Exact match. Not showing close matches.
'[EE] Scanning EEPROMs, etc.'
That EEPROM recovery thread prompted me to come up with an idea. It may
be totally out to lunch, and I am DEFINITELY glossing over a few details,
but it's interesting, so I thought I'd see if anybody had some ideas.
There MAY be a way to actually do this-- if the cells are large enough and
you can get close enough to them-- and as it turns out, the parts required,
which probably once required a significant budget, are probably sitting in
front of you.
What you need is a magneto-resistive device (MRD), and as it turns out
probably the best ones you're going to have ready access to are in modern
hard disk drives. Seagate has a number of technical articles on magneto-
resistive hardware; start there.
The 1,000 foot view is this:
1. Lock the part in place. (This is after you've exposed the die, probably
using acid to get close and then a polishing wheel to very slowly and
carefully remove the rest of the material.)
2. Rig up an apparatus to allow the MRD to move on one axis very fast, but
more importantly, at a precisely controlled rate of speed. If you cannot
control the speed precisely enough, you will need to use another DAQ channel
to monitor some sort of positioning sensor; possibly striped cellophane with
an optical sensor like inkjets use.
3. Rig up a second apparatus to rest the first one on that allows very precise
positioning along the second axis.
4. Recommended: rig up four charged wires at carefully measured distances from
the edge of the chip for alignment and calibration. Secure them in place.
5. Set up amplification and bufferring hardware similar to what a hard drive
uses to read the MR head, except that you want to store it in analog, not
just convert to digital.
6. For each ROW, fling the drive head over the COLUMNS, and log the stream.
7. Step to the next ROW.
8. Parse the streams in software to try and reconstruct the charge map.
The head, which you will effectively be using in reverse, will, with some help,
generate a signal as it moves over the charged area on the chip. The use of a
magneto-resistive device should localize the area you will see an effect from.
The worse it is as localizing it, the higher your sampling rate will have to be,
and the more post-processing you will have to do.
You're going to want to oversample; in other words, if the width of the charge
buckets (or what-have-you) is N, and the width of the die is W, you're going to
want to have something like n/4 as your sampling interval, and W/(n/4) as your
horizontal resolution. For the column (streaming) axis, this will mean you
need a faster data acquisition setup, and you will ALSO need to EITHER make it
more sensitive, or move the head faster (but still at a constant rate). For
the row-select axis, this means you will need a VERY fine positioning stage.
Such stuff does, indeed, exist! Check out the way positioning is done on STMs
(scanning-tunnelling microscopes) for one example; another way might just be
something as simple as a stepper-driven screw drive with two guide rails.
This would also be a really neat way to see power consumption on a working
chip! In fact, that's the ONE use of this setup that I'm PRETTY SURE would
Hmmm, maybe I should try and build this. If I use my own chips, it isn't
reverse-engineering-- it's a security exercise to see if my designs will
stand up against this technique!
http://www.piclist.com hint: PICList Posts must start with ONE topic:
[PIC]:,[SX]:,[AVR]: ->uP ONLY! [EE]:,[OT]: ->Other [BUY]:,[AD]: ->Ads
More... (looser matching)
- Last day of these posts
- In 2002
, 2003 only
- New search...