Dirt Cheap Dirty Decapping

Those tiny black rectangles of epoxy aren’t black boxes anymore. Decapsulating ICs is becoming somewhat common, and if you’re reverse engineering a chip-on-board epoxy blob, or just figuring out if the chip you bought is the chip you wanted, you’ll need to drop some acid. Usually this means finding someone with the knowhow to decap a chip, or having enough confidence in yourself to mess around with fuming nitric acid. Now Dangerous Prototypes has a better solution – Dirty Decapsulation. Send your chip to Dangerous Prototypes, and they’ll melt away the epoxy and take a few pictures of the die hidden inside your chip.

dirty-decappingDirty Decapsulation is Dangerous Prototype’s addition to their array of hacker services including cheap, crappy PCBs and SLA printing service. Dirty Decapsulation follows in the tradition of these other services; it’s not the best you can possibly get, but you’re not paying thousands of dollars for the job.

Right now, Dirty Decapsulation will take a chip, strip off the epoxy, and take a few pictures. These pictures are stitched together, producing a medium quality image of the die. No, you can’t see individual gates, and you can’t see different layers of metal and silicon. If you want that, you’ll need some nitric or a few thousand dollars. Dirty Decapsulation is just to verify the chip’s identity and give a rough idea of the layout of the die.

Hackaday Links: Summer, 2015

[Elia] was experimenting with LNAs and RTL-SDR dongles. If you’re receiving very weak signals with one of these software defined radio dongles, you generally need an LNA to boost the signal. You can power an LNA though one of these dongles. You’ll need to remove a few diodes, and that means no ESD protection, and you might push the current consumption above the 500mA a USB port provides. It does, however, work.

We’ve seen people open up ICs with nitric acid, and look inside them with x-rays. How about a simpler approach? [steelcityelectronics] opened up a big power transistor with nothing but a file. The die is actually very small – just 1.8×1.8mm, and the emitter bond wire doesn’t even look like it’ll handle 10A.

Gigantic Connect Four. That’s what the Lansing Makers Network built for a Ann Arbor Maker Faire this year. It’s your standard Connect Four game, scaled up to eight feet tall and eight feet wide. The disks are foam insulation with magnets; an extension rod (with a magnet at the end) allows anyone to push the disks down the slots.

[Richard Sloan] of esp8266.com fame has a buddy running a Kickstarter right now. It’s a lanyard with a phone charger cable inside.

Facebook is well-known for the scientific literacy of its members. Here’s a perpetual motion machine. Comment gold here, people.

Here’s some Hackaday Prize business: We’re giving away stuff to people who use Atmel, Freescale, Microchip, and TI parts in their projects. This means we need to know you’re using these parts in your projects. Here’s how you let us know. Also, participate in the community voting rounds. Here are the video instructions on how to do that.

Automated Die Testing

Are the contents of a Crown Royal bag fair? No, they never are. What about dice? In a quest for good randomness, [Apo] designed and built an automated die tester. Not only does it shake the die up, it captures images so real, actual statistics can be done on each individual die.

The setup is a n acrylic box made with BoxMaker attached to a 3D printed adapter for a stepper motor shaft. Randomizing the die happens exactly like you think it would: a stepper shakes the box, and a camera underneath takes a picture. With a bit of computer vision, this image can be translated into a number, ready for the statistics package of your choice.

There were only 559 rolls before the 3D printed mess of duck tape fell apart, but a test of the distribution revealed this die to have a 92% probability that it is fair. That’s not good.

Creating a cheating die is much more interesting, and to find out if he could do it, [Apo] stuck a die in an oven at 100° C for a few minutes. Surprisingly, the fairness of the die got better, suggesting it’s possible to correct an un-fair die. Putting it back in the oven after that threw the fairness out of the window but there was still no visual difference between this modified die and the original stock die.

Digging deep into how the 8085 processor’s registers were designed

Hardware design enthusiasts should already be salivating just looking at this image. But [Ken Shirriff’s] write-up on how the 8085 processor’s registers were designed will put you in silicon reverse-engineering heaven. He manages to get to the bottom of the tricks the designers used to make register access as efficient as possible, like routing some through the ALU on their path elsewhere.

We’re certainly not experts in studying dies like the one seen above. Luckily [Ken] does a great job of zooming in on important parts, then dissecting how they work by representing the silicone image as a functional flow chart. One of the parts which we found most interesting is the WZ temporary registers. These are a set of internal registers that are not accessible to the programmer. They’re only used internally by the chip. They act as temporary storage for multiple operand functions, and also hold register addresses for a handful of instructions (JMP, CALL, RST, etc.).

If you’re more interested in how images of these chips are attained you should do some searching on Hackaday. Just last week we featured one such project in a links post.

[via Reddit]

Hackaday Links: February 28th, 2013

Xbox 360 control for a toy heli

links-xbox-helicopter-remote

[Jason] leveraged the IR control libraries for Arduino to use an Xbox 360 controller to fly his Syma S107G helicopter.

Windows 7 running on Raspberry Pi

links-win7-rpi

Why, oh god why? Well, the guys at Shackspace got their hands on a laser cutter that can only be driven with a Windows program. Their solution was to run Win7 on RPi as a virtual machine.

Twin-servos for your third hand

links-servo-third-hand

After growing tired of constantly flipping over the substrate being held with a third hand [Nidal] came up with a better way. He mounted his third hand on two servo motors so that it can be positioned with a joystick.

Depopulating SMD resistors

links-removing-smd-resistors

If you’ve ever tried to remove small surface mount resistors or capacitors with an iron you know it can be tricky. Take a look at the technique that [Scott] uses to remove the components.

Photographing the die of MSP430, Z80, PIC, and several other chips

links-decapping-chips

Here’s the latest work from [Michail] on photographing the die of various chips. You may remember reading his previous post on decapping chips with boiling sulfuric acid.

How the 8085 ALU is structured

8085-alu-reverse-engineering

This is a microscopic photograph of an 8085 processor die. [Ken Shirriff] uses the image in his explanation of how the ALU works. It is only capable of five basic operations: ADD, OR, XOR, AND, and SHIFT-RIGHT. [Ken] mentions that the lack of SHIFT-LEFT is made up for by adding the number to itself which has the effect of multiplying a number by two; the same mathematical function performed by a shift operation.

His post details the gate arrangement for each ALU operation. This is clear and easy to follow, and was based on reverse engineering work already done by a team who meticulously decapped and photographed the dies.

Not long ago this explanation would have been voodoo to us. But we worked our way through The Elements of Computing Systems text-book by following the online Nand to Tetris course. It really demystifies the inner working of a chip like the 8085.

Now if you really want to understand this ALU you’ll build it for yourself inside of Minecraft.

[Thanks Ed]

Boiling acid used to see chip die

When a project starts off by heating acid to its boiling point we say no thanks. But then again we’re more for the projects that use ones and zeros or a hot soldering iron. If you’re comfortable with the chemistry like [Michail] this might be right up your alley. He used boiling acid to expose and photograph the die from several integrated circuits.

The title of our feature is a play on words. In this case, die refers to the silicone on which the IC has been etched. To protect it the hardware manufacturer first attaches the metal pins to the die, then encapsulates it in plastic. [Michail] removes that plastic case by heating sulfuric acid to about 300 degrees Celsius (that’s 572 Fahrenheit) then submerges the chips in the acid inside of a sealed container for about forty minutes. Some of the larger packages require multiple trips through the acid bath. After this he takes detailed pictures of the die and uses post processing to color enhance them.

This isn’t the only way to get to the guts of a chip. We’ve seen nitric acid and even tree sap (in the form of bow rosin) do the trick.