This presentation by Ulf provides a comprehensive beginner's guide to the hobbyist reverse engineering of integrated circuits (ICs). The talk covers the entire process, starting with the fundamental anatomy of ICs and their various package types. A significant portion is dedicated to "decapsulation," detailing numerous methods for removing the chip's packaging to expose the silicon die, ranging from simple mechanical and heat-based techniques to the speaker's preferred colophony (rosin) boiling method. The presentation strongly emphasizes the extreme dangers of professional chemical methods involving sulfuric, nitric, and especially hydrofluoric acids, advising extreme caution and proper safety protocols. Subsequent sections cover delayering to remove metal tracks, the principles of reflected light microscopy essential for imaging, and the importance of an objective's numerical aperture for achieving high resolution. Finally, the talk explores the practical applications of the resulting images, from simple chip identification and feature recognition (memory, CPU cores) to the meticulous transistor-level tracing required to reconstruct logic gates, gate arrays, and mask ROMs.
A Beginner's Guide to Reverse Engineering Integrated Circuits
1:43 A Critical Safety Warning: The speaker begins by stressing that many techniques involve incredibly dangerous and toxic chemicals (like hydrofluoric acid) that can be lethal if mishandled. He advises following all safety protocols and being aware of the risks.
4:29 Unpacking the Chip (Decapsulation): To access the silicon die, the outer package must be removed. Several methods are presented:
Mechanical (5:48): Using tools like hammers, chisels, or saws to physically break open ceramic or metal packages. This method is simple but risks contaminating or damaging the die.
Heat (7:16): Using a heat gun or blowtorch to soften or burn away the epoxy packaging, making it brittle and easy to remove. Requires practice to avoid cracking the die from thermal stress.
Chemicals (10:08): Dissolving the package using acids like hot sulfuric or fuming nitric acid. This is highly effective but extremely dangerous.
Colophony (Rosin) Method (12:15): The speaker's preferred and safer method involves boiling the chip in rosin at ~300Β°C, which effectively dissolves most epoxy compounds. The materials are easily accessible.
17:22 Peeling the Layers (Delayering): To see the transistors beneath the metal interconnects, the top layers of the chip must be removed.
Lapping (17:40): A mechanical method of carefully sanding or polishing away the layers using fine abrasives like diamond paste.
Wet Etching (19:19): A chemical process using hydrofluoric acid (HF) to dissolve the glass passivation layer, followed by another acid mixture to remove the metal. This gives the cleanest results but is the most hazardous part of the entire process.
23:11 Getting the Picture (Microscopy): Imaging a silicon die requires a specific type of microscope.
Reflected Light Microscopy (23:47): Unlike biological microscopes that shine light through a sample, IC analysis requires a metallurgical microscope that shines light down onto the reflective surface of the chip.
Numerical Aperture (NA) is Key (26:20): The resolving power of a microscope depends less on magnification and more on the objective's numerical aperture. A higher NA allows the objective to capture more light and distinguish smaller features, but these objectives are significantly more expensive.
30:13 Rebuilding the Puzzle: Once imaged, the die can be analyzed.
Chip & Feature Identification (30:25): The process can be used to identify unknown chips or locate major functional blocks like memory, peripherals, and CPU cores, even on modern chips where individual transistors aren't visible with optical microscopes.
Transistor-Level Analysis (34:26): By delayering, it's possible to see individual transistors and trace their connections to reconstruct the original logic gates and schematic.
Analyzing Regular Structures (36:55): Simpler structures like Gate Arrays and Mask ROMs are easier to reverse engineer because they consist of repeating patterns where only the final interconnects or a single mask layer define the logic or stored data.
40:09 Advanced Technique: Photon Emission: Transistors emit a faint infrared glow when they switch. Using a modified camera with a long exposure, it's possible to see which parts of the chip are active during certain operations, helping to locate specific functional areas without a full teardown.