55

I was interested in a recent interview of Masayuki Uemura, one of the engineers who designed the Nintendo Famicom in the early 80s. During initial design phase of the Famicom, one of the first things he says he did was reverse engineer the video game consoles of the time. This quote from him of this interview caught my interest:

I had a semiconductor manufacturer dissolve the plastic covering on the chips to expose the wiring underneath. I took pictures, blew them up, and looked at the circuitry to understand it.

Exactly what process is he talking about? At a time when ICs were of low complexity (compared today), could you actually see each transistor on the silicon and reverse engineer it?

  • 9
    It certainly jibes with the often-repeated claim that Nintendo copied the 6502 (minus decimal mode) rather than licensing it. – Tommy Jul 8 at 13:37
  • 8
    I read somewhere about engineers leaving microscopic messages etched into the wafer as an "up yours" to the people reserve-engineering the designs. Alas I cannot find a link. – Kingsley Jul 9 at 3:50
  • 12
  • 3
    I’d think that being able to inspect and test a chip and fixing it with Focused Ion Beams (FIB) is actually a critical part of development and manufacturing. Being able to reverse engineer it is just a side effect of those capabilities. – Michael Jul 9 at 8:43
  • 11
    When I worked on ICs for RCA in the early 70s this was certainly possible. In fact, one engineer in the group was known for his ability to alter circuitry in test chips using an X-Acto knife and conductive epoxy. – Hot Licks Jul 9 at 13:08
78

With a powerful enough microscope, you can see each transistor. Reverse-engineering silicon then boils down to carefully removing each layer (ceramic or plastic to expose the chip, then each metal layer), taking detailed photographs, and figuring out what each part does. For CPUs of the era, this was already possible in the early eighties.

Ken Shiriff does this nowadays on older chips; he just posted a detailed example of this process on the Intel 8086. Michael Steil famously reverse-engineered the 6502 nearly ten years ago, and gave a great presentation on the topic at CCC.

| improve this answer | |
49

(More of a memory dump related to Stephens Answer)

At a time when ICs were of low complexity (compared today), could you actually see each transistor on the silicon and reverse engineer it?

Yes.

Just try it yourself. Take some 1980s TTL, like a 7400 - I'm sure you find some on old boards - and crack it open. Usually it separates well from the plastic. Put it below a children's microscope and you will see the structure for each of the four gates. With some basic knowledge about semiconductors, you'll be able to draw the schematics free hand.

It's what I did to my first pocket calculator at the age of 13. Of course, I didn't have the knowledge to really turn what I saw (it was a calculator chip, not just a 7400) into a useful drawing, but I still remember my father's face, showing a mixture of being mad and amazed at the same time, when I showed him the drawings and he realized that I utterly destroyed the calculator he has spend ~50 Mark (*1) on a few days before. Essentially it forshaded my future of taking everything apart :))

Slicing up a 1976-1980 8-bit CPU is not really challenging. Structure sizes were about 5-10 µm, so not even a microscope was needed. A good camera with a fitting lens and average film will do it.

Lets take for example the well known 6502. It was manufactured in an 8 µm process with a chip area of roughly 4x4 mm. The needed film quality is defined by 'lines' - that is, pairs of consecutive lines that still can be distinguished. 8 µm wide details on a 4000 µm means we need at least 2000 lines over the width of the photograph taken. With 35 mm film, this means 2000/35 = ~60 lines/mm. An average ASA 100 colour film will deliver anywhere between 60 to 150 lines/mm.

So even the cheapest hobby film could be used in reverse-engineering a 6502. This is especially true as we talk analogue film, so no pixel artefacts (*2). Of course, this is the upper limit to start, still making it hard to decide some structures. So more lines are better. B&W films of similar (low) quality and price deliver 300-500 lines/mm, while good go past 1000. More than enough to give a crisp clear view of every detail (*3).

Bottom line: in 1980, a consumer class camera with a good lens and cheap film was all that was needed to dissect any CPU at the time ... well, yes, and a lot of time at hand to understand what was shown :))


In fact, one can still do so with the latest chips except the problem is that nowadays, a picture, even a very good one, wouldn't do it alone. The 6502 had 5 layers and basically all of them can be identified right away. Nowadays chips are made of more than a dozen layers, many of them connective ones, covering the underlying transistors a great deal. Today it needs careful scraping of of layers to get a look inside, much like archaeologists digging out a settlement. But still doable, as now fine tools like lasers can be used to peel each layer. Heck, there is even a guy in Berlin(?) doing this for fun with today's chips, like Apples latest ARM cores.


*1 - 50 Mark in 1974 may equal about 100 Euros nowadays. Doesn't sound much, but it was quite a lot money to us (you know, ye gode olde time when we had no shoes and had to walk to school in snow and rain, uphill in both direction). Back then, filling a large car (Mercedes) was less than 20 Mark.

*2 - To be correct, Analogue film does as well show granulation, as the photo sensitive area is made up of discrete particles. But unlike a CCD they are randomly placed, resulting in kind of a ... well ... analogue resolution. Important for this task is that due the random placement none of the usual digital artefacts will be created. The picture will simply start to blur.

*3 - Superior material can deliver up to 10,000 lines. That's enough to cover any modern CPU with a single shot. Of course, at that point optics does start working a bit different, but that's another story.

| improve this answer | |
  • there is even a guy in Berlin(?) doing this for fun with today's chips - do you have a reference? (and speaking of: *32* - typo) – user7761803 Jul 28 at 13:30
27

It's worth noting what you can see, and what you can't.

First, you cannot see any feature that is much smaller than the wavelength of light that you are using. In 1995 I designed a chip for my Master's thesis in 1.2um technology; features are clearly visible under microscope. Features in 0.5um technology might be visible, but by 1997 0.25um technology was the big thing, and individual transistors would not be visible. Today, reverse engineers pretty much have to use electron microscopes - optical microscopes are useless.

Second, you can see only those features that have some physical significance: you can see metal layers, polysilicon (the material used to make transistor gates), the contacts and vias between these layers, as well as the "thinox" demarcating a transistor, which is really a slope between a thick layer of silicon dioxide and the thinner layer used to make a transisitor gate.

You cannot see doping - what makes an NMOS device different from a PMOS device, so you cannot tell which is which just by looking. You can infer which is which using the circuit connectivity, if you know what you are looking for. Similarly, for NMOS devices, you cannot distinguish enhancement mode devices from depletion mode devices by looks alone.

| improve this answer | |
  • 2
    Re the final paragraph: one useful feature is that in a CMOS circuit, the PMOS devices are much bigger (double-length?) than the NMOS ones, to compensate for their worse characteristics. Given that the PMOS ones are probably on the positive power-rail and the NMOS on 0v, you can tell which way up all is... – SusanW Jul 9 at 17:00
  • @SusanW It's a hint, but not necessarily a reliable one. If you don't have a stringent requirement on the low-to-high propagation delay, you can gain a little space and a little high-to-low speed by reducing the PMOS device to minimum size. – John Doty Jul 11 at 11:17
  • @JohnDoty yep, true enough. – SusanW Jul 11 at 15:56
12

Yes, reverse engineering of chips with a conventional optical microscope in the late 1970s and early 1980s is generally possible.

Although of course, there are limitations. Firstly, the number of wiring layers is important - already two layers of metallization and two layers of polysilicon make reverse circuit design much more difficult. Secondly, chip traps specially created by developers to prevent copying - this, in particular, was practiced by Zilog with the Z80. Thirdly, the size of the circuit / number of transistors, taking into account the amount of labor and available auxiliary techniques - already Motorola chips of level 68000 were a very expensive task.

However, in the game consoles of those years, only the second version of the problems was relevant.

| improve this answer | |
5

This was part of how AMD developed their first 80386.

AMD had long been a second source for Intel x86 chips. Originally the agreement was that Intel would provide details to AMD, who would build their own chips. As time went on Intel wanted to end this agreement or at least prevent AMD from making use of it. This led to numerous court battles.

AMD expected to win, so one of their approaches was to reverse engineer Intel's chips by doing what you describe-- decapping them, and working out the designs by direct examination under microscopes. They took lots of pictures. Eventually AMD won out and they were able to produce the Am386. I believe AMD used other approaches in parallel, but I don't know details of them.

[My only source is my memories from working at AMD at the time. I wasn't on this team but the story was well known around the company.]

| improve this answer | |
4

An engineer who worked at National Semiconductor back when reverse engineering was legal described a conference room wall covered with a patchwork of photos representing an entire Intel microprocessor. They visually extracted the circuit from the image.

| improve this answer | |
0

As voltage shows up on electron microscopes, somewhat, but you cannot see hidden layers. ICs are getting more 3d.

| improve this answer | |
New contributor
DAVID PICKETT is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
  • 2
    Would that have been a factor in the early 80s? – Stephen Kitt Jul 31 at 7:05
-3

From the '80s, chips increasingly used standard cell components. So if you can recognise a standard cell, you don't need to recognise each transistor in it. Companies like Phillips and ES2 provided standard cell libraries.

Built in self test became popular at that time. It's a technique for piping a known state into and out of the chip, running it for some cycles, then reading the result. It's used to check if a chip works after making the wafer but before packaging it. It could also be used to reverse engineer the chip.

To replicate a chip, you'd also need to replicate any firmware. Compaq's reverse engineering of the IBM PC's code to evade copyright is a important setp the IBM PC story: https://en.wikipedia.org/wiki/IBM_PC_compatible

| improve this answer | |
  • 7
    Compaq didn’t clone the microcode, they cloned the firmware. They didn’t need to clone anything related to the CPU, they bought 8086 or 8088 CPUs from Intel. – Stephen Kitt Jul 9 at 13:46
  • 5
    Use of standardcores as IP is a thing of the nineties and naughties, not the 80s. – Raffzahn Jul 9 at 13:55
  • 2
    @Raffzahn Partly true. I worked at ES2, a low volume fab and tool-maker, from '86-9. Most designs were standard cell. Standard cells ranged from easily recognisable ADC pads to logic as netlists which could differ from chip to chip. I think I recall a CPU in the Phillips standard cell library. I'm confused on dates - Robin Saxby left for ARM before I left but Wikipedia reckons it wasn't founded until late 1990?? So maybe CPUs from the late 80s but commodified by ARM in the '90s? – Michael Grazebrook Jul 10 at 15:11
  • @StephenKitt - Corrected. – Michael Grazebrook Jul 10 at 15:12
  • Anyway I stand by my main points: built in self test and recognising standard cells are handing for reverse engineering. – Michael Grazebrook Jul 10 at 15:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.