1

I've been playing around a lot with the xeltek reader, which lets me image various memory chips. Usually, I just use the catalog number used to get the chip's datasheet and search xelteks database for a proper adapter.

But what if I have an electronic device that uses a proprietary chip or no catalog number is given.

How would I go about making a binary image of the mystery chip in question? Is there any readily available hardware that will help do this?

1 Answer 1

3

I am no expert in the matter but that seems highly unlikely. There are 2 ways how to approach that I know of:

  1. detect/exploit/sniff known interface

    Like SPI,JTAG,... or even memory interface (address,data and control buses) and do the dump with some MCU to PC adapter attached to it or dump to SD card or what ever. This is not invasive approach but needs to have the interface present. If you do not have the pinout for the chip (or the PCB ...) try to find the other stuff connected to it. Also using oscilloscope helps.

    However if the access to data is restricted you're out of luck (fuses,HW/SW key ...). Also this way is not guaranteed that you will got the whole memory dump either. Mostly the interfaces are controlled by software so you would need to hack in the protocol. With HW interfaces you got direct chip access according to your privileges set by fuses...

    see related Thought I found serial port - broke embedded device instead! Help?

  2. Die shot analysis

    In some cases the chip is sliced to obtain a die shot (but that of coarse destroys the chip for good). Then according to used technology you can reverse engineer the whole circuit diagram including PROM related stuff and obtain the data "directly". With EEPROM is this tricky as the information is stored as charge so you would need some really tricky sensors to scan that more like some liquid crystal based solution. but the possibility of error is extremly high as the info can be discharged by the slicing, by any contact with air or anything. Better would be reverse the circuit and detect programming interface on some spare chip and then use #1 on the real one ... FLASH memories are based on domino technology so it should be detectable from the die shot directly like PROM too.

    See related:

To make some universal HW for this you would need to have some analog multiplexors switching matrix to be able to support any pinout and then prior to use configure which pin is what (power supply, data, ...). That is more or less possible (considering voltage, current, impedance, and frequency requirements) but to use it you would need the necessary info you do not have for unknown chip anyway ...

To detect the chip first you would need to try power it up which will most likely burn any chip with wrongly selected pins... making universal detection impossible. For a group of similar chips is this possible but again you would need some info about them ...

2
  • Thanks for thorough response. So assuming I had an infinite supply of chips to test, would it be just trial and error? The only pre-existing knowledge I would have about the electronic device is the 28 connector pin out that it interfaces with other electronic devices with.
    – ChipsAhoy
    Jun 27, 2016 at 13:46
  • @ChipsAhoy If you got the pinout then you know which pins are power, ground, shield and interfaces so there are no guesses ... but to have minimal circuit usually chips need few capacitors, crystal etc ... which can be deduced from PCB you are inspecting. Then it is just matter of scanning for programing protocol ...
    – Spektre
    Jun 27, 2016 at 13:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.