Laser Fault Injection, Now With Optional Decapping

Whether the goal is reverse engineering, black hat exploitation, or just simple curiosity, getting inside the packages that protect integrated circuits has long been the Holy Grail of hacking. It isn’t easy, though; those inscrutable black epoxy blobs don’t give up their secrets easily, with most decapping methods being some combination of toxic and dangerous. Isn’t there something better than acid baths and spinning bits of tungsten carbide?

[Janne] over at Fraktal thinks so, and the answer he came up with is laser decapping. Specifically, this is an extension of the laser fault injection setup we recently covered, which uses a galvanometer-scanned IR laser to induce glitches in decapped microcontrollers to get past whatever security may be baked into the silicon. The current article continues that work and begins with a long and thorough review of various IC packaging technologies, including the important anatomical differences. There’s also a great review of the pros and cons of many decapping methods, covering everything from the chemical decomposition of epoxy resins to thermal methods. That’s followed by specific instructions on using the LFI rig to gradually ablate the epoxy and expose the die, which is then ready to reveal its secrets.

The benefit of leveraging the LFI rig for decapping is obvious — it’s an all-in-one tool for gaining access and executing fault injection. The usual caveats apply, of course, especially concerning safety; you’ll obviously want to avoid breathing the vaporized epoxy and remember that lasers and retinas don’t mix. But with due diligence, having a single low-cost tool to explore the innards of chips seems like a big win to us.

Adjustable Lights Help Peer Inside Chips With IR

If you’re used to working through a microscope, you’ve probably noticed that the angle of the light greatly affects how your workpiece looks. Most of us prefer the relatively flat lighting provided by a ring light, but variable angle side lighting can be useful too, especially when you’re peering inside ICs to make sure the silicon is what it’s supposed to be.

That’s what [Bunnie] is working on these days with his Project IRIS, short for “Infrared in situ,” a non-destructive method for looking inside chip packages. The technique relies on the fact that silicon is transparent to certain wavelengths of light, and that some modern IC packages expose the underside of the silicon die directly to the outside world. Initial tests indicated that the angle of the incident IR light was important to visualizing features on the metal interconnects layered onto the silicon, so [Bunnie] designed a two-axis light source for his microscope. The rig uses curved metal tracks to guide a pair of IR light sources through an arc centered on the focal point of the microscope stage. The angle of each light source relative to the stage can be controlled independently, while the whole thing can swivel around the optical axis of the microscope to control the radial angle of the lighting.

The mechanism [Bunnie] designed to accomplish all this is pretty complex. Zenith angle is controlled by a lead screw driving a connecting rod to the lights on their guide tracks, while the azimuth of the lights is controlled by a separate motor and pulley driving a custom-built coaxial bearing. The whole optical assembly is mounted on a Jubilee motion platform for XYZ control. The brief videos below show the lights being put through their paces, along with how changing the angle of the light affects the view inside a chip.

Continue reading “Adjustable Lights Help Peer Inside Chips With IR”

Stacking Solar Cells Is A Neat Trick To Maximise Efficiency

Solar power is already cheap and effective, and it’s taking on a larger role in supplying energy needs all over the world. The thing about humanity, though, is that we always want more! Too much, you say? It’s never enough!

The problem is that the sun only outputs so much energy per unit of area on Earth, and solar cells can only be so efficient thanks to some fundamental physical limits. However, there’s a way to get around that—with the magic of tandem solar cells!

Continue reading “Stacking Solar Cells Is A Neat Trick To Maximise Efficiency”

Up Close And Personal With A MEMS Microphone

If you’ve ever wondered what lies beneath the barely visible hole in the can of a MEMS microphone, you’re in luck, because [Zach Tong] has a $10 pair of earbuds to sacrifice for the cause and an electron microscope.

For the uninitiated, MEMS stands for microelectromechanical systems, the tiny silicon machines that power some of the more miraculous functions of smartphones and other modern electronics. The most familiar MEMS device might be the accelerometer that gives your phone a sense of where it is in space; [Zach] has a deep dive into MEMS accelerometers that we covered a while back.

MEMS microphones seem a little bit easier to understand mechanically, since all they have to do is change vibrations in air into an electrical signal. The microphone that [Zach] tore down for this video is ridiculously small; the SMD device is only about 3 mm long, with the MEMS chip under the can a fraction of a millimeter on a side. After some overall views with the optical microscope, [Zach] opened the can and put the guts under his scanning electron microscope. The SEM shots are pretty amazing, revealing a dimpled silicon diaphragm over a second layer with holes etched right through it. The dimples on the diaphragm nest into the holes, forming an air-dielectric capacitor whose capacitance varies as sound waves vibrate the diaphragm.

The most visually interesting feature, though, might be the deep cavity lying behind the two upper surfaces. The cavity, which [Zach] says bears evidence of having been etched by the deep reactive ion etching method, has cool-looking corrugations in its walls. The enormity of the cavity relative to the thin layers covering it suggests it’s a resonating cavity for the sound waves.

Thanks to [Zach] for this in-depth look at a device that’s amazingly complex yet remarkably simple.

Continue reading “Up Close And Personal With A MEMS Microphone”

Simple Chemistry To Metallize And Etch Silicon Chips

We’ve been eagerly following [ProjectsInFlight]’s stepwise journey toward DIY semiconductors, including all the ups and downs, false leads, and tedious optimizations needed to make it possible for the average hacker to make chips with readily available tools and materials.

Next up is metallization, and spoiler alert: it wasn’t easy. In a real fab, metal layers are added to chips using some form of deposition or sputtering method, each of which needs some expensive vacuum equipment. [ProjectsInFlight] wanted a more approachable way to lay down thin films of metal, so he turned to an old friend: the silver mirror reaction. You may have seen this demonstrated in high school chemistry; a preparation of Tollen’s reagent, a mix of sodium hydroxide, ammonia, and silver nitrate, is mixed with glucose in a glass vessel. The glucose reduces the reagent, leaving the metallic silver to precipitate on the inside of the glass, which creates a beautiful silvered effect.

Despite some issues, the silvering method worked well enough on chips to proceed on, albeit carefully, since the layer is easily scratched off. [ProjectsInFlight]’s next step was to find an etchant for silver, a tall order for a noble metal. He explored piranha solutions, which are acids spiked with peroxide, and eventually settled on plain old white vinegar with a dash of 12% peroxide. Despite that success, the silver layer was having trouble sticking to the chip, much preferring to stay with the photoresist when the protective film was removed.

The solution was to replace the photoresist’s protective film with Teflon thread-sealing tape. That allowed the whole process from plating to etching to work, resulting in conductive traces with pretty fine resolution. Sure they’re a bit delicate, but that’s something to address another day. He’s come a long way from his DIY tube furnace used to put down oxide layers, and suffering through the search for oxide etchants and exploring photolithography methods. It’s been a fun ride so far, and we’re eager to see what’s next.

Continue reading “Simple Chemistry To Metallize And Etch Silicon Chips”

Testing Oxide Etchants For The Home Semiconductor Fab

Building circuits on a silicon chip is a bit like a game of Tetris — you have to lay down layer after layer of different materials while lining up holes in the existing layers with blocks of the correct shape on new layers. Of course, Tetris generally doesn’t require you to use insanely high temperatures and spectacularly toxic chemicals to play. Or maybe it does; we haven’t played the game in a while, so they might have nerfed things.

Luckily, [ProjectsInFlight] doesn’t treat his efforts to build semiconductors at home like a game — in fact, the first half of his video on etching oxide layers on silicon chips is devoted to the dangers of hydrofluoric acid. As it turns out, despite the fact that HF can dissolve your skin, sear your lungs, and stop your heart, as long as you use a dilute solution of the stuff and take proper precautions, you should be pretty safe around it. This makes sense, since HF is present in small amounts in all manner of consumer products, many of which are methodically tested in search of a practical way to remove oxides from silicon, which [ProjectsInFlight] has spent so much effort recently to learn how to deposit. But such is the ironic lot of a chip maker.

Three products were tested — rust remover, glass etching cream, and a dental porcelain etching gel — against a 300 nm silicon dioxide layer. Etch speed varied widely, from rust remover’s 10 nm/min to glass etching cream’s blazing 240 nm/min — we wonder if that could be moderated by thinning the cream out with a bit of water. Each solution had pros and cons; the liquid rust remover was cheap easy to handle and clean up, while the dental etching gel was extremely easy to deposit but pretty expensive.

The good news was that everything worked, and each performed differently enough that [ProjectsInFlight] now has a range of tools to choose from. We’re looking forward to seeing what’s next — looks like it’ll be masking techniques.

Continue reading “Testing Oxide Etchants For The Home Semiconductor Fab”

Start Your Semiconductor Fab With This DIY Tube Furnace

Most of us are content to get our semiconductors from the usual sources, happily abstracting away the complexity locked within those little epoxy blobs. But eventually, you might get the itch to roll your own semiconductors, in which case you’ll need to start gearing up. And one of the first tools you’ll need is likely to be something like this DIY tube furnace.

For the uninitiated, [ProjectsInFlight] helpfully explains in the video below just what a tube furnace is and why you’d need one to start working with semiconductors. Perhaps unsurprisingly, a tube furnace is just a tube that gets really, really hot — like 1,200° C. In addition to the extreme heat, commercial furnaces are often set up to seal off the ends of the tube to create specific conditions within, such as an inert gas atmosphere or even a vacuum. The combination of heat and atmospheric control allows the budding fabricator to transform silicon wafers using chemical and physical processes.

[ProjectsInFlight]’s tube furnace started with a length of heat-resistant quartz glass tubing and a small tub of sodium silicate refractory cement, from the plumbing section of any home store. The tube was given a thin coat of cement and dried in a low oven before wrapping it with nichrome wire. The wrapped tube got another, thicker layer of silicate cement and an insulating wrap of alumina ceramic wool before applying power to cure everything at 1,000° C. The cured tube then went into a custom-built sheet steel enclosure with plenty of extra insulation, along with an Arduino and a solid-state relay to control the furnace. The video below concludes with testing the furnace by growing a silicon dioxide coating on a scrap of silicon wafer. This was helped along by the injection of a few whisps of water vapor while ramping the furnace temperature up, and the results are easily visible.

[ProjectsInFlight] still needs to add seals to the tube to control the atmosphere in there, an upgrade we’ll be on the lookout for. It’s already a great start, although it might take a while to catch up to our friend [Sam Zeloof].

Continue reading “Start Your Semiconductor Fab With This DIY Tube Furnace”