To analyze the communication protocol between two chips running unknown firmware, we eavesdrop into the communication bus between the chips. In the ideal case, this is “just” a matter of matching exposed paths on a PCB with the contacts of a logic analyzer.

What if the chips are stacked in a package on package configuration? How can the contacts be exposed? Can the chips be separated? Does this damage the chips, or will they look as new afterwards?

1 Answer 1


Non Destructive

Highly unlikely to be successful unless you have intimate knowledge of how the pacakges were epoxied together. If you did go this route it might be possible to break down the glue that binds the chips together a REing effort in its own right. Once you did that it might not be possible to join them back together without machinery to align the chips under x-ray. And even then the soder balls might not be too happy about what you have done to them...


Since package on package usually means the chips are epoxied together you basically have to distroy the packages to get them appart. Once you did you could look at them under microscope and RE them that way. You could possibly separate them without damaging the interconnects and test the top chip... as a black box I would imagine the bottom chip woudln't work without the top one though since it is usually RAM at least in mobile devices.

Related Info Christopher Tarnovsky and http://www.chipworks.com

That company specializies in REing chips... and that is the sort of setup you would need to do it sucessfully. 1 million+ USD for something like an arm processor.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.