12

I've seen numerous examples of people essentially dissolving away the resin from integrated circuits in boiling high strength acid in order to expose the raw silicon chip underneath. My general understanding is that this has, from time to time, allowed for attackers to determine 'secret' information like crypto keys and the like. In addition, undocumented functionality can be determined and unlocked by doing this in some cases.

How can one go about 'reading data' from raw silicon? What kind of other benefits can you obtain from hardware level reverse engineering?

  • What kind of chip are you investigating? CMOS? Digital? Do you have a part number? – Keelan Mar 23 '13 at 19:00
13

There are various techniques used and I'll list some.

1) Probing while operating - if you have a probe station you ca operate the device and probe intermediate signals within the die. This requires that the encapsulations (usually Si#N4 -or sometime Polyimide) needs to also have been removed. Once this is removed the chip has a limited life, but you can't probe through that.

Also the features size of the chip on top metal must also be large enough to be able to probe. In most modern processes this is very problematic as even on the coursest resolution layers it is still far too small for probing.

In this case we use a FIB (Focused Ion Beam) machine to cut and also to add test points on the chip. In this case you'd leave the passsivation on and the pad is deposited on top of the passivation. The FIB then cuts through the passivation and connects to traces below. These machines are typically charged out at $100's per hour.

2) delayering: The chip is etched layer by layer and photographs and/or electron micrographs are taken at each stage. Understanding the construction of the devices will allow you to regenerate the device structure down to the Si. Here dimensions are important. To understand the implants into the Si itself requires the use of SIMS (Secondary Ion Mass Spectrograph) machine and tiny hole are milled into the substrate the ions are vacuumed into a Mass spectrometer machine and the species and doping profiles are shown as the machine drills down. THere are lots of other machines that are used that can help determine species and doping levels.

3) The two techniques above cannot help if there are flash or EEProm devices, because the state of the device is set by the presence or absence of charge, which you can't read. In this case there are other tools that are used. You would delayer to just above the gate levels and try to read the stored charge on the floating gate using various techniques like AFM (with the ability to read electron affinity- special attachment). There are even techniques that can be used such as SEM with surface contrast enhancement that allows you to monitor a running chip almost like a strobe light. But this requires that the device can have significant metal layers removed and STILL be operational. Which is not usual.

To fully RE a chip you will require multiple chips and you progressively learn as you slowly step through the various layers.

There are many different techniques used, most are developed to help designers debug problems rather than to RE, this is only a short overview at best.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.