, and with what
success?

I found this:

"An important architectural feature that is found on virtually all PLDs
is not shown on logic diagrams. This feature is the security fuse.
Normally, the fuse pattern programmed into a PLD can, like a PROM, be
read and displayed or copied by programming hardware. Devices with a
security fuse, however, provide the ability to disable this read
function. This allows the design to be somewhat secure from attempts to
copy or reverse engineer it.

In reality, it's relatively easy to shave the top off of a bipolar PLD
and examine the programmed fuses with a microscope. For bipolar PLDs,
then, would be copiers are merely inconvenienced. Erasable CMOS PLDs
are considerably more secure, since it's very difficult, if not
impossible, to determine their function from examination."

From
http://www.ee.cooper.edu/courses/cou...es/EE151/PLD1/

Anyone here ever "shave" a chip for examination? I have access to a
video microscope at the university. I also have a DV camcorder with DV
in, so I could take the pictures, post them, and then beg for more
help. ;)

Any suggestions? I would be shaving the top off of some 16R8/4 chips.
Would heating them to around 250-300F for a while help? Shaving the
tops down while hot?

I eventually want to rewrite all of the equations for speed, but
getting a 100% copy of the OEM work was the goal.

Grant

Grant Stockly 09-05-2005 02:50 PM

Article: 77918
Subject: Re: Microscope examination of a PLD
From: Rene Tschaggelar <none@none.net>
Date: Sat, 22 Jan 2005 11:20:29 +0100
Links: << >> << T >> << A >>
I never tried it, however it might be possible to determine
the location of the fuse by a focused UV laser that is scanned
over an identical part.
Scan the laser and read out until the fuse is gone.

Rene
--
Ing.Buero R.Tschaggelar - http://www.ibrtses.com
& commercial newsgroups - http://www.talkto.net

Grant Stockly 09-05-2005 02:52 PM

Article: 77933
Subject: Re: Microscope examination of a PLD
From: Jim Granville <no.spam@designtools.co.nz>
Date: Sun, 23 Jan 2005 11:36:19 +1300
Links: << >> << T >> << A >>
logjam wrote:
> I'm probably going to attempt a distructive test on a PLD to determine
> its function. I'm wondering if anyone has tried this, and with what
> success?

I hope you have more than one :)

>
> I found this:
>
> "An important architectural feature that is found on virtually all PLDs
> is not shown on logic diagrams. This feature is the security fuse.
> Normally, the fuse pattern programmed into a PLD can, like a PROM, be
> read and displayed or copied by programming hardware. Devices with a
> security fuse, however, provide the ability to disable this read
> function. This allows the design to be somewhat secure from attempts to
> copy or reverse engineer it.
>
> In reality, it's relatively easy to shave the top off of a bipolar PLD
> and examine the programmed fuses with a microscope. For bipolar PLDs,
> then, would be copiers are merely inconvenienced. Erasable CMOS PLDs
> are considerably more secure, since it's very difficult, if not
> impossible, to determine their function from examination."
>
> From
> http://www.ee.cooper.edu/courses/cou...es/EE151/PLD1/
>
> Anyone here ever "shave" a chip for examination? I have access to a
> video microscope at the university. I also have a DV camcorder with DV
> in, so I could take the pictures, post them, and then beg for more
> help. ;)
>
> Any suggestions? I would be shaving the top off of some 16R8/4 chips.
> Would heating them to around 250-300F for a while help? Shaving the
> tops down while hot?
>
> I eventually want to rewrite all of the equations for speed, but
> getting a 100% copy of the OEM work was the goal.

If that is the goal, why not simply reverse engineer the logic ?

16R8/4 devices are not complex, and if you also have the product circuit
diagram [or application circuits of the devices], you can greatly reduce
the vector-search complexity.

All you need is pencil, paper, text editor, and a PLD programmer that
can run test vectors (most can).

-jg

Grant Stockly 09-05-2005 02:52 PM

Article: 77935
Subject: Re: Microscope examination of a PLD
From: Eric Smith <eric-no-spam-for-me@brouhaha.com>
Date: 22 Jan 2005 15:27:13 -0800
Links: << >> << T >> << A >>
"logjam" <grant@cmosxray.com> writes:
> Anyone here ever "shave" a chip for examination?

Two friends and I read a bipolar PROM optically. It was interesting
to view it under the microscope. I'd heard that there was a long-term
problem with regrowth of the fuses, but we were actually able to see it.

Also, Peter Monta optically extracted the contents of three 2560-bit
PMOS masked ROM chips circa 1973, in order to run the code on my
simulator:

http://www.pmonta.com/calculators/hp-35/

Grant Stockly 09-05-2005 02:53 PM

Article: 77951
Subject: Re: Microscope examination of a PLD
From: Captain Rick <ME@127.0.0.1>
Date: Sun, 23 Jan 2005 17:16:55 +0000
Links: << >> << T >> << A >>
On 23 Jan 2005 02:26:32 -0800, "logjam" <grant@cmosxray.com> wrote:

>Is there a substance that will break down the IC potting material but
>not the electronics? I noticed that the back of the silicon was coated
>with metal. Next I might try comming in from the back, carving around
>the back plane, and lifting the guy out.

Try searching Google - fuming nitric acid is commonly used I believe.
Be careful with it though...

<Editor note, look in the general->electronics section for "How to decap an IC">

Grant Stockly 09-05-2005 02:54 PM

Article: 77967
Subject: Re: Microscope examination of a PLD
From: Tommy Thorn <foobar@nowhere.void>
Date: Mon, 24 Jan 2005 02:09:58 GMT
Links: << >> << T >> << A >>
logjam wrote:
> So I will try this on monday:
> -Shave PLD about 1/8"
> -place flat on a hot plate, around 130*C
> -Drip nitric acid on it until the silicon is visible
...
> If all else fails, I'm getting a 100MHz 18 channel 128k+ sample logic
> analyzer...so... ;)

Well, even if you get a visual reading of the bits, I would still want
to verify it by frobbing pins. However, rather than a logic analyzer,
why not simply hook it fully up to an FPGA? There are plenty < $500
boards out there that would be up for the job. That would give you all
the functionality of the LA with the additional ability to incrementally
build up and verify the reengineered model, all within the same framework.

Just an idea,
Tommy

Grant Stockly 09-05-2005 02:55 PM

Article: 77947
Subject: Re: Microscope examination of a PLD
From: "Jezwold" <edad3000@yahoo.co.uk>
Date: 23 Jan 2005 07:07:58 -0800
Links: << >> << T >> << A >>
Tradationally people use fuming nitric acid to remove the
encapsulation.I wouldnt recomment it though without some serious
protection as fuming nitric acid is highly toxic and will strip flesh
to the bone in seconds.

Grant Stockly 09-05-2005 02:56 PM

Article: 78218
Subject: Re: Microscope examination of a PLD
From: "logjam" <grant@cmosxray.com>
Date: 28 Jan 2005 11:31:22 -0800
Links: << >> << T >> << A >>
Here are the results of decapping my IC...
http://www.stockly.com/forums/showthread.php?p=6


All times are GMT. The time now is 07:56 AM.

Powered by vBulletin® Version 3.8.9
Copyright ©2000 - 2024, vBulletin Solutions, Inc.