Hello and welcome to the #nakeddiefriday again. This one will be a continuation of the previous one with the same exhibit but in more depth. :-)

To remind you, this is the unnamed smartcard IC, which I believe was fabbed by Samsung.

Let's try removing some metal from the top. ๐Ÿงต

#electronics #reverseengineering #smartcard

Interestingly, the thick infill area was way more resistant to the lapping process and the majority of metal-3 remained there, while the rest got stripped off.

There is a lot of analog circuitry on the bottom and right sides of the chip. I am not sure why there is so much and what it does exactly.

A detail view on the analog section; the features on the right seem to be four resistor arrays of the same value, and those on the left are multiple capacitors connected in parallel. I wonder why they decided to make multiple separate parts instead of making a large one of required geometry.
A detail view of the sea of gates. Note the difference in the shade of blue.
The smaller memory array in bottom left is certainly an SRAM block.
Then the array in the middle is actually the mask ROM. That's a lot of code space. Bit density is impressive as well, looks like an implant NAND ROM. 10 poly lines going horizontally, 8 routed from the vertical metal-1 and two from the circuitry in the center, likely enable lines. Looks like a very typical architecture for such memory.
Part of the EEPROM circuitry, looking almost-symmetric.
Finally there is this zone, which I also noted last week. I can't say for sure, but this does look like a PLA.
And there is this pad circuitry. This pad was not bonded out. I am intrigues by the unusual square feature in the upper left quadrant.
Removing most of metal-2, we get a better view on the circuitry. Unfortunately, I am not skilled enough yet to correct the material removal location, so it turns out uneven.
The SRAM now very clearly displays the bit cell structure. Each of the suiggle pairs is in fact two inverters connected in a loop.
The more-or-less same portion of the mask ROM for comparison. Clearly, metal-1 is primarily used for local routing.
This is displayed even more clearly in the sea of gates. Removing metal-2 makes each individual gate stand out. In several cases metal-1 is used for global routing here.
There has been an interesting development in the "PLA" area too. Now a pattern can be seen on the right here. This looks almost like a binary counter.
Looking at the funky pad again, now I can see what this is about. It is a fuse. And it looks not to be blown, which is rather interesting.
The same analog component blocks as before, indeed a set of individual resistors and capacitors.

Finally, there is something that can be classified as human-readable text. I fail to extract any meaning from this.

EDIT: People smarter than myself suggest this may have been LOW_TEMP.

@infosecdj LOW_TEMP?