Silicon Pr0n

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
Invasive techniques actively modify the system in a permanent way.

====== Backside analysis ======

[[backside:start]]

====== Rewiring ======

===== Cutting wires =====

==== Laser ====

The "professional" mid range solution.  Typically some form of Nd:YAG, either the fundamental or some harmonic.  Expect minimum of a few thousand USD for a system, probably many more.  Probably the most economical would be to piece together a Mitutoyo microscope.  Of course, be careful not to look into your home spun laser while firing without good reason.

==== FIB ====

The "professional" high end solution used for small processes.  Equipment is rather expensive. Some estimates seem to put them around an order of magnitude of 500,000 USD.

FIB time can often be rented on an hourly basis from universities and research labs.

azonenberg is beginning to experiment with FIB. [[azonenberg:fibnotes|Lab notes]]


==== Scratching ====

Microprobes can cut traces by moving back and forth.  Professional units use peizo's (ie ultrasound).


==== Chemical ====

By masking the chip and then etching (ex: with HF) wires can be removed.  Masking compounds range from photoresists to nail polish.


===== Adding wires =====

Usually done with a fib.  Can be done temporarily with microprobes or possibly on a high process chip very carefully with conductive epoxy.


====== Presentation: low cost microporbing ======

JM's highlights from watching the presentation

exposing wires
  * laser
    * expensive
    * more reliable with experience
    * better option for smaller areas
    * better option for planar chips
  * scratching
    * good option for larger, non-planar chips
    * lower cost
fuses
  * binary search by covering chip
    * try to erase with UV light
  * trace VPP
    * charge pump or external
  * confirm guess via microprobing
op amp vs ttl amp for gain
  * microcircuits damaged or distorted when disturbed
  * op amp in volt follower mode
    * "more transparent electrically"
    * look at noise level
      * drops when makes contact
      * not necessarily the right wire though
fib probing
  * shoots ions instead of electrons
  * filled hole with platinum to make a bond pad
anti-anti-re
  * cut charge pumps
  * jump security mesh
  * go from back side
    * challenge: can destablize chips
    * tends to be used more by FA than RE
  * peizo probing
    * they didn't like it
    * I've seen others use it
future/upcoming anti-re
  * analog meshes
    * The IBM PCI card thing has one externally but maybe not plausible yet at chip level

No mention of masked etching.  Ex: putting PR or nail polish and etching with HF

====== References ======

  * Functional IC Analysis: http://nedos.net/host2012.pdf
  * Breaking and Entering through the Silicon: http://nedos.net/ccs2013.pdf
  * Low-Cost Chip Microprobing
    * http://events.ccc.de/congress/2012/Fahrplan/events/5124.en.html
    * http://media.ccc.de/browse/congress/2012/29c3-5124-en-low_cost_chip_microprobing_h264.html