Sauraen wrote:Eke wrote:Nemesis wrote:I was actually starting up my own "at home" decapping lab, and I've got the fuming nitric acid in the garage which can attest to it
Yeah, basically. The professor told me access to those chemicals was severely restricted due to safety concerns, and I shouldn't even try to get some.
Stef wrote:Haha, when i read this i internally had the same reaction / feeling, crazy guy ! But that is how we progress
Yeah, you need the right balance of crazy and cautious to attempt this I think. Hopefully I've got that balance right
. I actually exaggerate slightly, because technically my nitric acid isn't "fuming" nitric acid, it's reagent grade 70%, and Wikipedia tells me that in order to be classified as "fuming" nitric acid, it needs to be 90%. I still call it fuming though, because call me silly, but my definition of fuming is "gives off fumes", and I can tell you, 70% nitric acid does that plenty well at room temperature thank you very much.
I could of course distill this 70% solution to increase the concentration, but I actually don't see the need. The reactivity of the nitric acid can be increased by raising the temperature. Rather than heating the acid, I got myself an old electric fry pan, and placed a block of offcut marble from a benchtop in it, to give me a good thermal mass and something I could chemically abuse without worry. This is all wired up to a temperature controller to keep a stable temperature, and I then just stick the chip on the marble block to heat it up. I was experimenting with 70-80 degrees celcius. I then use one drop of acid at a time directly on to the chip package. With the chip so hot, it heats the acid on contact and causes a strong reaction, and after a second or two, I flush with a little acetone and repeat. This seems to work well. It's much better to have the slightly less nasty 70% nitric in storage than true fuming nitric too. I still get paranoid about this acid, and check on the bottles from time to time, just in case. They're stored in an old, thick wooden cabinet at ground level, with a magnetic lock that can only be opened by placing a magnet at the right magic place on the front door. The acid bottles are in tern surrounded by several large plastic containers of deionized water, with the theory that if it somehow escapes and starts eating away at anything, the plastic bottles will break and flood the area, diluting the acid to a harmless concentration.
I'm actually not just using nitric acid through, I'm using a nitric+sulpheric acid mix. I came across a paper that talked about mixing sulpheric acid with nitric acid, to create a "buffer" which should apparently protect the metal layer, for the first few seconds of contact anyway, which I want to do at least for the initial decapping, so I'm trying a mix of 3 parts nitric (70%) to 1 part sulpheric (98%). The original paper called for 2 parts nitric to 1 part sulpheric, but they were using fuming nitric, so I've adjusted the quantities. Still yet to verify the results.
Finding nitric acid was hard though, and laws vary between countries. I live in Australia, and while it's not illegal to buy or possess nitric acid in high concentrations, it's still tough to find any companies which will supply it retail to an individual, and just as tough to ship it. With how good it is at building things that go boom, and how hazardous it is to transport and store, this isn't surprising. I found a single supplier in the country where I could get it, and had it personally couriered to my door by a chemical courier company. I'm probably on some kind of terrorist watchlist now after making the purchase, but so be it. Fortunately the prices weren't too bad. In the end, this was the smallest cost though, the cash starts adding up quick when you realize all the other equipment you need in order to, you know, not die. Storing this mix is a real pain. Nitric+sulpheric acid reacts with just about everything. A lot of standard lab equipment, and basically all the standard lab safety gear, can't handle this kind of acid. You can't use any plastic, it's glassware throughout, and the fact it fumes means you can't keep it in anything with a rubber dropper or the like very long, because it'll rise up and start eating it. Made that mistake with my first attempt. Came back in the shed and found it had eaten its way out of my vials and started stripping the paint off the workbench. Makes very good paintstripper. For storage, you're basically limited to glass and teflon. Protective gear also needs to be neoprene. And then there's the fumes. That's the last barrier I had to properly address. I could mix the acids safely enough in open air, but when it comes to the actual decapping, the fumes are simply to hazardous, even with my kit that makes me look like I walked off the set of breaking bad. The vapour from this stuff can turn your lungs to soup, and outdoors is simply too uncontrolled an environment to work in for long.
I ended up getting an old industrial fume cabinet off ebay for $1, just needed to set it up in an area and have another go. Haven't had a chance to get back to it since then though, and right now my garage is full of parts from my truck, the engine for which I'm rebuilding, so that's the project that needs to be finished first before I get back to this again. Still, I managed to get about halfway to the die of the chip I was testing on last time before I had to stop due to the fumes, and that only took a minute or so, so I'm hopeful with the fume cabinet, I can decap chips quickly and easily. Then it'd be on to the photography issue. I've picked up a really high-end Nikon 20x Plan microscope objective (
http://www.nikoninstruments.com/index.p ... -VC-Series), and under tests with an adapter for a telephoto lens on a digital camera, I believe it will work well. I was inspired by examples I've seen of this online, such as here:
http://www.photomacrography.net/forum/v ... php?t=9664. I still need to pick up the actual camera I'm planning to use (waiting on the right price), but with the complete setup, I should be able to capture 18 megapixel (or whatever the camera I get supports) pictures at 20x zoom, which based on research, I believe will be enough detail. My lighting solution should work, and I've got an X/Y table thingy from an old microscope to address the stability issue for taking the pictures, which is critical, because the focal depth of a microscope objective is insanely small. Apart from the camera, I'm pretty sure I have everything now to make this work, just need the time to work on it again.
Sauraen wrote:We'll see how the laser method goes. Let me see how it goes with this chip before you get too excited about future ones! But if all goes well, that won't be a year of work; the laser should be quick, and the photography shouldn't be that bad. If some of these chips are in unusual packages, what would help to maximize the chances of success would be if you could also send a random different chip that happens to be in the same package--that way we would get two chances to get the laser depth right.
Cool, can't wait to hear how it goes! My backyard setup would be handy for the long term, and hell it's just plain fun to try, but I have a feeling you'll be able to turn around a result quicker than I'll be able to get my rig up and running, especially with how little time I've had this last year.
Keep in mind that reading this logic takes a long time, and reading ROMs isn't terribly easy either, depending on the photo quality and lighting as well as the chip process.
Yep, no illusions about that, but even without much analysis, some things can be determined very quickly that otherwise are very hard to know. IE, is that unused pin actually connected to something internally? What might those "test" lines be wired up to? Longer term, it also serves as an indisputable, absolute reference on what's really inside a chip. After research, like the kind you're doing, we can know for certain what the internal operation of the chip is. Combining decap analysis with physical system tests, everything should be possible to reveal. The problem with system tests alone is you've still essentially got a black box, so you don't know for sure if you're missing something. Decapping can highlight things that have been missed in system testing. Into the future, a delayered die-shot will be the most important resource for emulating old hardware. Things need to start with logical documentation, either official or reverse engineered, but they can't truly be completed for any reasonably complex chip without decapping IMO.