How to Reverse Engineer a Chip

Have you ever wondered how you could look at a chip and map out its schematic? [Robert Baruch] wants to show you how he does it and he does in a new video (see below).  The video assumes you know how to expose the die because he’s made a video about that before.

This video focuses on using his Beaglebone-driven microscope stage to get high-resolution micrographs stitched together from smaller shots. A 3D-printed sample holder keeps the part from moving around. Luckily, there’s software to stitch the images together. Once he has the die photo, he will etch away the metal to remove the passivation, the metal layer, and the silicon dioxide under the metal and takes another set of photos.

[Robert] loads the images into Inkscape so he can trace over the various components of the device and add labels. Then he uses KiCAD to produce the schematic. The end result is an entry on the Project 54/74 wiki. The project we’ve mentioned before that aims to document this historically significant family of ICs.

If you want to duplicate his efforts, be warned that you need some fairly nasty chemicals, so be careful. Real labs use hydrofluoric acid to etch glass, which is especially nasty. [Robert] uses Armour Etch, which is slower but a bit safer and easy to get and store.

A 74LS01–the subject of the video–only has 8 transistors. Imagine trying to do even a simple CPU like an 8008 with about 3,500 smaller transistors. We recommend coffee and patience.

23 thoughts on “How to Reverse Engineer a Chip

  1. http://www.visual6502.org/

    In the summer of 2009, the Visual6502.org project shot and assembled high resolution photographs of a MOS 6502 revision D. The surface of the chip was photographed, then the metal and polysilicon layers were stripped off to reveal the conductive substrate diffusion areas. The substrate was photographed, and the substrate image was aligned to the surface image. These two aligned images were then used to create the vector polygons that form the Visual6502 chip simulation.

      1. I guess just being careful with HF is enough. It’s not like you’ll be using concentrated solutions anyway.
        And Armour Etch (which isn’t a thing around here and required some googling) is basically an acidic solution of fluoride salts, so much so that the MSDS suggests treating skin exposure with calcium gluconate gel… doesn’t sound much better than other products in the market to me.

      2. I have always found HF to be too aggressive for general use when delayering/deprocessing a die. If you don’t want to work with HF; you can achieve results by polishing it with a mix of DI water and Alumina, sometimes sold as jeweler’s rouge. Don’t breathe the powder though if you can help it.

    1. (Of course, since it was an Uncommitted Logic Array, it was really a repeating pattern of cells, and only the metalization layer was different, so as soon as you have one of the cells and the connections, you have the entire chip, which is easier than a fully custom chip like a microprocessor).

    1. Years ago I did this professionally. Might be different now but it was a very manual process then. We did work on election beam stroboscopy to be able to identify good vs bad operation but that took a huge computer back then and was never super successful.

  2. As I recall, Intel used to give away key fobs with raw CPUs embedded inside.. (Las Vegas Trade Show)

    It’s possible I still have one tucked in a box somewhere.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s