Dirt Cheap Dirty Decapping

Those tiny black rectangles of epoxy aren’t black boxes anymore. Decapsulating ICs is becoming somewhat common, and if you’re reverse engineering a chip-on-board epoxy blob, or just figuring out if the chip you bought is the chip you wanted, you’ll need to drop some acid. Usually this means finding someone with the knowhow to decap a chip, or having enough confidence in yourself to mess around with fuming nitric acid. Now Dangerous Prototypes has a better solution – Dirty Decapsulation. Send your chip to Dangerous Prototypes, and they’ll melt away the epoxy and take a few pictures of the die hidden inside your chip.

dirty-decappingDirty Decapsulation is Dangerous Prototype’s addition to their array of hacker services including cheap, crappy PCBs and SLA printing service. Dirty Decapsulation follows in the tradition of these other services; it’s not the best you can possibly get, but you’re not paying thousands of dollars for the job.

Right now, Dirty Decapsulation will take a chip, strip off the epoxy, and take a few pictures. These pictures are stitched together, producing a medium quality image of the die. No, you can’t see individual gates, and you can’t see different layers of metal and silicon. If you want that, you’ll need some nitric or a few thousand dollars. Dirty Decapsulation is just to verify the chip’s identity and give a rough idea of the layout of the die.

20 thoughts on “Dirt Cheap Dirty Decapping

    1. A similar way is to put the device in a vice the long way with the die facing down and tighten slightly to induce a bit of stress. Then heat the device with a propane torch until it is hot and tighten the vice. This will pop the device apart and the die will come out very clean, no acid etching needed. The die will go flying so having a box over the vice will help you find the die (and wear safety glasses and perform in a well ventilated area). I used this method several times when I only needed to look at the die and did not care if the bond wires were not intact. Also at a semi startup before we had the money for a wet lab I used this method. Having a few extra devices is good to practice on.

    2. Yeah, we Zippo Decap at work all the time. If we’re going to get fancy I take it home and take off a lot of the epoxy with my milling machine before the cigarette lighter.

  1. I can highly recommend their dirty SLA prints. They are very reasonably priced and are of a good quality. I personally cannot wait for their dirty laser cutting service that seems to be taking forever to come out.

    1. Glad dirty SLA is working out for you. We will add clear options at same price in next site update.

      That’s for mentioning the lasercut service. We didn’t realize anyone was waiting on the other services :) will get it online for you asap, we just have a hard time finding a supplier willing to give us full pricing info so we can give an accurate price.

      I was actually in the process of migrating the dev site to the main site today when this came up. I put the site back online and will finish the migration and update tomorrow morning China time.

  2. Thanks for posting this. We recently decapped about a half dozen Atmels from genuine and Arduino knock offs. We’ll post a comparison soon. Any guesses if the Atmel on a $1 Chinese Arduino is real? :)

    1. I’ll bet they are real. Atmel has more competitive pricing in China than in NA/Europe. Pricing rebate tiers also contribute to cheap grey market products. For example a chip may cost 50c at qty 10K, and you get a 10% rebate for every quarter you purchase 50K units. The quarter is almost over, and you’ve used 40K so far. You’ve got no orders for next quarter, but you buy 10K to sell quick on the grey market for 35c ea, making a $1K profit.

    2. I always imagined faking complex ICs wouldn’t be a feasible business, but while reading your decapping service page I found “Example decap photo of ATMEL 168 clone chip”…

      Apparently there is the LGT8F88A from LogicGreen, which is an instruction set compatible clone, that is specified to be running faster and with less clock cylces than the atmega88. Further more there is the GD32 series from giga devices. Which is a clone of the STM32 series e.g. STM32F103 vs GD32F103. Pretty interesting is that they use a different memory architecture accoring to the die shots from zeptobars. Further more the company seems to be an official arm member.

      Looks like I’m betting on fake.

    3. I would bet they are real die. Are they totally legitimate… probably not, but only in so far as they are ghost shift, out-the-back-door, recycled, over production…

      I have never heard of a (functioning!) fake ATMega, except for the Logic Green clones of the Mega88 – LGT8F88A – and I have not heard anything about that since it was announced in 2013.

      1. That’s the chip in the picture :) You’re right too, we have not really been able to find them in the mainstream Chinese market so far this year. I think they probably stopped making them.

  3. Anybody know of a service like this that WILL return the decapped chip to you? Obviously willing to pay more than $75 for that but not $75,000. Most of the silicon valley companies in this space are geared towards full-service reverse engineering and want to upsell you their high-end services. I just want somebody who can handle nitric acid safely because I know I can’t. We have all the other equipment.

    If you have any leads, please reply to this comment which will trigger an email notification to me.

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.