#1
|
|||
|
|||
Microscope examination of a PLD
Article: 77917
Subject: Microscope examination of a PLD From: "logjam" <grant@cmosxray.com> Date: 22 Jan 2005 02:13:56 -0800 Links: << >> << T >> << A >> I'm probably going to attempt a distructive test on a PLD to determine its function. I'm wondering if anyone has tried this, and with what success? I found this: "An important architectural feature that is found on virtually all PLDs is not shown on logic diagrams. This feature is the security fuse. Normally, the fuse pattern programmed into a PLD can, like a PROM, be read and displayed or copied by programming hardware. Devices with a security fuse, however, provide the ability to disable this read function. This allows the design to be somewhat secure from attempts to copy or reverse engineer it. In reality, it's relatively easy to shave the top off of a bipolar PLD and examine the programmed fuses with a microscope. For bipolar PLDs, then, would be copiers are merely inconvenienced. Erasable CMOS PLDs are considerably more secure, since it's very difficult, if not impossible, to determine their function from examination." From http://www.ee.cooper.edu/courses/cou...es/EE151/PLD1/ Anyone here ever "shave" a chip for examination? I have access to a video microscope at the university. I also have a DV camcorder with DV in, so I could take the pictures, post them, and then beg for more help. Any suggestions? I would be shaving the top off of some 16R8/4 chips. Would heating them to around 250-300F for a while help? Shaving the tops down while hot? I eventually want to rewrite all of the equations for speed, but getting a 100% copy of the OEM work was the goal. Grant |
#2
|
|||
|
|||
Article: 77918
Subject: Re: Microscope examination of a PLD From: Rene Tschaggelar <none@none.net> Date: Sat, 22 Jan 2005 11:20:29 +0100 Links: << >> << T >> << A >> I never tried it, however it might be possible to determine the location of the fuse by a focused UV laser that is scanned over an identical part. Scan the laser and read out until the fuse is gone. Rene -- Ing.Buero R.Tschaggelar - http://www.ibrtses.com & commercial newsgroups - http://www.talkto.net |
#3
|
|||
|
|||
Article: 77933
Subject: Re: Microscope examination of a PLD From: Jim Granville <no.spam@designtools.co.nz> Date: Sun, 23 Jan 2005 11:36:19 +1300 Links: << >> << T >> << A >> logjam wrote: > I'm probably going to attempt a distructive test on a PLD to determine > its function. I'm wondering if anyone has tried this, and with what > success? I hope you have more than one > > I found this: > > "An important architectural feature that is found on virtually all PLDs > is not shown on logic diagrams. This feature is the security fuse. > Normally, the fuse pattern programmed into a PLD can, like a PROM, be > read and displayed or copied by programming hardware. Devices with a > security fuse, however, provide the ability to disable this read > function. This allows the design to be somewhat secure from attempts to > copy or reverse engineer it. > > In reality, it's relatively easy to shave the top off of a bipolar PLD > and examine the programmed fuses with a microscope. For bipolar PLDs, > then, would be copiers are merely inconvenienced. Erasable CMOS PLDs > are considerably more secure, since it's very difficult, if not > impossible, to determine their function from examination." > > From > http://www.ee.cooper.edu/courses/cou...es/EE151/PLD1/ > > Anyone here ever "shave" a chip for examination? I have access to a > video microscope at the university. I also have a DV camcorder with DV > in, so I could take the pictures, post them, and then beg for more > help. > > Any suggestions? I would be shaving the top off of some 16R8/4 chips. > Would heating them to around 250-300F for a while help? Shaving the > tops down while hot? > > I eventually want to rewrite all of the equations for speed, but > getting a 100% copy of the OEM work was the goal. If that is the goal, why not simply reverse engineer the logic ? 16R8/4 devices are not complex, and if you also have the product circuit diagram [or application circuits of the devices], you can greatly reduce the vector-search complexity. All you need is pencil, paper, text editor, and a PLD programmer that can run test vectors (most can). -jg |
#4
|
|||
|
|||
Article: 77935
Subject: Re: Microscope examination of a PLD From: Eric Smith <eric-no-spam-for-me@brouhaha.com> Date: 22 Jan 2005 15:27:13 -0800 Links: << >> << T >> << A >> "logjam" <grant@cmosxray.com> writes: > Anyone here ever "shave" a chip for examination? Two friends and I read a bipolar PROM optically. It was interesting to view it under the microscope. I'd heard that there was a long-term problem with regrowth of the fuses, but we were actually able to see it. Also, Peter Monta optically extracted the contents of three 2560-bit PMOS masked ROM chips circa 1973, in order to run the code on my simulator: http://www.pmonta.com/calculators/hp-35/ |
#5
|
|||
|
|||
Article: 77951
Subject: Re: Microscope examination of a PLD From: Captain Rick <ME@127.0.0.1> Date: Sun, 23 Jan 2005 17:16:55 +0000 Links: << >> << T >> << A >> On 23 Jan 2005 02:26:32 -0800, "logjam" <grant@cmosxray.com> wrote: >Is there a substance that will break down the IC potting material but >not the electronics? I noticed that the back of the silicon was coated >with metal. Next I might try comming in from the back, carving around >the back plane, and lifting the guy out. Try searching Google - fuming nitric acid is commonly used I believe. Be careful with it though... <Editor note, look in the general->electronics section for "How to decap an IC"> |
#6
|
|||
|
|||
Article: 77967
Subject: Re: Microscope examination of a PLD From: Tommy Thorn <foobar@nowhere.void> Date: Mon, 24 Jan 2005 02:09:58 GMT Links: << >> << T >> << A >> logjam wrote: > So I will try this on monday: > -Shave PLD about 1/8" > -place flat on a hot plate, around 130*C > -Drip nitric acid on it until the silicon is visible ... > If all else fails, I'm getting a 100MHz 18 channel 128k+ sample logic > analyzer...so... Well, even if you get a visual reading of the bits, I would still want to verify it by frobbing pins. However, rather than a logic analyzer, why not simply hook it fully up to an FPGA? There are plenty < $500 boards out there that would be up for the job. That would give you all the functionality of the LA with the additional ability to incrementally build up and verify the reengineered model, all within the same framework. Just an idea, Tommy |
#7
|
|||
|
|||
Article: 77947
Subject: Re: Microscope examination of a PLD From: "Jezwold" <edad3000@yahoo.co.uk> Date: 23 Jan 2005 07:07:58 -0800 Links: << >> << T >> << A >> Tradationally people use fuming nitric acid to remove the encapsulation.I wouldnt recomment it though without some serious protection as fuming nitric acid is highly toxic and will strip flesh to the bone in seconds. |
Thread Tools | |
Display Modes | |
|
|
Similar Threads | ||||
Thread | Thread Starter | Forum | Replies | Last Post |
QX5 microscope | tonigau | Electronics | 0 | 02-05-2006 06:09 PM |
Reading a PAL16R8 with a microscope | Grant Stockly | Electronics | 3 | 09-17-2005 05:55 PM |