To analyze the communication protocol between two chips running unknown firmware, we eavesdrop into the communication bus between the chips. In the ideal case, this is “just” a matter of matching exposed paths on a PCB with the contacts of a logic analyzer.
What if the chips are stacked in a package on package configuration? How can the contacts be exposed? Can the chips be separated? Does this damage the chips, or will they look as new afterwards?
Non Destructive
Highly unlikely to be successful unless you have intimate knowledge of how the pacakges were epoxied together. If you did go this route it might be possible to break down the glue that binds the chips together a REing effort in its own right. Once you did that it might not be possible to join them back together without machinery to align the chips under x-ray. And even then the soder balls might not be too happy about what you have done to them...
Destructive
Since package on package usually means the chips are epoxied together you basically have to distroy the packages to get them appart. Once you did you could look at them under microscope and RE them that way. You could possibly separate them without damaging the interconnects and test the top chip... as a black box I would imagine the bottom chip woudln't work without the top one though since it is usually RAM at least in mobile devices.
Related Info Christopher Tarnovsky and http://www.chipworks.com
That company specializies in REing chips... and that is the sort of setup you would need to do it sucessfully. 1 million+ USD for something like an arm processor.
