User talk:Ada L0ve Lace/sandbox

CXD90025G inside die overview

 This article is for educational purposes only, do not try to repeat!  

References

• http://www.cl.cam.ac.uk/~sps32/mcu_lock.html Copy Protection in Modern Microcontrollers - Dr Sergei Skorobogatov

• https://www.youtube.com/watch?v=0Z4aF-qiziM Defcon 21 - Decapping Chips The Strike Easy Hard Way

• https://siliconpr0n.org/wiki/doku.php?id=decap:start

• http://zeptobars.ru/en/read/how-to-open-microchip-asic-what-inside

• http://travisgoodspeed.blogspot.fr/2009/06/cold-labless-hno3-decapping-procedure.html Cold, Labless HNO3 Decapping Procedure

• http://www.cleanroom.byu.edu/wet_etch.phtml Wet Chemical Etching of Metals and Semiconductors

• http://users.sec.t-labs.tu-berlin.de/~nedos/ccs2013.pdf Breaking and Entering through the Silicon

Decap a (epoxy packaged) chip, but why?

CXD90025G die numbers

• to damage (beyond repair) the chip and things around you (including you) and end up ,if lucky, in the great Wall of Shame or much worst (dead, blind & anosmia ...)
• for fun (then, use razorblade but not as you were going to tearing a part of the human scalp)
• photograph for forensics purposes:
  • look for damage
  • to get die numbers
  • check for counterfeit (e.g. http://www.cti-us.com/pdf/CCAP-101InspectExamplesA6.pdf)
• microprobing ( e.g.: with ion beam workstation)
• if somehow, you end up here for making explosive things/dispose body, it s not the right place.

The Strike Easy Hard Way (be blind & anosmia)

Epoxy resin around the chip could be removed using fuming nitric acid (HNO3) (when the solution contains more than 86% HNO3, it is referred to as fuming nitric acid).

Hot fuming nitric acid dissolves the package without affecting the chip. The procedure should preferably be carried out under very dry conditions, as the presence of water could corrode exposed aluminium interconnects.

Alternatives to heated HNO3 (70% concentration is enough) can be with cold white HNO3 (99% concentration), with sulfuric acid (H2SO4) or with (boilting) rosin (for 20 minutes).

The chip is then washed with acetone in an ultrasonic bath, followed optionally by a short bath in deionized water and isopropanol.

After that chip could be glued into a test package and bonded manually. Having enough experience it might be possible to remove epoxy without destroying bonding wires and smartcard contacts.

On the depackaged chip, the top-layer aluminium interconnect lines are still covered by a passivation layer (usually silicon oxide or nitride), which protects the chip from the environment and ion migration.

On top of this, we might also find a polyimide layer that was not entirely removed by HNO3 but which can be dissolved with ethylenediamine.

We have to remove the passivation layer (top layer of the die) before the probes can establish contact.

Wire bonding Gold is immune to attack from the fuming acids used to etch away the mold compound of the package; copper is not.

Passivation layer

Growth of an oxide layer on the surface of a semiconductor to provide electrical stability by isolating the transistor surface from electrical and chemical conditions in the environment; this reduces reverse-current leakage, increases breakdown voltage, and raises power dissipation rating.

The most convenient depassivation technique is the use of a laser cutter. The UV or green laser is mounted on the camera port of the microscope and fires laser pulses through the microscope onto rectangular areas of the chip with micrometer precision. Carefully dosed laser flashes remove patches of the passivation layer.

The resulting hole in the passivation layer can be made so small that only a single bus line is exposed. This prevents accidental contacts with neighboring lines and the hole also stabilizes the position of the probe and makes it less sensitive to vibrations and temperature changes.

An other way to remove the passivation layer is by using hydrofluoric acid.

Terminology

Nitric acid

• Warning:

You can burn/intoxicate by fumes (like countless of experimented and certified chemists). Chemical burn traumata with nitric acid lead to 
specific yellow- to brown-stained wounds with slower accumulation of eschar and slower demarcation compared with thermal burns; skins stains/coloration 
can happens later on (8 hours) without you noiticing any traumata/burn on the spot.

• Boiling point:83 °C (181 °F; 356 K) 68% solution boils at 121 °C (250 °F; 394 K)

• https://www.youtube.com/watch?v=8YWVBBGSxZ8 How to make Fuming Nitric Acid
• http://www.instructables.com/id/Make-Nitric-acid-The-Complete-Guide/

Sulfuric acid

• Warning:

causing very severe burns, apidly attacks the cornea and can induce permanent blindness if splashed onto eyes.

• Boiling point: 337 °C (639 °F; 610 K) When sulfuric acid is above 300 °C (572 °F), it will decompose slowly
• http://uvicrec.blogspot.com/2013/04/heatgun-h2so4-decap.html Heatgun H2SO4 decap
• http://chemistry.about.com/od/makechemicalsyourself/a/How-To-Make-Sulfuric-Acid-At-Home.htm / http://pyrorockets.tripod.com/ How to make concentrated sulfuric acid from a car battery
• http://www.instructables.com/id/Make-Sulfuric-Acid-by-Copper-Sulfate-Electrolysis/ How to make sulfuric acid by electrolysis of copper using an inert anode
• http://www.instructables.com/id/Make-Sulfuric-acid-metabisulfiteoxidizer-method/ concentrated sulfuric acid from sodium metabisulfite, hydrochloric acid and an oxidant such as hydrogen peroxide or nitric acid (metabisulfite/oxidizer method)

Hydrofluoric acid

• Warning:

In addition to being a highly corrosive liquid, hydrofluoric acid is also a contact poison. It should therefore be handled with extreme care.
Because of the ability of hydrofluoric acid to penetrate tissue, poisoning can occur. Rinsing off is not enough. 
Accidental exposures can go unnoticed until a day after (too late).

Corrosive effect on human tissue, with the potential to damage respiratory organs, eyes, skin, and intestines irreversibly.

• http://en.wikipedia.org/wiki/Hydrofluoric_acid#Health_and_safety
• http://www.ncbi.nlm.nih.gov/pubmed/20512294 Finger burns caused by concentrated hydrofluoric acid, treated with intra-arterial calcium gluconate infusion: case report.

Porcelain etch gel contain low (9.6%) concentration of Hydrofluoric acid

Hydrochloric Acid

• https://en.wikipedia.org/wiki/Hydrochloric_acid#Safety

• https://www.youtube.com/watch?v=YGjd7xxTuZw

Chlorine

Warning:

Chlorine is a toxic gas that irritates the respiratory system. Used as chemical weapon.

widely used for purifying water owing to its powerful oxidizing properties, especially potable water supplies and water used in swimming pools. 

Hydrogen peroxide

Warning:

Regulations vary, but low concentrations, such as 6%, are widely available and legal to buy for medical use. 
Most over-the-counter peroxide solutions are not suitable for ingestion. 
Higher concentrations may be considered hazardous

Can be used for the sterilization of various surfaces/tools or creating organic peroxide based explosive as improvised explosive devices. 
When diluted H2O2 (between 1.9% and 12%) mixed with ammonium hydroxide is used to bleach human hair.

Rosin

Warning:

Boil a chip for a few hours in rosin, like used for soldering. Refluxing equipment is ideal. Should eat away the casing. Might be best used with Dremeling or other techniques to remove the majority of the epoxy first. The active ingredient for this is abietic acid.

Acetone

Warning:

Acetone is flammable for everyone (advanced/certified user or not), can enter the body by inhalation, skin contact or ingestion.

Common Products Containing Acetone:

• Nail polish and nail polish removers:
  • https://www.youtube.com/watch?v=KFXTv9vKPOY Woman burned while removing nail polish
• lot of others daily life products

Isopropanol

Warning:

Symptoms of isopropyl alcohol poisoning include flushing, headache, dizziness, CNS depression, nausea, vomiting, anesthesia, and coma.
Poisoning can occur from ingestion, inhalation, or absorption; therefore, well-ventilated areas and protective gloves are recommended. 
Around 15 g of isopropyl alcohol can have a toxic effect on a 70 kg human (the bigger they are the harder they fall).

Ethylenediamine

Warning:

Ethylenediamine is a skin and respiratory irritant. Unless tightly contained, liquid ethylenediamine will release toxic 
and irritating vapors into its surroundings, 
especially on heating. The vapors react with moisture in humid air to form a characteristic white mist, 
which is extremely irritating to skin, eyes, lungs and mucus membranes. 
Exposure to a relatively small amount of vapor or mist by inhalation can seriously damage health and may even result in death.

Ultrasonic bath

An ultrasonic cleaning is a process that uses ultrasound (usually from 20–400 kHz) and an appropriate cleaning solvent (sometimes ordinary tap water) to clean items.

Deionized water

Deionized water is a type of purified water with mineral ions (salts) removed. Deionized water is created by taking 
conventional water and exposing it to electrically charged resins that attract  and bind to the salts, removing them from the water.

Microprobing

Microprobing techniques (invasive attacks) can be used, once the chip is depackaged, to access the chip surface directly, 
thus we can observe, manipulate, and interfere with integrated circuit.  

Microprobing workstation: Its major component is a special optical microscope with a working distance of at least 8 mm between the chip surface and the objective lens. 
On a stable platform around a socket for the test package, we install several micropositioners , 
which allow us to move a probe arm with submicrometer precision over a chip surface. On this arm, we install a probe needle. 
These elastic probe hairs allow us to establish electrical contact with on-chip bus lines without damaging them.

Safety

Most of the items listed here are Prohibited Items (no fly)-hazardous materials (e.g. http://www.tsa.gov/traveler-information/prohibited-items)
Having them/making them/speaking/thinking/dreaming about them (with or without an proper license) is enough to put you in jail 
and being raped many time by many people/items.

• before: no fly items - studish/read - ...
• during: humble state of mind / not high/not drunk - ...
• after: storage/disposal of hazardous items, nearest clinics - ....

• proper workplace/labs (not your kitchen table or RV vehicle as acids can cause spontaneous combustion with organics)
• fume Cabinet
• acid-prof gloves
• protection glasses
• protective suit and shoes
• wear a cap and tied your hairs

...

Others ways

play it safety

• the safe way: services
• the explosive way: https://siliconpr0n.org/wiki/doku.php?id=decap:explosive
• the burning way: propane or butane torch (no wires remaining)
• the Indian way: razzorblade (e.g. RSX die, scraped with razorblade by Héctor Martín aka Marcan)

• the laser way:
  • https://www.youtube.com/watch?v=J00BEGsqIZE
  • https://www.jamiecraig.com/de-encapsulating-ics-with-a-laser-cutter/
  • the CO2 laser way: http://hackaday.com/2015/08/29/co2-laser-decapping-to-fix-soldering-mistake/

• the portal way: http://www.nordson.com/en-us/divisions/march/support/Literature/Documents/Nordson-MARCH-Mold-Decap-Article-USTech-July2012.pdf vacuum plasma
• the brute force: way https://www.youtube.com/watch?v=tjjIyJxqOqE brute force (several people apparently insist that this is not decapping but just destroying)
• the longest way:

...

Related articles

Microwires inside an IC (DualShock 4)

• Soldering Tips/Guides
• Xray

...

---