Can we make something like chip reader, which can understand chip design and generate blueprint of it?
\$\begingroup\$
\$\endgroup\$
3
-
\$\begingroup\$ What integrated circuit? For example the 555 timer the plans are online usually in the datasheet. \$\endgroup\$– DeanApr 25, 2011 at 18:50
-
\$\begingroup\$ It would be possible to design a chip reader that could "reverse-engineer" certain types of chips (e.g. any design one could put in a 16V8, or most designs one could put in a 22V10), but in general there are far too many things a chip could do for one to be confident in any reverse-enginnering effort done through probing alone. Even something like a 22V10 could behave one way until seven precise ten-bit addresses are clocked in, and then start behaving entirely differently. There'd be no way to probe all possible 70-bit address sequences, so one couldn't be sure no features were left out. \$\endgroup\$– supercatApr 26, 2011 at 15:19
-
1\$\begingroup\$ Related for Intel chips: reverseengineering.stackexchange.com/questions/5878/… \$\endgroup\$– Ciro Santilli OurBigBook.comOct 5, 2019 at 6:39
Add a comment
|
4 Answers
\$\begingroup\$
\$\endgroup\$
2
ChipWorks has an excellent blog about doing exactly this, with lots of great pictures here.
FlyLogic also has an excellent blog. It is here.
The short answer is it is absolutely possible. IC DIEs are basically really small circuit boards. You can reverse engineer them pretty easily, it just takes a different tool set.
I want to particularly call attention to some posts flylogic did on reverse-engineering ICs (how topical!) here and here.
Image from flylogic website
answered Apr 25, 2011 at 21:40
-
-
\$\begingroup\$ Complex chips are not that easy perhaps :-) reverseengineering.stackexchange.com/questions/5878/… \$\endgroup\$ Mar 22, 2018 at 1:15
\$\begingroup\$
\$\endgroup\$
4
Yes. There are companies out there that specialize in this. This is done all the time, although it's more of an art than a science. Usually they do some wacky chemical and mechanical etching process to progressively strips off the layers of the chip (like the layers of a PCB)-- taking detailed photos of each layer. Normally, these companies do it to help people like T.I. and Intel figure out why their own chips are failing, but you can bet that there is some illegal uses of this too.
Here's an interesting and relevant article that I just ran across: http://www.forbes.com/forbes/2005/0328/068.html
And another link: http://www.siliconinvestigations.com/ref/ref.htm
-
4\$\begingroup\$ What's illegal about reverse-engineering a competitor's chip? \$\endgroup\$– endolithApr 25, 2011 at 20:32
-
1\$\begingroup\$ @endolith I didn't say that reverse-engineering is illegal. But someone would probably make the case that it is (DCMA and all). That being said, reverse engineering is required to make counterfeit chips-- which is illegal in most countries. And, I should add, counterfeit chips is a big problem for most medium to large manufacturers. I know that our purchasing department has been trained to spot counterfeit chips, and has actually caught some before it made it into our system. \$\endgroup\$– user3624Apr 25, 2011 at 20:40
-
3\$\begingroup\$ I think reverse engineering to make an exact copy instead of using it to learn how it worked would fall under copyright infringement. \$\endgroup\$– pfyonApr 25, 2011 at 20:41
-
1\$\begingroup\$ @pfyon: The laws covering copying an IC mask work are very similar to the copyright laws that cover books, software, photographs, etc. I think the biggest difference is that copyright (with corporate authorship) lasts 95 years, but mask work rights last only 10 years. \$\endgroup\$ Jan 30, 2012 at 20:41
\$\begingroup\$
\$\endgroup\$
2
Another way to copy a chip design is to emulate its functionality using an FPGA. Many emulations of older chips like the Z80 and 6502 are available. Some students even produced their own version of an ARM device and made it available via the Web, but had to delete it when ARM threatened legal action.
answered Apr 25, 2011 at 19:39
-
3\$\begingroup\$ You can only implement it in an FPGA after you reversed engineered it. The question is about this reverse engineering. OP doesn't seem to have a datasheet. \$\endgroup\$– stevenvhApr 26, 2011 at 7:37
-
\$\begingroup\$ He hasn't said that. It's a viable approach if a data sheet is available, and far cheaper than the other suggestions. \$\endgroup\$ Apr 26, 2011 at 10:35
\$\begingroup\$
\$\endgroup\$
While reverse engineering of old microchips is feasible with an optical microscope and manual polishing, the challenge is to cleanly strip off layers. For instance, the above picture appears to be an older chip and from the color changes in the background you can see that it has been polished to remove a layer. Typical deprocessing processes involve polishing with specialized polishing/lapping machines or wet chemical etching with more or less dangerous chemicals.
However, for more recent chips the process sizes are so small that you will need sophisticated and more expensive equipment such as a plasma etcher, a Scanning Electron Microscope (SEM) or a Focused Ion Beam (FIB). Due to the complexity it is also no longer that easy to extract logic (i.e., the netlist information) from the chip. Today, companies thus use automated tools that typically process the obtained SEM images of chip layers to generate the netlist. The challenge here is deprocess the chip so that deprocessing artifacts are avoided as they would be problematic for any subsequent automated analysis.
There are some Youtube videos and conference talks on chip reverse engineering. For instance, in the video here you can see a smaller setup that people could use even at home: https://www.youtube.com/watch?v=r8Vq5NV4Ens
On the other hand, there are companies that can do this kind of work with more sophisticated and expensive equipment. In addition to the above mentioned, IOActive has a lab for this kind of work.
In the EU there are also companies. For instance on the Trustworks website, you can see a few pictures and some of the necessary lab tools to do this kind of work: https://www.trustworks.at/microchipsecurity. They also appear to have microchip reverse engineering software tools if you specifically look at their "Netlist Extraction and Analysis" section.
