Decoding A ROM From A Picture Of The Chip

January 12, 2024 by Jenny List 14 Comments

Before there were home computers, among the hottest pieces of consumer technology to own was a pocket calculator. In the early 1970s a series of exciting new chips appeared which allowed the impossible to become the affordable, and suddenly anyone with a bit of cash could have one.

Perhaps one of the more common series of chips came from Texas instruments, and it’s one of these from which [Veniamin Ilmer] has retrieved the ROM contents. In a way there’s nothing new here as the code is well known, it’s the way it was done which is of interest. A photo of the die was analysed, and with a bit of detective work the code could be deduced merely from the picture.

These chips were dedicated calculators, but under the hood they were simple pre-programmed microcontrollers. Identifying the ROM area of the chip was thus relatively straightforward, but some more detective work lay in getting to the bottom of how it could be decoded before the code could be verified. So yes, it’s possible to read code from an early 1970s chip by looking at a photograph.

A very similar chip to this one was famously reprogrammed with scientific functions to form the heart of the inexpensive Sinclair Cambridge Scientific.

Integrated Circuit Reverse Engineering, 1970s Style

June 2, 2017 by Jenny List 10 Comments

We are used to stories about reverse engineering integrated circuits, in these pages. Some fascinating exposés of classic chips have been produced by people such as the ever-hard-working [Ken Shirriff].

You might think that this practice would be something new, confined only to those interested in the workings of now-obsolete silicon. But the secrets of these chips were closely guarded commercial intelligence back in the day, and there was a small industry of experts whose living came from unlocking them.

Electron micrograph of a wire bond to the Z80 CTC die

Integrated Circuit Engineering Corporation were a Scottsdale, Arizona based company who specialised in semiconductor industry data. They have long since been swallowed up in a series of corporate takeovers, but we have a fascinating window into their activities because their archive is preserved by the Smithsonian Institution. They reverse engineered integrated circuits to produce reports containing detailed information about their mechanical properties as well as their operation, and just such a report is our subject today. Their 1979 examination of the Zilog Z80 CTC (PDF) starts with an examination of the package, in this case the more expensive ceramic variant, then looks in detail at the internal construction of the die itself, and its bonding wires. We are then taken in its typewritten pages through an extensive analysis of the circuitry on the die, with gate-level circuits to explain the operation of each part.

The detail contained in this report is extraordinary, it is clear that a huge amount of work went into its production and it would have been of huge value to certain of Zilog’s customers and competitors. At the time this would have been extremely commercially sensitive information, even if it now seems like a historical curiosity.

The Z80 CTC is a 4-channel counter/timer peripheral chip for the wildly succesful Z80 8-bit microprocessor, in a 28-pin dual-in-line package. We were surprised to find from a quick search that you can still buy this chip from some of the usual suppliers rather than the surplus houses, so it may even still be in production.

If IC reverse engineering takes your fancy, take a look at our archive of [Ken Shirriff] posts.

Thanks [fortytwo] for the tip.

Ken Shirriff Takes Us Inside The IC, For Fun

December 27, 2016 by Elliot Williams 13 Comments

[Ken Shirriff] has seen the insides of more integrated circuits than most people have seen bellybuttons. (This is an exaggeration.) But the point is, where we see a crazy jumble of circuitry, [Ken] sees a riddle to be solved, and he’s got a method that guides him through the madness.

In his talk at the 2016 Hackaday SuperConference, [Ken] stepped the audience through a number of famous chips, showing how he approaches them and how you could do the same if you wanted to, or needed to. Reading an IC from a photo is not for the faint of heart, but with a little perseverance, it can give you the keys to the kingdom. We’re stoked that [Ken] shared his methods with us, and gave us some deeper insight into a handful of classic silicon, from the Z80 processor to the 555 timer and LM7805 voltage regulator, and beyond.

Continue reading “Ken Shirriff Takes Us Inside The IC, For Fun” →

Russian Decapping Madness

July 18, 2016 by Elliot Williams 37 Comments

It all started off innocently enough. [mretro] was curious about what was inside a sealed metal box, took a hacksaw to it and posted photographs up on the Interwebs. Over one hundred forum pages and several years later, the thread called (at least in Google Translate) “dissecting room” continues to amaze.

If you like die shots, decaps, or teardowns of oddball Russian parts, this is like drinking from a firehose. You can of course translate the website, but it’s more fun to open it up in Russian and have a guess at what everything is before peeking. (Hint: don’t look at the part numbers. NE555 is apparently “NE555” in Russian.)

From a brief survey, a lot of these seem to be radio parts, and a lot of it is retro or obsolete. Forum user [lalka] seems to have opened up one of every possible Russian oscillator circuit. The website loads unfortunately slowly, at least where we are, but bear in mind that it’s got a lot of images. And if your fingers tire of clicking, note that the URL ends with the forum page number. It’d be a snap to web-scrape the whole darn thing overnight.

We love teardowns and chip shots, of old gear and of new. So when you think you’ve got a fake part, or if you need to gain access to stuff under that epoxy blob for whatever reason, no matter how embarrassing, bring along a camera and let us know!

Thanks [cfavreau] for the great tip!