Introduction IC Layout Recovery Functional Recovery Case Studies Conclusion CMOS Reverse Engineering Advanced Digital IC Design (ETI135) Vt1 2012 Steffen Malkowsky, Christoph M¨ uller Lund University February 10, 2012 Steffen Malkowsky, Christoph M¨ uller CMOS Reverse Engineering
Introduction IC Layout Recovery Functional Recovery Case Studies Conclusion Table of Contents Introduction IC Layout Recovery Functional Recovery Case Studies Conclusion Steffen Malkowsky, Christoph M¨ uller CMOS Reverse Engineering
Introduction IC Layout Recovery Functional Recovery Case Studies Conclusion Why should CMOS devices be reverse engineered? ◮ As preliminary for security examinations ◮ Identify patent infringements ◮ Find errors in the manufacturing process ◮ We can - and it’s awesome! ;-) Steffen Malkowsky, Christoph M¨ uller CMOS Reverse Engineering
Introduction Expose the die IC Layout Recovery Deprocessing Functional Recovery Image Acquisition Case Studies Stitching process Conclusion Determine the typ of the package ◮ Different methods according to typ of the package ◮ Cavity packages (metal and ceramic) ◮ Plastic ◮ Some need professional equipment, some can be used at home Steffen Malkowsky, Christoph M¨ uller CMOS Reverse Engineering
Introduction Expose the die IC Layout Recovery Deprocessing Functional Recovery Image Acquisition Case Studies Stitching process Conclusion Open the packages Delidding cavity packages ◮ Grinding away the lid (mainly for ceramic packages) ◮ Cracking the lid seal with a knife ◮ Melting the lid seal and peel up the lid Decapsulating plastic packages ◮ Fuming nitric acid, fuming sulfuric acid or a mixture of both (ca. 90 ◦ ) ◮ Drop chip in heated acid ◮ Cavity etching ◮ Jet etching ◮ Cooking in rosin (colophony) (320 ◦ -360 ◦ ) Steffen Malkowsky, Christoph M¨ uller CMOS Reverse Engineering
Introduction Expose the die IC Layout Recovery Deprocessing Functional Recovery Image Acquisition Case Studies Stitching process Conclusion Examples Images of several decapsulated chips Images from: http://cms.diodenring.de/electronic/microcontroller/83-ic-decapsulation/ http://www.prioritylabs.com/Decapsulation.aspx Steffen Malkowsky, Christoph M¨ uller CMOS Reverse Engineering
Introduction Expose the die IC Layout Recovery Deprocessing Functional Recovery Image Acquisition Case Studies Stitching process Conclusion Methods to expose the layers ◮ Chemical ◮ Wet etching - remove layers with specific chemicals ◮ Dry etching - plasma etching (e.g. reactive ion etching) ◮ Mechanical - polishing Steffen Malkowsky, Christoph M¨ uller CMOS Reverse Engineering
Introduction Expose the die IC Layout Recovery Deprocessing Functional Recovery Image Acquisition Case Studies Stitching process Conclusion Polishing How it works ◮ Fix die on a stamp (must be parallel to the polishing surface!!!) ◮ Use very fine (0.04 µ m) abrasive paper ◮ Check progress regularly to prevent too deep polishing ◮ Can be done manually or with machines ◮ The planarity of the surface must be maintained Steffen Malkowsky, Christoph M¨ uller CMOS Reverse Engineering
Introduction Expose the die IC Layout Recovery Deprocessing Functional Recovery Image Acquisition Case Studies Stitching process Conclusion Polishing Advantages ◮ Material can be removed layer by layer (good for multilayers) ◮ Can be done without machines Disadvantages ◮ Time-consuming ◮ Planarity Steffen Malkowsky, Christoph M¨ uller CMOS Reverse Engineering
Introduction Expose the die IC Layout Recovery Deprocessing Functional Recovery Image Acquisition Case Studies Stitching process Conclusion What happens if planarity is destroyed Skewed polished chip Image from: All Chips Reversed [Sch10a] Steffen Malkowsky, Christoph M¨ uller CMOS Reverse Engineering
Introduction Expose the die IC Layout Recovery Deprocessing Functional Recovery Image Acquisition Case Studies Stitching process Conclusion Image Acquisition Necessary microscope depends on structure size of the die ◮ Optical microscope ◮ Relatively cheap ◮ Smallest possible resolution about 0 . 2 µ m ◮ Confocal microscope ◮ Smallest possible resolution about 0 . 1 µ m ◮ Tremendously higher depth of focus ◮ Colors images of different layers ◮ Electron microscope ◮ Expensive ◮ Smallest possible resolution about 0 . 1 nm Steffen Malkowsky, Christoph M¨ uller CMOS Reverse Engineering
Introduction Expose the die IC Layout Recovery Deprocessing Functional Recovery Image Acquisition Case Studies Stitching process Conclusion Examples Optical microscope vs. Electron microscope Images of a die manufactured in a 130 nm process Images from: The State-of-the-Art in IC Reverse Engineering [TJ09] Steffen Malkowsky, Christoph M¨ uller CMOS Reverse Engineering
Introduction Expose the die IC Layout Recovery Deprocessing Functional Recovery Image Acquisition Case Studies Stitching process Conclusion Examples Confocal microscope Image of a chip made with confocal microscope Image from: Chip Reverse Engineering [NS08] Steffen Malkowsky, Christoph M¨ uller CMOS Reverse Engineering
Introduction Expose the die IC Layout Recovery Deprocessing Functional Recovery Image Acquisition Case Studies Stitching process Conclusion How to continue? ◮ Acquire images of every chip layer ◮ Motorized frames available to semi automate the process ◮ Take overlapping images to simplify the following step ◮ Number of images depending on chip area and needed magnification ◮ Huge dataset Intel 8086, images from the visual 6502 project http://uxul.org/~noname/visual6502/8086/t/bf/5x/ Steffen Malkowsky, Christoph M¨ uller CMOS Reverse Engineering
Introduction Expose the die IC Layout Recovery Deprocessing Functional Recovery Image Acquisition Case Studies Stitching process Conclusion Combination of the images ◮ Problem: combine a bunch of images to a single big one ◮ Problem also well known in panorama photography ◮ Solution: use well optimized panorama stitching tools ◮ Panotools/Hugin ◮ Autostitch ◮ Photoshop ◮ · · · Steffen Malkowsky, Christoph M¨ uller CMOS Reverse Engineering
Introduction Expose the die IC Layout Recovery Deprocessing Functional Recovery Image Acquisition Case Studies Stitching process Conclusion Stitching process ◮ Load images Steffen Malkowsky, Christoph M¨ uller CMOS Reverse Engineering
Introduction Expose the die IC Layout Recovery Deprocessing Functional Recovery Image Acquisition Case Studies Stitching process Conclusion Stitching process ◮ Load images ◮ Find matching points in the overlapping zones ◮ Can be automated, but problems with regular structures e.g. memories. . . Steffen Malkowsky, Christoph M¨ uller CMOS Reverse Engineering
Introduction Expose the die IC Layout Recovery Deprocessing Functional Recovery Image Acquisition Case Studies Stitching process Conclusion Stitching process ◮ Load images ◮ Find matching points in the overlapping zones ◮ Can be automated, but problems with regular structures e.g. memories. . . ◮ Stitch everything together Steffen Malkowsky, Christoph M¨ uller CMOS Reverse Engineering
Introduction Recovery of the Transistor Logic IC Layout Recovery Standard Cell Recognition Functional Recovery Interconnections Case Studies Software Conclusion Non destructive Methods Recovery of the Transistor Logic I Polysilicon Layer P-Well Polysilicon Contact N-Well Die shoot: http://www.degate.org , National Semiconductor SC14421CVF Steffen Malkowsky, Christoph M¨ uller CMOS Reverse Engineering
Introduction Recovery of the Transistor Logic IC Layout Recovery Standard Cell Recognition Functional Recovery Interconnections Case Studies Software Conclusion Non destructive Methods Recovery of the Transistor Logic II Metal Layer 1 VDD Via GND Die shoot: http://www.degate.org , National Semiconductor SC14421CVF Steffen Malkowsky, Christoph M¨ uller CMOS Reverse Engineering
Introduction Recovery of the Transistor Logic IC Layout Recovery Standard Cell Recognition Functional Recovery Interconnections Case Studies Software Conclusion Non destructive Methods Recovery of the Transistor Logic III Metal Layer 2/3 Input A A B Q B A Output Q Input B Die shoot: http://www.degate.org , National Semiconductor SC14421CVF Steffen Malkowsky, Christoph M¨ uller CMOS Reverse Engineering
Introduction Recovery of the Transistor Logic IC Layout Recovery Standard Cell Recognition Functional Recovery Interconnections Case Studies Software Conclusion Non destructive Methods Recovery of the Transistor Logic IV What can we do now? ◮ Enough to recover the circuit diagram of the complete IC ◮ The only way for ”old” digital ICs which have been designed on transistor level ◮ Has been done - MOS 6502 for example. Steffen Malkowsky, Christoph M¨ uller CMOS Reverse Engineering
Recommend
More recommend
