Post by thread:[EE] Scanning EEPROMs, etc.

Hi folks, That EEPROM recovery thread prompted me to come up with an idea. It may be totally out to lunch, and I am DEFINITELY glossing over a few details, but it's interesting, so I thought I'd see if anybody had some ideas. There MAY be a way to actually do this-- if the cells are large enough and you can get close enough to them-- and as it turns out, the parts required, which probably once required a significant budget, are probably sitting in front of you. What you need is a magneto-resistive device (MRD), and as it turns out probably the best ones you're going to have ready access to are in modern hard disk drives. Seagate has a number of technical articles on magneto- resistive hardware; start there. The 1,000 foot view is this: 1. Lock the part in place. (This is after you've exposed the die, probably using acid to get close and then a polishing wheel to very slowly and carefully remove the rest of the material.) 2. Rig up an apparatus to allow the MRD to move on one axis very fast, but more importantly, at a precisely controlled rate of speed. If you cannot control the speed precisely enough, you will need to use another DAQ channel to monitor some sort of positioning sensor; possibly striped cellophane with an optical sensor like inkjets use. 3. Rig up a second apparatus to rest the first one on that allows very precise positioning along the second axis. 4. Recommended: rig up four charged wires at carefully measured distances from the edge of the chip for alignment and calibration. Secure them in place. 5. Set up amplification and bufferring hardware similar to what a hard drive uses to read the MR head, except that you want to store it in analog, not just convert to digital. 6. For each ROW, fling the drive head over the COLUMNS, and log the stream. 7. Step to the next ROW. 8. Parse the streams in software to try and reconstruct the charge map. The head, which you will effectively be using in reverse, will, with some help, generate a signal as it moves over the charged area on the chip. The use of a magneto-resistive device should localize the area you will see an effect from. The worse it is as localizing it, the higher your sampling rate will have to be, and the more post-processing you will have to do. You're going to want to oversample; in other words, if the width of the charge buckets (or what-have-you) is N, and the width of the die is W, you're going to want to have something like n/4 as your sampling interval, and W/(n/4) as your horizontal resolution. For the column (streaming) axis, this will mean you need a faster data acquisition setup, and you will ALSO need to EITHER make it more sensitive, or move the head faster (but still at a constant rate). For the row-select axis, this means you will need a VERY fine positioning stage. Such stuff does, indeed, exist! Check out the way positioning is done on STMs (scanning-tunnelling microscopes) for one example; another way might just be something as simple as a stepper-driven screw drive with two guide rails. This would also be a really neat way to see power consumption on a working chip! In fact, that's the ONE use of this setup that I'm PRETTY SURE would definitely work. Hmmm, maybe I should try and build this. If I use my own chips, it isn't reverse-engineering-- it's a security exercise to see if my designs will stand up against this technique! Any thoughts? Cheers, Matt -- http://www.piclist.com hint: PICList Posts must start with ONE topic: [PIC]:,[SX]:,[AVR]: ->uP ONLY! [EE]:,[OT]: ->Other [BUY]:,[AD]: ->Ads