Hello, wonderful people. Taking a break is good, so I am taking a couple moments to write the #nakeddiefriday post of the week.

Today we have this interesting sample. Yes, it has certainly seen better days; been sitting in a queue for a real while now. This is again a smartcard chip without a name to it. I believe this to be fabbed by Samsung, and be rather old. The chip is built using poly-gate CMOS with 3 metal layers; later processes moved to a higher layer count.

#electronics #smartcards #reverseengineering

There are three obvious memory array types on the die, with I think the fourth one hiding near the centre. The largest one is likely to be the programmable memory.

They decided to protect the second-largest one with a security mesh. Note the pattern is a very peculiar one; very much like ST with their own mesh type, this must belong to a particular manufacturer. Most certainly I have seen this one before on several occasions, but there is no concrete evidence to pin this one on Samsung or another company.

Would it not be nice to have an image database where one could annotate images by their features such as this...

One more reason I think this is Samsung is due to the design of their I/O pads. Two examples to compare; certainly not an exact match but similarities abound.
Taking a peek at the sea of gates now, it is not immediately apparent whether it will be possible to image them optically with a resolution high enough to know exactly which gate does what. The two metal layers, counted from the top, are used for global routing, orthogonal to each other. The metal-1 layer is again used for local interconnect to form the cells and distribute power in each row.
One more interesting feature of the die is this. Two blocks of 10x4 on top metal with no visible connections to anything else. It is very tempting to interpret this pattern as binary. What does it mean? I have no idea. I can only make a guess this identifies the design. If anyone has any information on this, please let me know.

All in all, this looks like a good candidate for deprocessing. I hope not to lose this sample like the others, as it's the only one I have at this moment.

Related, there is one more mystery here, which concerns the damage done to the metal layers of this die. Here I can clearly see the intact metal3 in the power distribution routing in the bottom left corner of the snippet, which is bright yellow like elsewhere on the die. This then transitions to green, the abrupt transition typically means the metal there was etched away by something -- probably the remains of whatever I used to decap this. Going up further though, I see green turning into pale yellow colour, very similar to metal2. The other snippet also shows a similar story, with metal3 being removed leaving some green residue, which is also removed afterwards leaving transparent oxide with some junk inside.

I would so, so much like to know a) what is this green lining? some kind of nitride? and b) what reaction caused it to be stripped. This could be so much useful in deprocessing.

With that, I think I will wrap it for this time. Thank you for following along, I hope you enjoyed exploring this creation.

As always, I am happy to accept any donations to #nakeddiefriday whether in samples or in cash to mitigate the supplies costs. Please get in touch if you want to support my work.

I wish you a nice and calm end of the week. See you next Friday!

SRAM tapestry fanpersons go wild!

And how's your Sunday going?

Garden eels.
@infosecdj Maybe they can hang out with the snakes on my Nortel clock-recovery chip
@infosecdj The images that you post are fantastic and it is fascinating what you are doing: do I understand right that you essentially slowly grind/polish large ICs, taking a picture when you have uncovered another layer ?
Is there more to taking the actual pictures than cleaning the surface and setting up a microscope with a camera (please forgive my ignorance, I am just being curious) ?

@joost_rekveld Thank you for your kind words!

The vast majority of the images taken do not involve any deprocessing steps like polishing or lapping, which is why oftentimes all the interesting bits are obscured by upper layers. If the device only has one metal layer, I can deprocess it using chemical means. I started experimenting with mechanical deprocessing recently, you can find a thread on this in my account if you are interested to see how the results look.

There is not much more to it than a) removing the die from the package b) cleaning it up and mounting on a slide c) running the imaging in an automated fashion and d) post-processing the collected tile images into a single panorama image of the whole die. I guess there is also step e) posting about it here. :-) Some imaging runs may go on for more than a day if the sample is particularly large.

@infosecdj thanks for the explanations ! If I can ask some more to understand how it works: how should I imagine "c)" ? Do you have a kind of XY table moving the die under a microscope or macro lens in order to make the panorama ?
@joost_rekveld Yep, the stage is fully motorized to allow programmatic control over XY. The microscope itself grew a motor for Z.