How To Reverse Engineer A Chip

Have you ever wondered how you could look at a chip and map out its schematic? [Robert Baruch] wants to show you how he does it and he does in a new video (see below).  The video assumes you know how to expose the die because he’s made a video about that before.

This video focuses on using his Beaglebone-driven microscope stage to get high-resolution micrographs stitched together from smaller shots. A 3D-printed sample holder keeps the part from moving around. Luckily, there’s software to stitch the images together. Once he has the die photo, he will etch away the metal to remove the passivation, the metal layer, and the silicon dioxide under the metal and takes another set of photos.

[Robert] loads the images into Inkscape so he can trace over the various components of the device and add labels. Then he uses KiCAD to produce the schematic. The end result is an entry on the Project 54/74 wiki. The project we’ve mentioned before that aims to document this historically significant family of ICs.

If you want to duplicate his efforts, be warned that you need some fairly nasty chemicals, so be careful. Real labs use hydrofluoric acid to etch glass, which is especially nasty. [Robert] uses Armour Etch, which is slower but a bit safer and easy to get and store.

A 74LS01–the subject of the video–only has 8 transistors. Imagine trying to do even a simple CPU like an 8008 with about 3,500 smaller transistors. We recommend coffee and patience.

27 thoughts on “How To Reverse Engineer A Chip

  1. http://www.visual6502.org/

    In the summer of 2009, the Visual6502.org project shot and assembled high resolution photographs of a MOS 6502 revision D. The surface of the chip was photographed, then the metal and polysilicon layers were stripped off to reveal the conductive substrate diffusion areas. The substrate was photographed, and the substrate image was aligned to the surface image. These two aligned images were then used to create the vector polygons that form the Visual6502 chip simulation.

      1. I guess just being careful with HF is enough. It’s not like you’ll be using concentrated solutions anyway.
        And Armour Etch (which isn’t a thing around here and required some googling) is basically an acidic solution of fluoride salts, so much so that the MSDS suggests treating skin exposure with calcium gluconate gel… doesn’t sound much better than other products in the market to me.

      2. I have always found HF to be too aggressive for general use when delayering/deprocessing a die. If you don’t want to work with HF; you can achieve results by polishing it with a mix of DI water and Alumina, sometimes sold as jeweler’s rouge. Don’t breathe the powder though if you can help it.

    1. (Of course, since it was an Uncommitted Logic Array, it was really a repeating pattern of cells, and only the metalization layer was different, so as soon as you have one of the cells and the connections, you have the entire chip, which is easier than a fully custom chip like a microprocessor).

    1. Years ago I did this professionally. Might be different now but it was a very manual process then. We did work on election beam stroboscopy to be able to identify good vs bad operation but that took a huge computer back then and was never super successful.

  2. As I recall, Intel used to give away key fobs with raw CPUs embedded inside.. (Las Vegas Trade Show)

    It’s possible I still have one tucked in a box somewhere.

  3. Wow, that is totally awesome and well detailed. The only gap I have is wondering how to identify the chips individual components… though I will have to watch this more. That is really excellent what was demonstrated in the video and the video is really well made too. Thanks for sharing!

Leave a Reply

Please be kind and respectful to help make the comments section excellent. (Comment Policy)

This site uses Akismet to reduce spam. Learn how your comment data is processed.