reverse engineering: electronics rev ii - philadelphia university · 2015. 12. 24. · product...
TRANSCRIPT
![Page 1: Reverse Engineering: Electronics Rev II - Philadelphia University · 2015. 12. 24. · Product Teardowns. Identifythe product, package, internal boards, sub- systems, and components](https://reader035.vdocuments.site/reader035/viewer/2022081621/611e5c5cc2b38a3b282f8cd8/html5/thumbnails/1.jpg)
D R . T A R E K A . T U T U N J I
R E V E R S E E N G I N E E R I N G
P H I L A D E L P H I A U N I V E R S I T Y , J O R D A N
2 0 1 5
Reverse Engineering: Electronics Rev II
![Page 2: Reverse Engineering: Electronics Rev II - Philadelphia University · 2015. 12. 24. · Product Teardowns. Identifythe product, package, internal boards, sub- systems, and components](https://reader035.vdocuments.site/reader035/viewer/2022081621/611e5c5cc2b38a3b282f8cd8/html5/thumbnails/2.jpg)
Reference
www.chipworks.com
www.electronicdesign.com
State-of-the-Art in Semiconductor RE at Chipworks by Randy Torrence and Dick James 2009
![Page 3: Reverse Engineering: Electronics Rev II - Philadelphia University · 2015. 12. 24. · Product Teardowns. Identifythe product, package, internal boards, sub- systems, and components](https://reader035.vdocuments.site/reader035/viewer/2022081621/611e5c5cc2b38a3b282f8cd8/html5/thumbnails/3.jpg)
Electronics RE
Electronics Reverse engineering can be divided into: Product tear-downs—What chips are used for? Identify the product, package, internal boards, and components.
System level analysis—How chips are used? Analyze operations, signal paths, and interconnections.
Process analysis—How chips are built? Examine the structure and materials to see how it is manufactured
and what it is made of. Circuit extraction—How chips work? De-layer to transistor level, then extract interconnections and
components to create schematics.
![Page 4: Reverse Engineering: Electronics Rev II - Philadelphia University · 2015. 12. 24. · Product Teardowns. Identifythe product, package, internal boards, sub- systems, and components](https://reader035.vdocuments.site/reader035/viewer/2022081621/611e5c5cc2b38a3b282f8cd8/html5/thumbnails/4.jpg)
Product Teardowns
Identify the product, package, internal boards, sub-systems, and components .
The simplest type of RE in electronics.
The device is dissembled, the boards and sub-assemblies photographed, and a description of the components is noted.
Result includes bill of materials and tentative costing for the manufacture.
![Page 5: Reverse Engineering: Electronics Rev II - Philadelphia University · 2015. 12. 24. · Product Teardowns. Identifythe product, package, internal boards, sub- systems, and components](https://reader035.vdocuments.site/reader035/viewer/2022081621/611e5c5cc2b38a3b282f8cd8/html5/thumbnails/5.jpg)
Product Teardowns Example
Panasonic-made NTT FOMA mobile phone partly torn down to expose the smaller LCD display and the camera sub-unit.
![Page 6: Reverse Engineering: Electronics Rev II - Philadelphia University · 2015. 12. 24. · Product Teardowns. Identifythe product, package, internal boards, sub- systems, and components](https://reader035.vdocuments.site/reader035/viewer/2022081621/611e5c5cc2b38a3b282f8cd8/html5/thumbnails/6.jpg)
Product Teardown: iPhone Example
Reference: Chipworks
![Page 7: Reverse Engineering: Electronics Rev II - Philadelphia University · 2015. 12. 24. · Product Teardowns. Identifythe product, package, internal boards, sub- systems, and components](https://reader035.vdocuments.site/reader035/viewer/2022081621/611e5c5cc2b38a3b282f8cd8/html5/thumbnails/7.jpg)
Product Teardown: iPhone
Reference: Chipworks
![Page 8: Reverse Engineering: Electronics Rev II - Philadelphia University · 2015. 12. 24. · Product Teardowns. Identifythe product, package, internal boards, sub- systems, and components](https://reader035.vdocuments.site/reader035/viewer/2022081621/611e5c5cc2b38a3b282f8cd8/html5/thumbnails/8.jpg)
System Level Analysis
Hardware analysis
Reverse-engineering at the physical circuit or board level
Functional analysis using test stimulus and monitoring outputs and internal signals
Software analysis
Software reverse engineering involves extraction and reconstruction of embedded code
Software functional analysis
![Page 9: Reverse Engineering: Electronics Rev II - Philadelphia University · 2015. 12. 24. · Product Teardowns. Identifythe product, package, internal boards, sub- systems, and components](https://reader035.vdocuments.site/reader035/viewer/2022081621/611e5c5cc2b38a3b282f8cd8/html5/thumbnails/9.jpg)
System Level Analysis
Analyze operations, signal paths, and interconnections .
Can be very complex, depending on what degree of analysis is required.
Example : Digital camera How it works?
Get one dismembered but functioning camera, and connected probes between the interfaces and a logic analyzer.
Study the device's timing.
![Page 10: Reverse Engineering: Electronics Rev II - Philadelphia University · 2015. 12. 24. · Product Teardowns. Identifythe product, package, internal boards, sub- systems, and components](https://reader035.vdocuments.site/reader035/viewer/2022081621/611e5c5cc2b38a3b282f8cd8/html5/thumbnails/10.jpg)
System Level Analysis: Hardware
Figure shows the sequence of events followed to examine the camera's functions.
![Page 11: Reverse Engineering: Electronics Rev II - Philadelphia University · 2015. 12. 24. · Product Teardowns. Identifythe product, package, internal boards, sub- systems, and components](https://reader035.vdocuments.site/reader035/viewer/2022081621/611e5c5cc2b38a3b282f8cd8/html5/thumbnails/11.jpg)
System Level Analysis: Software
Reference: Chipworks
![Page 12: Reverse Engineering: Electronics Rev II - Philadelphia University · 2015. 12. 24. · Product Teardowns. Identifythe product, package, internal boards, sub- systems, and components](https://reader035.vdocuments.site/reader035/viewer/2022081621/611e5c5cc2b38a3b282f8cd8/html5/thumbnails/12.jpg)
Process Analysis
Examine the structure and materials to see how it is manufactured and what it is made of.
Use micro-analytical tools.
Every wafer fab has a range of equipment for process control and failure analysis.
Example: Cellphone
The CMOS image sensor in the camera. Removed the camera module from the device and took it apart, recording the details until we ended up with the CMOS imager die.
![Page 13: Reverse Engineering: Electronics Rev II - Philadelphia University · 2015. 12. 24. · Product Teardowns. Identifythe product, package, internal boards, sub- systems, and components](https://reader035.vdocuments.site/reader035/viewer/2022081621/611e5c5cc2b38a3b282f8cd8/html5/thumbnails/13.jpg)
Process Analysis
![Page 14: Reverse Engineering: Electronics Rev II - Philadelphia University · 2015. 12. 24. · Product Teardowns. Identifythe product, package, internal boards, sub- systems, and components](https://reader035.vdocuments.site/reader035/viewer/2022081621/611e5c5cc2b38a3b282f8cd8/html5/thumbnails/14.jpg)
Process Analysis
Analyze the chip using a leading-edge sensor, with a small pixel size of 2.85 x 2.85 µm, so the emphasis was on a detailed examination of the pixel.
TEM (transmission electron microscopy) looks through the sample to give high resolution images of the device structure
SCM (scanning capacitance microscopy) is a way of seeing the positive and negative doping that makes up the actual working transistors, resistors, and so on in the silicon chip
![Page 15: Reverse Engineering: Electronics Rev II - Philadelphia University · 2015. 12. 24. · Product Teardowns. Identifythe product, package, internal boards, sub- systems, and components](https://reader035.vdocuments.site/reader035/viewer/2022081621/611e5c5cc2b38a3b282f8cd8/html5/thumbnails/15.jpg)
Process Analysis
![Page 16: Reverse Engineering: Electronics Rev II - Philadelphia University · 2015. 12. 24. · Product Teardowns. Identifythe product, package, internal boards, sub- systems, and components](https://reader035.vdocuments.site/reader035/viewer/2022081621/611e5c5cc2b38a3b282f8cd8/html5/thumbnails/16.jpg)
Process Analysis Example
Reference: Chipworks
![Page 17: Reverse Engineering: Electronics Rev II - Philadelphia University · 2015. 12. 24. · Product Teardowns. Identifythe product, package, internal boards, sub- systems, and components](https://reader035.vdocuments.site/reader035/viewer/2022081621/611e5c5cc2b38a3b282f8cd8/html5/thumbnails/17.jpg)
Process Analysis Example
![Page 18: Reverse Engineering: Electronics Rev II - Philadelphia University · 2015. 12. 24. · Product Teardowns. Identifythe product, package, internal boards, sub- systems, and components](https://reader035.vdocuments.site/reader035/viewer/2022081621/611e5c5cc2b38a3b282f8cd8/html5/thumbnails/18.jpg)
Circuit Extraction
De-layer to transistor level, then extract interconnections and components to create schematics
Circuit extraction of semiconductor chips has become very difficult as device dimensions shrink. Today we have 50-nm transistor gate lengths, way beyond the
resolution of optical microscopes, and we use electron microscopes just to see the transistors.
This has made RE of semiconductor circuitry a specialized business.
![Page 19: Reverse Engineering: Electronics Rev II - Philadelphia University · 2015. 12. 24. · Product Teardowns. Identifythe product, package, internal boards, sub- systems, and components](https://reader035.vdocuments.site/reader035/viewer/2022081621/611e5c5cc2b38a3b282f8cd8/html5/thumbnails/19.jpg)
Circuit Extraction
Dedicated SEM (scanning electron microscope) are used to image the different layers
Specially developed software is used to
Stitch the thousands of images from each layer together with minimal spatial error.
Synchronize the multiple layers so there is no misalignment between layers.
Full circuit extraction means taking note of all
transistors, all contacts/vias between levels, and all interconnects at each level, and then condensing them to a schematic readable by a design engineer.
![Page 20: Reverse Engineering: Electronics Rev II - Philadelphia University · 2015. 12. 24. · Product Teardowns. Identifythe product, package, internal boards, sub- systems, and components](https://reader035.vdocuments.site/reader035/viewer/2022081621/611e5c5cc2b38a3b282f8cd8/html5/thumbnails/20.jpg)
Circuit Extraction
Typically a block of circuitry is extracted at a time, and cross-reference the blocks so that the full schematic is available.
Not a quick or easy task, but sometimes necessary.
![Page 21: Reverse Engineering: Electronics Rev II - Philadelphia University · 2015. 12. 24. · Product Teardowns. Identifythe product, package, internal boards, sub- systems, and components](https://reader035.vdocuments.site/reader035/viewer/2022081621/611e5c5cc2b38a3b282f8cd8/html5/thumbnails/21.jpg)
Circuit Extraction
SEM images from the polysilicon transistor layer, and the first and second metal levels of a device, with a couple of interconnects marked up for illustration.
![Page 22: Reverse Engineering: Electronics Rev II - Philadelphia University · 2015. 12. 24. · Product Teardowns. Identifythe product, package, internal boards, sub- systems, and components](https://reader035.vdocuments.site/reader035/viewer/2022081621/611e5c5cc2b38a3b282f8cd8/html5/thumbnails/22.jpg)
Circuit Flow RE
Reference: Chipworks
![Page 23: Reverse Engineering: Electronics Rev II - Philadelphia University · 2015. 12. 24. · Product Teardowns. Identifythe product, package, internal boards, sub- systems, and components](https://reader035.vdocuments.site/reader035/viewer/2022081621/611e5c5cc2b38a3b282f8cd8/html5/thumbnails/23.jpg)
Circuit Flow RE
Reference: Chipworks
![Page 24: Reverse Engineering: Electronics Rev II - Philadelphia University · 2015. 12. 24. · Product Teardowns. Identifythe product, package, internal boards, sub- systems, and components](https://reader035.vdocuments.site/reader035/viewer/2022081621/611e5c5cc2b38a3b282f8cd8/html5/thumbnails/24.jpg)
Conclusion
RE of electronic systems is used to identify the components (including their functions and connections) in order to understand and capture the electronic circuit.
RE of electronics involves: Product Teardown, system level analysis, process analysis , and circuit extraction.
RE of modern electronic systems can be very complex and requires advanced tools and equipment.