Decapping integrated circuits with sap

[James] is interested in reverse engineering some integrated circuits. One of the biggest hurdles in this process has always been just getting to the guts of the chip. He used acetone to dissolve the plastic case but had trouble getting through the epoxy blob. Commonly, the epoxy is soaked in nitric acid for a few minutes but [James] didn’t have access to that chemical. Instead he popped into the local music store and picked up some rosin (used to make violin bows sticky enough to grab the strings of the instrument). After boiling down the rock-hard rosin and the chip for 20 minutes, he got a clean and relatively undamaged semiconductor that he can easily peer into.

26 thoughts on “Decapping integrated circuits with sap

  1. To what end, curiousity? Can a chip really be analyzed visually like this, to make any determination as to its function? I would imagine that it can’t help much more than normal creative testing of the existing pins…

  2. Sure if you get good enough magnification you can see the individual transistors, though most of these chips are multi-layer so you have to dissolve through the layer one at a time.

  3. Check the latest hitb slides, there was one about thermo analysisng chips to find out their functions.
    You can do it when the device operates so I guess its how jack bauer steal military secrets from embedded devices and uploads them to CTU :D

  4. Doesn’t look that undamaged but hard to tell w/ low magnification. Nowhere near well equipped enough to start trying anything anyway though so I dunno. Nurdrage (no relation to them, but have used their demos at times) have pretty good instructions for making small amounts of Nitric Acid from OTC only, supposing it’s only unavailable rather then illegal. Needs heavier concentrating, but then it’s not like you need much if you’re just decapping with it.

  5. Interesting… I wonder if the ‘oil’ (really a sap-derivative) which they use for dust control on North American gravel roads would work the same way. It comes in 55gal drums at a reasonable price, and I’m sure the local MD could spare a litre or two.

  6. One use for decapping chips is when the chips contain internal ROM, decapping can be used to read it out. If it contains mask ROM, you can decap it and photograph the ROM. In some cases you can decap the chip, disable the protection circuitry and read out the data.

  7. Hmm didn’t realize flux could do that.(that sap is just rosin…it’s been used in solder forever)I wonder if rosin sap is more effective than just using a bottle of rosin flux. Hmm would no clean fluxes work as well?

  8. Pretty sure that the chip doesn’t work (at least properly) after boiling it in rosin at +320 C for 20 minutes. With large geometries could be lucky enough though.

    I think that may be good for failure or topological analysis (like reading a rom) but not for an active attack. But if nothing is going to be lost trying… :)

  9. If a hobbyist in the US wanted to do this with fuming nitric acid where could I find some? I understand the stuff needs to be handled very carefully, with proper safety and ventilation and not disposed of in an unsafe way.

  10. @Jayson
    Where else do people buy pianos and guitars and such?

    Even in my relatively small home town, we had at least 6 or 7 dedicated music shops, not including the 3 Guitar Centers, which is like the sell-out version. Cheap MIDI controllers though.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s