Mastodawn

There are three obvious memory array types on the die, with I think the fourth one hiding near the centre. The largest one is likely to be the programmable memory.

They decided to protect the second-largest one with a security mesh. Note the pattern is a very peculiar one; very much like ST with their own mesh type, this must belong to a particular manufacturer. Most certainly I have seen this one before on several occasions, but there is no concrete evidence to pin this one on Samsung or another company.

Would it not be nice to have an image database where one could annotate images by their features such as this...

One more reason I think this is Samsung is due to the design of their I/O pads. Two examples to compare; certainly not an exact match but similarities abound.

Taking a peek at the sea of gates now, it is not immediately apparent whether it will be possible to image them optically with a resolution high enough to know exactly which gate does what. The two metal layers, counted from the top, are used for global routing, orthogonal to each other. The metal-1 layer is again used for local interconnect to form the cells and distribute power in each row.

Joost Rekveld Mar 13

@infosecdj The images that you post are fantastic and it is fascinating what you are doing: do I understand right that you essentially slowly grind/polish large ICs, taking a picture when you have uncovered another layer ?
Is there more to taking the actual pictures than cleaning the surface and setting up a microscope with a camera (please forgive my ignorance, I am just being curious) ?

@joost_rekveld Thank you for your kind words!

The vast majority of the images taken do not involve any deprocessing steps like polishing or lapping, which is why oftentimes all the interesting bits are obscured by upper layers. If the device only has one metal layer, I can deprocess it using chemical means. I started experimenting with mechanical deprocessing recently, you can find a thread on this in my account if you are interested to see how the results look.

There is not much more to it than a) removing the die from the package b) cleaning it up and mounting on a slide c) running the imaging in an automated fashion and d) post-processing the collected tile images into a single panorama image of the whole die. I guess there is also step e) posting about it here. :-) Some imaging runs may go on for more than a day if the sample is particularly large.

Joost Rekveld

@infosecdj thanks for the explanations ! If I can ask some more to understand how it works: how should I imagine "c)" ? Do you have a kind of XY table moving the die under a microscope or macro lens in order to make the panorama ?