Great.
Thank you all for coming out today.
My name is Aaron Wasserman, and today we're going to be talking about decapping integrated circuits at home.
So this is a process, uh, where my methodology involves lasers and acid.
So, uh, should be a fun time here today.
Really quick introduction slide, uh, Nick gave me this idea to just do a little photo montage of stuff I like.
Uh, so in addition to, you know, the standard boilerplate senior security engineer at Praetorian on the IOT practice, uh, I also love astrophotography.
Uh, so if you like telescopes or space at all, I would love to chat about that.
Uh, and then modifying cars.
I'm always happy to chat about cars as well.
So, uh, hit me up if you have, uh, any shared interests.
Uh, another plug, uh, is for training.
Uh, if anyone saw a great talk earlier on electromagnetic fault injection from Will McArdle, uh, he and I, along with two other coworkers, uh, will be, uh, providing, uh, training at HackspaceCon this May, uh, and DEFCON, uh, later this summer.
So if you're interested in learning IOT and hardware hacking, uh, come hang out with us.
Uh, so quick show of hands in the crowd.
Who in here has taken apart an electronic device out of curiosity for how it works?
Awesome.
Follow up.
Who here got it back together successfully?
I see a couple hands that did not go back up.
So that is, that is the normal experience.
Awesome.
So if you did get one opened up, you probably saw all these little black chips around the board, and you might or may not have known, uh, what they did.
Uh, but these chips are also called integrated circuits or ICs.
So if you hear me say ICs, integrated circuits, or chips at all throughout this presentation, I'm talking about the same thing, and it's these little black chips on the board.
Uh, so talking a little bit about the structure of ICs and how they're packaged, uh, is going to be important before we start removing the packaging in decapsulation.
So there's a couple different common packages.
I have a few of them shown on screen here.
The actual ones we're going to be working on, uh, for this project were QFPs and SOPs.
Uh, but for the example, I'm actually going to use a cross section of one of these DIP packages, the dual inline packages.
So these are standard external form factors, but on the inside, there's a silicon die.
The silicon die is actually where all the magic of the circuit happens.
So this is where you're going to build up your microcontroller or whatever structure the device is, uh, internally at the silicon level.
Now, if you've seen some greeting cards or things of that nature, they might take that die, slap it right on with some bond wires, epoxy it down, and call it a day.
But more commonly, you're going to see those dies packaged up, uh, into one of these integrated circuit packages.
That die is mounted, uh, kind of on a, uh, lead frame on the inside of the chip.
Uh, the bond wires are what connect from the silicon die to those pins on the outside of the package.
And the whole thing is encased in a hard, uh, epoxy resin.
That's that black resin you're seeing on the outside.
So the process of decapsulation or decapping, uh, is removing that epoxy so you can get access to that silicon die inside.
And one of the big challenges here, uh, is going to be not ruining the functionality of the chip and not breaking the bond wires.
So jumping ahead here, this is what it looks like when you have a chip successfully decapped, at least for the experiments I was running.
So we can see we have that chip, uh, the black epoxy has been eaten away in the middle towards that silicon die, uh, but all of those tiny, uh, copper-looking bra, uh, um, bond wires on the inside are still intact.
Uh, I mentioned breaking bond wires and keeping those intact.
That is a very difficult part of this process.
These are very, very teeny tiny, uh, and when they break, you lose your connection from that die to the external pins that are actually human scale, uh, for you to connect to.
So you need to keep those intact for the chip to remain functional.
The other problem is if you're too aggressive with your methods, you can damage the die in other ways, in which case it will also not talk to you.
So I mentioned that this is super small.
Uh, this is one of those decap chips next to a penny, uh, and if you can barely make out those tiny bond wires, they are very, very small, very fragile, and very to eat, uh, very easy to eat away with acid.
Uh, so that's kind of the challenge we're up against here with decapping these chips at home.
Now, taking a step all the way back, why are we even doing this in the first place?
Sure, we could go get some cool pictures of the dies if that's all we're interested in, uh, but there are some other uses for decapping chips.
Uh, now the industry actually does this, uh, not even just security research.
So there's failure analysis and verification labs.
So if you're doing a run of ICs for your company, maybe you have some proprietary, uh, application-specific IC you're running, and you start to have problems with the early batches, uh, you have to open these up to try to see, uh, what the failure states are.
Uh, so there are labs that can do this for you, uh, also for anti-counterfeit.
If you're sourcing chips and you want to make sure that they are, you know, genuine Texas Instruments processors instead of a knockoff, uh, this can also help with that process.
Uh, and then also for reverse engineering of competitor products, uh, or otherwise.
Security research have that same, uh, shared goal of reverse engineering, uh, but there's another couple cool ones that are out there.
So in the chips I've showed you so far, uh, there's only a single die, but this isn't always the case.
Some ICs can actually have multiple silicon dies inside them, uh, that are only connected on the inside of those chips.
So those interconnects never get broken out to the pins on the outside of the package.
Now if you're a device manufacturer, you're probably thinking, hey, nobody's opening our chip at the silicon level to intercept these signals.
We don't have to worry if the data on those lines is encrypted or not.
That is an assumption you could make.
Uh, for most attackers, I think that's a pretty safe assumption.
But if you are someone that is really worried about very advanced, highly motivated reverse engineering attempts or nation state actors, maybe you reconsider a little bit, because if you could decap a chip to a point where you could measure those interconnects,
maybe you can sniff off some sensitive secrets.
And then finally, the one that motivated my portion of this talk is invasive attack techniques.
So again, if anyone caught Will's talk on electromagnetic fault injection, he also mentioned there are some other ones like laser or otherwise optical fault injection techniques.
And as you might imagine, if you're trying to hit the silicon with a laser or other source of light, you need to decap it first so it's accessible and that epoxy isn't in the way.
So this is actually the attack that motivated me to begin this project, the paparazzi attack.
So this is an attack targeting the JTAG fuse in MSP430 microcontrollers.
So if you're familiar with JTAG, it's a debugging interface.
It can be used for, you know, a lot of wreaking havoc on chips and taking them over completely.
But one of the functions you can do as well is dumping the internal firmware if it's stored in the internal flash memory.
So with the Texas Instruments MSP430 microcontrollers, they have a solution for locking out JTAG once they've been programmed at the factory.
And that is by blowing a tiny fuse that's actually on the die itself.
Now, when the chip boots up, it will try to pass a current through that fuse and measure if it sees a response.
If it doesn't, it knows the fuse is blown and it doesn't enable JTAG.
If it does see a return, it knows that JTAG is enabled and it will let you talk to it.
So if we can trip up that fuse check operation, we might be able to re-enable JTAG on a locked chip.
But again, this is a physical fuse on the board.
So in order to interact with it at all, we have to start by decapping the chip.
So that's where decapping comes in in this process.
There's a really great set of talks from Braden Thomas at Black Hat and Echo Party, I have them linked later on, where he documents doing this process.
But essentially, you run a really tight loop of checking the fuse, and when that's happening, you hit it with a camera flash, literally just a digital camera flash, and those photons are able to induce enough current that it looks like the fuse isn't blown.
It's a fascinating attack.
I think it was originally described by Travis Goodspeed.
He also has a fantastic book called Microcontroller Exploits, where this is described.
I highly recommend that one for anyone who's interested in these type of attacks.
There's some other famous ones, blog posts, that come up using decapping, and one of them is Bunny's Pick Hack.
So this targets configuration fuse in a pick microcontroller, and these fuses can prevent reading back or modifying certain regions in the memory.
But flash devices can usually also be erased by UV light, as described in this blog post.
So if we can get a UV light to shine just on the regions where those fuses are, we might be able to clear those and then read out protected regions of memory.
So that's where decapping comes in, because again, we need to get to that silicon die in order to perform this attack.
So by tipping the chip at an angle in an EEPROM eraser, as you see there, he describes how you can bounce the UV light off of the shield that's supposed to cover you from hitting these, and actually erase those fuses.
So another fascinating attack, a really great blog post to go read, highly recommend it.
But this is another case where you might want to decap chips yourself if you're trying to reproduce this.
And then also for more general laser fault injection.
If you've heard about fault injection techniques, it seems like everyone says, hey, these are nation-state capabilities, very expensive, nobody's actually going to do this.
And then slowly over time, the capabilities get cheaper, more training comes out, more blog posts come out, and the cost comes down.
That happened with voltage fault injection, with tools like the Chip Whisperer, we're seeing it happening with electromagnetic fault injection, with the Chip Shouter, Faulty Cat, et cetera.
And it's starting to happen with laser fault injection.
So in the last year or so, there have been two really great projects open sourced, one from Fractal and one from NetSpy, both talking about how you can build low-cost laser fault injection solutions and bypass some real controls.
So these are also excellent.
Some of these techniques, you actually don't have to decap the chip in the way I'm doing, you can decap it from the back and actually shoot the lasers through the silicon.
That's a little bit outside of the scope of what we're talking about here, but if you are trying to decap it from the top like we were, where the bond wires are, that's what my methodology here today is going to describe.
So I've talked about doing this DIY, did I consider having one of these professional failure analysis shops do this for me?
Yes.
The problem was, it's very expensive.
If you want to get their equipment, it's very expensive, and if you want them to do it for you, it's also very expensive and they promise pretty low yield rates.
So I talked to a couple shops, and for a small batch from an individual, the best quote I got was $4,000 to decap 10 chips, and they were only guaranteeing that 50% of them would come back functional.
So that was a little outside of what I could do.
Yes?
Oh, we're getting a question?
Okay, no worries.
So if I wanted to buy these machines myself, there's a couple things you can do.
Usually these processes start with some sort of laser ablative process to remove the bulk of the material before swapping over to something like acid deposition to eat the rest of it around the chip.
So there's some very expensive lasers on screen here, that machine in the bottom right is for automated acid deposition and etching, and then the one in the bottom left is an atmospheric plasma needle decapsulation machine.
I don't know about you guys, but I do not have the disposable income for anything that has atmospheric plasma needle in the title.
So that was going to be off the table here.
For some of the DIY methods, people have tried this themselves, again using laser ablation or some type of mechanical removal.
If you're working on a larger package like one of those dip packages, you might be able to do a lot of it with the Dremel.
I do not have steady hands, not a surgeon, so this was not going to work for me.
I've also seen some people strap a rotary tool like a Dremel to a 3D printer and use that as a kind of DIY CNC mill to drill out a pocket.
I didn't want to bring my 3D printer into this, so laser was the route I was looking at.
In the bottom left, you can see a commercial fiber laser.
I have one of these for prototyping printed circuit boards.
They're great for, you know, etching copper traces on a sheet of copper clad board.
So I wanted to try to repurpose that for this.
Following that manual deposition, you have to do some manual acid deposition.
You can't laser all the way, and I'll talk about that in a little bit.
So for this, I went with a mixture of acids, and I'll again talk about the reason for that later.
So safety considerations first.
You guys saw acid and lasers in the title.
This was bound to happen at some point.
I, my employer, CypherCon, etc., nobody are liable if you try this yourself, but we are going to talk about some of the safety considerations that you should consider if you're interested in doing this yourself.
So again, do not try this at home with an asterisk.
If you want to do all of your research, establish your own safety procedures that you are comfortable with for your risk tolerance.
I think this is a really fun process, but I might be biased.
You should assume that all of the safety controls I mentioned are inadequate or incomplete.
Assume that there might be risks beyond those I mentioned.
And again, do not attempt this without thoroughly researching all of the processes yourself.
Just to drive this home a little bit more, I'm going to talk briefly about the different tools we'll be using here, tools, compounds, chemicals we'll be using through this process.
So acetone, this one you might be familiar with.
It's in a lot of strong nail polish removers.
Again, it is flammable, not awesome for the skin, but not the worst thing if you have it on and can wash it off briefly.
One note, though, is it is denser than air, so it will pool up if you have the fumes exposed.
So those fumes can pool up on the ground.
You might not notice them until maybe they ignite.
So this is not the most hazardous thing we will be dealing with here, but it is something to consider.
Next up is the fiber laser.
So this is a class 4 laser.
That's the highest the classifications go.
It can burn skin and materials aggressively.
And incident contact.
So if a ray bounces off of something else and then goes into your eye, that can still be enough to permanently blind you.
So these are no joke.
You want to make sure that you have the correct laser safety glasses that are tuned for the wavelength of the laser you're using.
There are also enclosures you can put around the laser that, again, are made of the same material that block out these frequencies.
Very, very important to do.
And then fumes.
When you're cutting through these, you know, epoxy packages, there's some metal, you're going to be releasing some fumes you don't want from that laser as well.
So really don't want to play around with these if you like continuing to see.
Next up is the sulfuric acid.
I mentioned I was doing a mixture of acids.
The first of these was 98% sulfuric acid.
This is pretty high concentration, but I actually wasn't super worried about handling this myself, because in my time at Georgia Tech, at the electronics maker space, I was one of the trainers for a electroplating machine.
And this electroplating machine had vats of this stuff, like by the gallon.
So I was used to the safety protocols for that, the risks, and training others to handle it appropriately.
Very corrosive.
You do not want to breathe in the fumes.
You do not want this on your skin.
So you absolutely need to make sure that your face, especially, is protected from any splashes that might occur, having a full face mask on.
You want to protect your lungs.
A lot of these sulfuric acid side fumes can be removed with respirator cartridges, the pink acid ones.
So wearing that is essential.
And then again, covering your skin, your hands with gloves and a splash gown to make sure that you're not getting this on yourself.
The nitric acid is what I was worried about for this one.
So it's definitely not as bad as hydrofluoric acid if you're doing, again, some more work in this space.
But nitric acid, you can see the health hazard there is level 4, can be lethal.
And with nitric acid, there's a lot of risks you want to worry about.
Now, you'll notice I have 70% here.
The industry professionals, they actually use what's called fuming nitric acid, or red fuming or white fuming nitric acid, which describe the concentration.
So those are all 90 up to 98-ish percent.
Those are very, very concentrated.
There's actually separate safety data sheets for 70%, which is concentrated, versus those fuming nitric acids, because they behave very, very differently.
Fuming nitric acid, if you get it on a standard, like, nitrile glove that you might have, you might think, hey, that's a great way to not get acid on my hands.
When fuming nitric acid contacts a nitrile glove, it spontaneously combusts.
You do not want flaming acid on your hands.
So you need to do all of your research ahead of time to make sure that all of the interactions around you, you know what is going to happen, and you are prepared for those in the worst case.
There's some viton butyl gloves that you can get that are resistant to those higher concentrations.
I got those anyways, even though I was only working with the 70%, because it's always better to be safe than sorry.
This is also a very strong oxidizer, so it will help accelerate reactions.
You might have heard nitric acid used as an oxidizer for rocket fuels.
You might have heard of nitroglycerin, the niter in both of those.
That's the same.
So some serious stuff.
Another note about the fumes here, nitric oxide fumes, so nitrogen oxide and dinitrogen tetroxide, no passive respirator will filter those out.
The only way to completely filter those out with a respirator is having a whole scuba setup where you have your entire air supply.
So the safety data sheet does say that doing this outside is appropriate.
However, how many of you have been at a campfire, a little bonfire , and it seems like no matter where you move, the smoke always follows you around the fire at the mercy of the wind?
I did not want that to happen with these fumes that would dissolve my lungs from the inside out.
And speaking of your lungs, the safety data sheet for nitric acid actually tells you if you ingest it, which side of your body you're supposed to lay down on to make it more difficult for that to get into your lungs.
So if you can't remember fun facts like that from your safety data sheet, you probably want to read them again before continuing.
So again, I hope this is motivating that these are serious things.
Do your research, or just don't do it.
You know, live vicariously through others.
But if you do, make sure you're considering all the risks here.
So at this point, I'm suited up and ready to go in the backyard, drawing lots of attention from the neighbors, and I was ready to begin moving.
One more note I didn't mention about the safety procedures.
Make sure someone knows you're doing this, and they know how to call for help.
Have the safety data sheets physically printed out so they could be tendered to, you know, emergency services if needed.
Hopefully you don't.
Make sure they know to watch you, and don't assume that you'll be able to get yourself help.
Make sure someone is there with you.
Very, very important.
Awesome.
So now that we've talked about the safety, and I've hopefully scared you, but not too much, we're going to go into some of the prior works that I based my methodology on.
So there were two blog posts that were wildly useful in my process.
The first was a blog from Duo Security, talking about, again, invasive analysis to retrieve some firmware.
And then another was from JCJCDev.
So taken individually, I had a lot of problems using these methods for my chips.
But by combining some great elements from each of them, I was able to land on the methodology that worked for me.
So with the JCJCDev, this was the first resource I landed on, and it was very, very similar overall in approach, but it had a few notable problems.
This one used a PAW Dremel to drill the initial pocket.
Again, I have shaky hands.
I could not get an accurate pocket, so I went with the laser instead.
They also used nearly a one-to-one mix of nitric and sulfuric acids, and they remarked that they didn't see any notable differences between using just the 70% nitric or using the etchant mixture.
If I say etchant, I'm referring to the combination of those two acids.
Now, this surprised me, and I think the reason they got away with this is their chips were using gold bond wires, based on the images I saw.
So common bond wire types are especially going to be gold and copper.
The chips I was using were copper, which are attacked pretty aggressively by that nitric acid.
So that was the concern there.
So I think they didn't see a huge difference by using the mix versus just the nitric because their bond wires were gold, but that was not going to work for me.
They also heated the solution to 100 Celsius.
I found that at this temperature, I was losing all of my bond wires in the process, no matter how careful I tried to be.
So I think the heat there was a little high.
I won't cover exactly their process because, again, you'll hear that through my methodology, but if you want to read through their blog post, it is excellent.
The link is there.
The Duo blog was another great approach.
This solved a couple of the problem areas I encountered, but also introduced some new ones, as many troubleshooting efforts do.
Repeated problem, they used a Dremel and a 3D printer for the pocket.
As I mentioned, that was not really going to work for me because I didn't want to sacrifice a printer, and I couldn't do it manually, so I used my laser.
It solved a problem because they used a 2 to 1 ratio of the sulfuric acid to the nitric acid, and they didn't use any heat, so the reactions were much slower, but you avoided some of the problems with overdoing it.
But some new problems.
I struggled to get the dissolved epoxy off of the chip with the methods they described, which was submerging it in acetone and spraying it using a syringe to try to be gentle to not mess with those bond wires.
I still found that I was damaging bond wires this way.
It wasn't quite delicate enough, and even with that lack of heat, I found some cases where the reactions seemed to stall, or not even because of the heat, but because of the heat, I found some cases where the reactions seemed to stall, even with fresh etchant.
So I got to a point where I just could not get any more material out of the chip.
So this one also, very, very close to what ended up working, but had a few more problems along the way.
So how can we combine these?
I opted to use my fiber laser for the bulk removal instead of the automated or manual Dremel options, and I used a 2.5 to 1 mixture of the acids.
I'll talk about this a little bit later.
This was largely through experimentation, but I'll explain the purpose of mixing acids soon.
I also lowered the heat from 100 Celsius to 70.
This helped me burn through that issue where the reactions were stalling, but without overdoing it.
And then I used an ultrasonic acetone washing method from JCJCDev.
He described this as an alternative to trying to use the syringes, where you get an ultrasonic cleaner that you might have seen for dentures, Invisalign, jewelry, watches, things of that nature, or even cleaning circuit boards of flux.
So I used one of those with acetone for doing some of that washing.
So here's my methodology after many iterations, but you learn by failing quickly and adapting.
So I've highlighted and underlined some of the key differences from the previous methodologies just to really drive those home, that these were what my experimentation revealed.
So I started off with a laser ablative process to get the bulk of the material gone.
You could do acid from the start if you wanted, but again, since we're not using that fuming nitric acid, we're really worried about these bond wires, we want to reduce the amount of acid etching we have to do and try to get a lot of that material out of the way first.
So I used the laser to get as close as I could with the pocket, but stopped before the bond wires were visible.
Then again, heavily inspired by those other two methods, I used an etching mixture of the two acids and got that the rest of the way down using an ultrasonic acetone bath to remove the dissolved epoxy.
So for the laser process, the first thing I needed to do was figure out where the dye was in the package.
So I had a sacrificial chip here that I lasered all the way down.
Didn't try to stop early, just cooked it right through.
So you can potentially see, I'm not sure how clearly that shows up, some of those pins on the outside of the package, going in towards the dye, you'll notably see no bond wires at all, and you'll see a torched gray blob in the middle.
That was the dye before we lasered everything off of it.
So this is why we can't use the laser alone.
It is just not gentle enough in those final stages to keep the chip functional.
I even found that if I lasered too close to the bond wire, still not visible but too close, some of that energy was still causing the chips to fail.
So even before bringing out the acid, they had already stopped responding to me.
So I tried to find the sweet spot of how much lasering is enough to reduce the acid etching without killing the chips prematurely.
So once I had the depths figured out, I drilled a pocket right above where the dye should be located, again, that's showing the laser.
Don't run the lasers in your home office as I have shown in here.
You should have adequate ventilation for these.
Again, the fumes you're breathing here, not as bad as the acids, but still treat your lungs nicely.
And here's another photo for why not laser all the way.
This is a 555 timer that I had as another sacrificial chip, and again, you can see we just torched that dye in the middle.
So now how do we get these acids?
The sulfuric acid is actually pretty easy to get, and you can find it commonly as a drain cleaner, but if you order from one of these lab supply stores, you can get bottles of what's called semiconductor grade for pretty easy.
For the nitric acid, this was a little more difficult.
You can see the hazmat packaging on the right there labeled.
The hazmat shipping was actually as expensive as the quantity of acid I ordered.
So it is harder to get these, but you can do it.
And again, this is for buying off-of-the-shelf concentrated nitric acid.
If you want to do a DIY method with fuming nitric acid, you can make their own.
I'll talk later about a conference talk showing you how to make your own fuming nitric acid.
There's also some great videos from channels like Nile Red.
But for this, I didn't have the time to do that, and I honestly wanted to use off-the-shelf materials.
So that was one of the big constraints here, was trying to do this using a maximum of 70% concentrated nitric acid.
So why are we mixing them?
I've alluded to this a couple times, but if we're using just the nitric acid, what happens with the reaction as we get some of those gases, the scary gases I was telling you about, we get some water, some copper oxide, and these copper 2 nitrate salts.
Are there any chemists in the room, or anyone who considers themselves good at chemistry?
I saw maybe half of a hand.
That's great.
I am not a chemist either, and half of this is probably wrong.
So do not quote me on these slides.
I've tried to consult with some friends and could not get a definitive answer about the processes here.
But as I understand it with my Chem 101 education, these salts are formed during the reaction, and they actually are not dissolved by the nitric acid.
So as the reaction starts, these salts form almost a protective layer around those bond wires, stopping them from being further eaten.
The problem is that these salts are water soluble.
So that 70% nitric acid means there's 30% that is not nitric acid, and a lot of that is water.
So the problem is you have the cycle where the salts form, protects it shortly, they're dissolved, the acid eats it again, and that cycle repeats.
So by mixing them, the sulfuric acid can help dehydrate the solution of water, dehydrate the water from that 70% acid solution, and try to keep things drier during the reaction.
That might be completely wrong, again, that is as I understand it, but by mixing these acids, I did see some more results.
And again, by using the JCJCDev method with just the nitric acid, I was eating the bond wires away every single time.
For the DIY fume hood setup.
So as I mentioned, the safety data sheet says doing this outside is appropriate.
I wanted to avoid the bonfire issue, so I did outside with something to try to direct the fumes away.
I would not trust this fume hood to be used inside as the sole source of ventilation, but by stacking them on top of each other, I was comfortable enough to proceed.
And you can also see I have all of the other tools laid out here.
Now one of the things that I think is really helpful with a process like this is do a dry run with all of the solvents, all the acids still in their containers.
Practice moving things around when there's no acid ready, so you can see, hey, when I try to move from this container to this one, I'm running into this beaker.
Or hey, this is a really long distance to be bringing this, I'm afraid about dripping it.
And also be conscious of what you're going to be dripping on.
Make sure the materials your acid might drip or spill onto are not going to react aggressively and cause an emergency situation.
So again, earlier when I said understand everything you're working with, this really comes into play.
And also have more than enough sodium bicarbonate baking soda to neutralize all of the acids you're working with.
Have just way more than you need, right?
Plan to spill the entire bottle, neutralize it, and still be ready for another bottle to magically fall out of the void and spill right in front of you.
So what else do we need besides the stuff I previously mentioned?
Well, we need a hot plate to get the whole mixture and the chip up to temperature.
These are some graphite ingot molds.
I was using these to store the chip on the hot plate.
This would help me if the acid spilled, not go mess up my hot plate, but also was a good one for me to get my thermocouples from the bottom left onto so I could monitor the temperatures as it went.
You'll need some standard chemistry glassware, so beakers, flasks, watch glasses to cover your beakers to slow evaporation.
Some tweezers.
I got some plastic tweezers because I didn't want to mess up any of my nice ones.
These worked pretty well.
Also some compressed air for helping to dry the chip between transitions between some of the glasses.
And then finally a cheap ultrasonic cleaner for doing that ultrasonic acetone washing process.
What you should do with these ultrasonic cleaners, which are heated, is not fill them up with a flammable organic-like acetone.
What you can do instead is fill them with water and then submerge a beaker of the acetone into it.
That will give you largely the same effect.
I did not do that, but do as I say, not as I do.
It worked and I did not blow anything up.
So now we're into the procedure.
These are going to be a little bit dense slides, but I'll talk through each of the steps.
So step one, review your safety plan, let someone know you're doing this so they can monitor, and put on all of your PPE.
Then we need to make our acid mixture.
I liked getting this out of the way right away so I could move the large storage bottles of the acid away right away.
So I was only dealing with milliliters instead of the large bottles.
So I mixed 2 milliliters of the 70% nitric acid and 5 milliliters of the 98% sulfuric acid into a small beaker and I covered it with a watch glass.
Again, to try to retain that mixture for as long as possible.
If you try to do a couple chips in a row, you'll find that the acid etchant is less potent.
You'll need to mix up a new one.
This is a key difference from the other methods that I had seen online.
Because again, the JCJC dev used approximately a 1.0 ratio, 1 to 1, and didn't see any effect.
And the DuoBlog used a 1 to 2 ratio.
So I found this 1 to 2.5 was the one that yielded the best results for me.
Again, I heated the hot plate to 70 instead of 100.
Big difference from either 100 or 0.
That was another key one.
And I placed that graphite ingite mold on and added the thermocouple so I could measure it.
Then I placed the chip in the mold.
The chip had already gone through the lasering process.
So this is just the acid etching process.
Uncovered the etchant, and I added just 1 to 2 drops with a pipette into that cavity.
Monitored for about 3 to 5 minutes, you can kind of see when the reaction starts to slow down.
And at that point, you are ready to go to the washing cycle.
If you're nearing completion, let these cycles be a little bit slower.
Again, one of the risks is overcooking it.
You can lose functionality that way.
So then after you've gone through your first acid cycle, the reaction seems to slow down.
You can remove the chip using the plastic tweezers and quench it in the acetone wash tray.
Add the chip to the acetone, not the other way around.
And whenever you're mixing solvents, right, there's the always add acid rule again.
Make sure you're brushed up on your chemistry and safety procedures before you would try any of this.
There's a couple key ways to do this safely.
If you add things in the wrong order, you can cause flash boiling that can splash those everywhere.
And you do not want acid splashing anywhere near you.
Then if the bond wires aren't visible after you rinse it off, use an acetone wash bottle to rinse it pretty abrasively.
Otherwise, if it is visible, that's when that ultrasonic acetone cleaner is a huge difference for getting that material out, getting the dissolved gunk out without being too rough and breaking the bond wires.
If you're done at this point, you can rinse it with distilled water and dry it on the hot plate.
Otherwise, dry it off with compressed air and return to drop some more drops in.
So, that would be jumping back to step four.
So, go to step four and repeat until completed.
So, going through step by step.
This is the first time I saw bond wires visible for this chip.
So, you can see they're just barely poking through.
We start to see a little bit of the dye.
So, we're getting closer.
We're mostly there.
So, at this point, I'm decreasing those cycle times, not letting it react for as long.
And, again, I'm cleaning it pretty thoroughly so I can get an idea of where we're at.
And then, finally, we have the dye poking through.
All the bond wires intact on this one.
And I was very, very happy to see that I was able to get multiple chips talking without killing them.
So, this was a huge win here.
And you get these really nice glamour shots of the light just reflecting off of those dyes.
Really, really cool stuff.
So, now that I had decapped them, it was time again to validate that they're still working.
Now, the first chip I decapped, I was so happy, I brought it back into the lab, I was ready to solder it onto a breakout board so I could start interacting with it.
Start soldering, and the iron slips right into that nice pocket to catch any object and burns all the bond wires.
So, back out, decap another chip, and then come back to make a hot swappable socket so that never happens again.
So, this is the actual reason I own that laser.
I did not buy the laser just for the decapping.
I have this for making custom PCBs quickly at home.
This is not going to be anything near ordering one from JLCPCB or if you have equipment to do it nicely.
Not like that, but if you need a quick and dirty board, it does a pretty good job.
So, this was that original one.
I was soldering them onto these premade SOP2DIP adapter boards.
That was not going to cut it because I had to solder the decap chips onto the board.
So, I used the laser to cut out what I call the butterfly board because the traces on the board kind of look like a butterfly here.
So, I cut those traces in for one of these spring sockets.
So, when you press down on the socket, you can drop the chip in very gently, and when you release some contacts, press down on all of those pins exiting the package.
So, this way you can connect to it temporarily.
You can still get light in through the top.
That was a key.
Some of these sockets are opaque on the top, but this one was open top, and I can break it out to these much larger pins for making all of my connections where I'm not going to harm anything.
There's a really great YouTube video from Stephen Hawes.
He makes the lumen pick and place machine, if you've ever heard of that.
He follows almost exactly my process for prototype PCBs.
So, if you want to learn more about that, highly recommend this YouTube video.
So, finally, after getting my second chip decapped, I put it in this custom jig and tried to run a test script on it.
Again, I was trying that paparazzi attack from earlier.
So, the first thing I needed to do was try to perform an entry sequence, and it did spit back the hex 89, which is what I was expecting, and then check if the fuse was blown.
And it did return all fives, which is what you would expect if the fuse is blown.
So, at this point, I knew the chips were talking to me.
I knew they were decapped.
And that is about where my luck stopped.
So, for reproducing this attack, I had tried for a while.
It was a case where I was seeing faults that weren't the one I was hoping for.
So, when you hit this fault, you try to read a certain region in memory where you know the value.
It would normally return zeros, what the control is in place.
And there's a certain string that if you see it, you know you've bypassed it.
I was seeing all kinds of different random values that were not that value.
So, I was inducing some faults, but not the ones I wanted.
Now, the reason I couldn't just keep trying this is because sometimes you would hit the camera flash, see a big current spike, and then the chip would not wake up anymore.
So, there were some ways where the fault would actually just brick the chip.
And it takes long enough to do the decapping process that I was limited on how many I could work on during this process.
I do plan to pick this up again at some point soon.
But for now, the value in this talk is with that methodology, not actually successfully reproducing the attack.
Some future works.
Maybe I should make fuming nitric acid.
If anyone is familiar with the YouTube channel and reverse engineering community, Richessim, Hash Salahi from Richessim, gave an awesome talk at hardware.io last year.
That's a hardware security conference in Santa Clara, California, about how you can build a silicon analysis toolkit.
So, he talks through making your own fuming nitric acid at home and then also building a system with a variation of a 3D printed microscope for doing imaging of that system, not just under a normal microscope like I use for soldering.
Really excellent talk.
I plan to incorporate a lot of these the next time I'm doing it.
But again, even with some more robust methods like this, they still use that fuming nitric acid.
So, that is something that is still nice about the methodology I described here today, is that you can get away with the 70% nitric acid if you're willing to be careful and have, you know, a couple more failures.
I have the YouTube link there.
Excellent, excellent talk.
These are all of those videos I've been talking about through the process.
So, highly recommend you check these out and check out the sources they mention.
These are nested, you know, a couple layers deep.
But this is a really, really fascinating area of hardware security research.
And again, I think as everything shifts left and as these optical and laser fault injection technologies come down and are more accessible, we're going to see more of this.
So, if you need to decap some chips, again, do your research, be safe, but this might help you do it.
So, I'll pause there for any questions, otherwise I appreciate everyone coming out and listening today.
How do you dispose of your used etching?
That is a fantastic question.
So, I was accumulating it in a waste beaker and then neutralizing that again with some sodium bicarbonate.
There's a couple options.
So, some counties, depending on where you live, will have hazardous waste pickup days where you could give them kind of that sludge you get at the output.
Some cases, the actual official recommendation is to dilute that, you know, five or six times, and then you can flush that down just the sewer system.
But again, definitely check where you live.
I would definitely side towards keeping it as the sludge until you can find someone who can confidently dispose of it over going right for, you know, dumping it down the drain.
Something like just 98% sulfuric acid, again, that's the key ingredient in drain cleaner, so that's designed for it.
But again, with some of these side reactions, you do not want to mess with that.
Also, if you're friends with anyone in university systems or at companies that deal with some of these materials, they often have some good waste disposal processes.
So, you know, maybe you can grease some palms and have someone dispose of the sludge for you, but that is a key one to consider.
JP?
It was a case of a family member helping out.
Praetorian is a remote first company.
There's three of us in Wisconsin, believe it or not, but nobody that was around at that time.
So it was briefing a family member, hey, here's what I'm doing, here's how I'm going to indicate if something is wrong, and here's the procedures we'll follow.
So very quick briefing.
Again, you want to plan for the worst.
I was never expecting that they were going to have to intervene, but you want to have them ready if you do.
Again, plan to spill the whole thing and then have more acid than you even own spill right in front of you.
Make sure you have, you know, an eyewash station, the PPE.
Again, printouts of those materials, right?
SDS sheets vary a little bit.
If you have printed out the exact ones you own, if that, God forbid, needed to be provided to emergency personnel, you have that ready.
So again, it was a family member helping out, but again, that is planning for the worst case.
You should never get there.
Yep, Steven.
Yeah,
so I mentioned that paparazzi attack.
There was also that pick hack using those UV fuses, general laser fault injection, but then there's also some folks who do it for imaging.
So there's some communities like Silicon Prawn, they'll do large, super detailed scans of these silicon dyes.
You can use that for, you know, reverse engineering attempts.
If you can image really clearly like ROM, like read only memory, kind of at that silicon level, there are some tools like one from John McMaster for actually pulling the bits out, automatically extracting the firmware, just having an image of the chip.
Again, really fascinating stuff.
And there's also some easier uses.
So, you know, Will was talking about electromagnetic fault injection.
If you decap a chip and you can see where some of the larger structures are, hey, over here, I see it's nothing interesting, but all of the compute is happening in this corner, you can use that as a side channel almost to help you target where you're injecting for some other styles of attacks.
Nick?
Yeah, absolutely.
So with some of those, they are, again, dispensing very precise concentrations and they're handling all of the acid for you.
So they have pumps that are, you know, pumping these through precise quantities, precise heat, and it's targeted directly on the chip.
They usually have some type of sealing apparatus.
The problem with these is they take so long to set up and tune that even if you wanted to buy one secondhand on eBay, for small batches, it's almost easier to do it manually.
By the time you would, you know, tune all these parameters, get the right temperature settings, you know, it's almost harder than just doing it yourself.
And for the really expensive ones, the ones that are not the acid, but they're that atmospheric plasma needle, that's just a whole different ballgame.
Tens, hundreds of thousands of dollars.
Bad.
Yeah, bad on the wallet.
Yeah, so I didn't tally it up precisely.
The acids I was getting were, you know, again, with the hazmat shipping fees, on the order of, you know, hundreds of dollars.
That DIY fume hood was, you know, plywood from Home Depot and some Lexan sheets.
So again, on the order of hundreds of dollars.
The whole thing, you know, on the order of a couple thousand dollars.
Again, that laser, the fiber laser, that's expensive, but you have other purposes for it.
The actual amount of stuff you're spending that's consumable or for this specifically is not super high.
Cheap glassware set on Amazon you can get, you know, for $60.
So it is much more accessible.
So on the order of thousands of dollars, especially if you have a couple of these things already, not at all tens or hundreds of thousands of dollars.
Awesome.
Will?
Yeah, most of those for 10 ships, they were quoting about one and a half to two and a half weeks, which again was not meeting the timeline I needed.
But again, this was a great learning experience anyways.
But I highly recommend if you have a, you know, reason to do this professionally, an actual need for this, you do consider that if it is in the budget.
Again, it's a great learning experience, very fun to do yourself.
But if you're relying on this for more than kind of passion, might be good to look at those professional methods.
Awesome.
I don't see any more... oh, one more.
Yeah, so I was using a 20 watt fiber laser from a company called Monport.
I think with all of those, they're basically clones from the same factory.
So if you find anything that looks approximately like that, they're probably the same.
Monport is U.S.
based.
So in theory, the customer support should be a little bit better.
Luckily, I haven't had any major problems, but you may want to investigate those.
One more note with all of these laser manufacturers, they sell those enclosure shields, the anti blinding ones as an accessory.
And I don't think they do a great job of describing some of the risks of those sources.
So again, make sure you're past some of those branding materials and protect your eyes first.
Awesome.
Absolutely.
I did this over a span of about two or three weeks.
So it was coinciding with an engagement I was doing for Praetorian.
We had exhausted all of the attack paths that were in scope, but we still had some time left over.
And I had seen these paparazzi attacks recently and knew they applied to the microcontroller we were using.
So I got approval to try this out.
So it was going beyond the normal working hours for some nights and weekends over that three-week period.
But yeah, definitely fit within that three weeks.
Again, really heavy on the research up front, a short lag to get all the hardware and acids in hand.
And then the actual process was just over the course of a weekend for the experimentation.
The laser is going to be too aggressive and it's going to cause some damage to that die or the bond wires.
And the acetone is not going to be able to eat that packaging.
The acids really are what you need to get that epoxy resin packaging broken up so the acetone can help release it.
So if you're just trying to see large internal structures, the laser can help you do that.
But if you're definitely trying to maintain any functionality at all, laser or acetone only would not be viable.
Yep.
So it is standing there waiting about three minutes.
You can take a few steps back, look around, watch the birds.
You don't have to be laser focused staring at it, but generally watch its progress.
You can see how much it's bubbling, gauge the rate of the reaction.
And once that's slowed down, time to rinse and do another batch.
Awesome.
That looks like all the hands for now.
If anything pops up later, find me around the con.
I know we're at the end here, but thank you guys so much for listening and for all the awesome questions.