Ken Shirriff Explains His Techniques For Reverse Engineering Silicon

When it comes to reverse engineering silicon, there’s no better person to ask than Ken Shirriff. He’s the expert at teasing the meaning out of layers of polysilicon and metal. He’s reverse engineered the ubiquitous 555 timer, he’s taken a look at the inside of old-school audio chips, and he’s found butterflies in his op-amp. Where there’s a crazy jumble of microscopic wires and layers of silicon, Ken’s there, ready to do the teardown.

For this year’s talk at the Hackaday Superconference, Ken walked everyone through the techniques for reverse engineering silicon. Surprisingly, this isn’t as hard as it sounds. Yes, you’ll still need to drop acid to get to the guts of an IC (of course, you could always find a 555 stuck in a metal can, but then you can’t say ‘dropping acid’), but even the most complex devices on the planet are still made of a few basic components. You’ve got n-doped silicon, p-doped silicon, and some metal. That’s it, and if you know what you’re looking for — like Ken does — you have all the tools you need to figure out how these integrated circuits are made.

The first question you might ask when decapping a chip is how to get the silicon out of the chip. For some 555 timers, this is easy. You can indeed still buy 555s in a TO-99 metal case, and with a jeweler’s saw, hack saw, or even a dremel, that metal can will come right off, revealing the juicy silicon nougat inside.

For other chips, you’ll need to do a bit more work. After removing the bulk of the material, Ken uses a product called Armor Etch to remove some silicon dioxide. Armor Etch apparently comes from craft stores, used to etch glassware with silhouettes of birds or the words ‘live laugh love’. To remove metal layers, it’s just a matter of a few drops of hydrochloric acid.  Of course, Ken’s talk was only a survey of decapsulation, the best info comes from John McMaster’s wiki. With the chip decapsulated, it’s mounted in a metallurgical microscope equipped with an XY stage and a webcam that Ken picked up on eBay for a few hundred dollars.

But once you get that chip under the scope, how do you reverse engineer the circuit. There are only a handful of parts — transistors, resistors, and capacitors — that go into the layers of silicon, but even a transistor can look vastly different from one process or manufacturer to another. Luckily, Ken has been doing this a while, and he’s got an eye for what these things look like.

Transistors can look like circles, squares, or other interesting geometric patterns. Resistors, though, are usually just long lines of silicon underneath the metal layer. Tie all this together, and you can start to see pattern emerging. If you find two transistors with the base wired to the collector of each other, you’ve probably got a flip-flop. If you see rows and columns of transistors, you probably have some sort of data ready to be decoded.

It’s no exaggeration to say that Ken Shirriff is one of the best at what he does. He’s neck deep in making the innards of semiconductor devices understandable to everyone, and it shows: every single time Ken posts his latest discovery on his blog, it’s quickly upvoted to the top of Hacker News and makes the rounds on the cool parts of Twitter. This talk is a great look at the techniques Ken uses to understand these die shots, and a must-watch for everyone who even has an inkling of interest in modern semiconductor devices.

Social engineering techniques

Blagging is when someone makes up a story to gain a person’s interest and uses this to encourage them to give away information about themselves, or even send money.

For example, a person may receive an email that appears to be from a friend telling them that they’re in trouble and asking them to send money.

Similar to blagging, a phishing email will ask a person to send personal details, but pretends to be from a business. They can often look convincing, but may contain spelling errors or URLs

When a person clicks on these links and logs in, it sends their username and password to someone who will use it to access their real accounts. This information might be used to steal a person’s money or identity, or the email may contain malware

Banks will never send emails asking for personal information or usernames and passwords. If someone receives an email that they think might be phishing, they should report it to the business the sender is claiming to be.

Pharming is a type of cyberattack that redirects a user from a genuine website to a fake one. The fake website will often look like the genuine one. When a person logs in, it sends their username and password to someone who will use it to access their real accounts.

There are several ways that a pharming cyberattack can redirect traffic from a genuine website to a fake one. One example is if the Domain Name Servers (DNS

This is the simplest form of taking personal details. Shouldering is looking at someone’s information over their shoulder, for example looking at someone enter their PIN in a shop or at a cashpoint.

A person can prevent this by using their hand to cover the keypad as they type their PIN, or being aware of people around them when typing in PINs. Software helps protect against shouldering by masking what is typed, showing an asterisk on the screen instead of the symbol that was entered.

What You Need to Know About Becoming a Biomedical Engineering Major