Hostile Hardware reverse engineering by chip de-capping and analysys

Video thumbnail (Frame 0) Video thumbnail (Frame 3201) Video thumbnail (Frame 7711) Video thumbnail (Frame 10696) Video thumbnail (Frame 13029) Video thumbnail (Frame 16463) Video thumbnail (Frame 18523) Video thumbnail (Frame 22838) Video thumbnail (Frame 25621) Video thumbnail (Frame 27603) Video thumbnail (Frame 32043) Video thumbnail (Frame 34064) Video thumbnail (Frame 37456) Video thumbnail (Frame 40041) Video thumbnail (Frame 46166) Video thumbnail (Frame 49686) Video thumbnail (Frame 53194) Video thumbnail (Frame 55466) Video thumbnail (Frame 57611) Video thumbnail (Frame 59931) Video thumbnail (Frame 62814) Video thumbnail (Frame 67913) Video thumbnail (Frame 77144) Video thumbnail (Frame 79581) Video thumbnail (Frame 83663) Video thumbnail (Frame 86893) Video thumbnail (Frame 97441) Video thumbnail (Frame 103326) Video thumbnail (Frame 105644) Video thumbnail (Frame 107698) Video thumbnail (Frame 110956) Video thumbnail (Frame 113291) Video thumbnail (Frame 115456) Video thumbnail (Frame 117708) Video thumbnail (Frame 121033) Video thumbnail (Frame 123654) Video thumbnail (Frame 126646) Video thumbnail (Frame 137137) Video thumbnail (Frame 147628)
Video in TIB AV-Portal: Hostile Hardware reverse engineering by chip de-capping and analysys

Formal Metadata

Title
Hostile Hardware reverse engineering by chip de-capping and analysys
Alternative Title
Decapping Chips the Easy Hard Way
Title of Series
Author
License
CC Attribution 3.0 Unported:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Identifiers
Publisher
Release Date
2013
Language
English

Content Metadata

Subject Area
Abstract
For some time it has been possible to discover the inner workings of microprocessors with the help of a microscope and some nasty chemicals such as fuming nitric acid. However, unless you have access to a university or work science lab, this is beyond the reach of most hackers, and, even it were to be attempted, difficult and potentially extremely dangerous. In this talk we will go through our own adventures in tackling the issue from the point of view of the back-room hacker/researcher, and how we have solved many of the problems using only tools and devices that were freely and cheaply available from online sources such as Ebay. There is also the secondary problem of what to do with the chip once you've decapped it. For example: if you've taken microscopic images of a masked ROM, in theory you can extract the code, but in practice you're looking at thousands of tiny dots, each of which represent a 0 or a 1, which, once correctly read and compiled into HEX, will represent the original byte code. Many projects (e.g. MAME) have used crowd-sourcing as a means of converting the images by eye, but we will present a software tool that semi-automates this process and we'll demonstrate how what was once the works of tens if not hundreds of hours can be reduced to a few minutes.
Email Email Bit Mathematical analysis Graph coloring Optical disc drive Medical imaging Word Computer hardware Computer hardware Reverse engineering Reverse engineering God Thumbnail
Slide rule Greatest element Petri net Website Liquid Right angle Bit ACID Resultant Bookmark (World Wide Web)
Point (geometry) Spherical cap ACID Self-organization Sound effect Vapor Bit ACID Table (information) Fault-tolerant system Spontaneous symmetry breaking
ACID Plastikkarte Bit
Context awareness Mathematics Wechselseitige Information Perfect group Personal digital assistant ACID Sampling (statistics) Data storage device ACID Drop (liquid) Disk read-and-write head Graph coloring
Filter <Stochastik> Mathematics Direction (geometry) Website Set (mathematics) Bit Disk read-and-write head
Degree (graph theory) Greatest element Multiplication sign Per mil Energy level ACID Boiling point Logic gate
Greatest element Petri net Petri net Videoconferencing 1 (number) Boom (sailing) ACID Bit ACID Frame problem Entire function 2 (number)
Purchasing Inheritance (object-oriented programming) 1 (number) Bit Water vapor Routing
Area Medical imaging Identifiability Auditory masking Zoom lens Program slicing System identification Bit Selectivity (electronic) Image registration Graph coloring Number
Graphics tablet Type theory Virtual machine Keilförmige Anordnung Frame problem YouTube
Ocean current Game controller Web portal Service (economics) Mereology Computer Power (physics) Data mining Frequency Type theory Exterior algebra Googol Peripheral Logic Network socket Physicist Endliche Modelltheorie Physical system
Area Point (geometry) Concentric Software developer Multiplication sign Computer-generated imagery Zoom lens ACID Microcontroller Bit ACID Mereology Mereology Number Compiler Medical imaging Process (computing) Website Extension (kinesiology)
Point (geometry) ACID Relief
Word Component-based software engineering Hazard (2005 film) Order (biology) Electronic mailing list Cuboid Energy level Rhombus
Concentric Charge carrier Physical law Bit ACID Form (programming)
Medical imaging Bit Quicksort Mereology Software bug
Purchasing Mathematics Positional notation Workstation <Musikinstrument> Ripping Line (geometry) Graph coloring Software development kit
NP-hard Graphics tablet Texture mapping Personal digital assistant Selectivity (electronic) Right angle Quicksort Line (geometry)
Graphics tablet Point (geometry) Greatest element 1 (number) Bit Client (computing) Line (geometry) Mereology Number Microprocessor Personal digital assistant Software testing Data conversion Information security Reverse engineering
Logical constant Metre Point (geometry) Greatest element 40 (number) Multiplication sign Virtual machine Sheaf (mathematics) ACID Regular graph Proper map Power (physics) Frequency Square number Area Projective plane Sampling (statistics) Planning Maxima and minima 3 (number) Bit Line (geometry) Sierpinski triangle Film editing Spring (hydrology) Personal digital assistant Blog Order (biology) Resultant
Film editing Auditory masking Order (biology) ACID Bit Line (geometry) Punched card Resultant
Point (geometry) Greatest element Concentric Multiplication sign ACID Set (mathematics) Maxima and minima Line (geometry) Heat transfer Variable (mathematics) Frame problem Wärmestrahlung Maize Right angle Pressure Hydraulic jump
Area Point (geometry) Fibonacci number Key (cryptography) Open source Multiplication sign Set (mathematics) Planning 2 (number) Semiconductor memory Information security Resultant Software development kit
Laptop Point (geometry) Open source Wage labour Code Multiplication sign 1 (number) Mass Mereology Rule of inference Medical imaging Mathematics Goodness of fit Pi Different (Kate Ryan album) Term (mathematics) Hacker (term) Authorization Representation (politics) Office suite Logic gate Pattern recognition Algorithm Touchscreen Projective plane Code Bit Line (geometry) Cryptography Flow separation Process (computing) Hexagon Software Personal digital assistant Pattern language Right angle Game theory
Laptop Area Point (geometry) Simulation Video projector Multiplication sign Electronic program guide Menu (computing) Drop (liquid) Special unitary group Data mining Term (mathematics) Befehlsprozessor Green's function Software testing Whiteboard Quicksort Data structure Booting Freezing
Point (geometry) Medical imaging Personal digital assistant Computer-generated imagery Sheaf (mathematics) Bit ACID Line (geometry) Focus (optics) Number Row (database) God
Medical imaging Dot product Group action Set (mathematics) Bit Line (geometry) Graph coloring Row (database)
Point (geometry) Medical imaging Process (computing) Pattern language Bit Line (geometry) Cursor (computers) Loop (music) Reading (process) Asynchronous Transfer Mode Personal area network
Medical imaging Computer program Roundness (object) Hexagon Personal digital assistant Bit Pattern language Reading (process) Asynchronous Transfer Mode Usability
Medical imaging Group action Greatest element Auditory masking Set (mathematics) Bit Line (geometry) Computer font Reading (process) Asynchronous Transfer Mode
Computer icon Medical imaging Dot product Hexagon Computer file Code Moment (mathematics) Client (computing) Asynchronous Transfer Mode
Point (geometry) Area Pointer (computer programming) Computer file Code Set (mathematics) Product (business) Thomas Bayes
Computer program System call Touchscreen Table (information) Code Ferry Corsten File format Set (mathematics) Bit Branch (computer science) Variable (mathematics) Compiler Loop (music) Pointer (computer programming) Personal digital assistant Interrupt <Informatik> Address space Hydraulic jump Spacetime Address space
Computer virus Complex (psychology) Code Multiplication sign Coroutine Set (mathematics) Function (mathematics) Evolutionäre Spieltheorie Emulator Mathematics Radio-frequency identification QR code Information security Physical system Moment (mathematics) Branch (computer science) Variable (mathematics) Interrupt <Informatik> Website Right angle Reading (process) Reverse engineering Point (geometry) Computer-generated imagery Flash memory Branch (computer science) Mass Raw image format Cyclic redundancy check Host Identity Protocol Product (business) Hacker (term) Software Energy level EEPROM Hydraulic jump Software development kit Addition Polygon mesh Key (cryptography) Projective plane Carry (arithmetic) Inclusion map Word Loop (music) Calculation Radio-frequency identification Blog Disassembler
Point (geometry) Web page Sensitivity analysis Implementation Existence Open source Code Multiplication sign Virtual machine Combinational logic Coroutine Microcontroller Mereology Theory Radio-frequency identification Software Bus (computing) Software testing Information security Form (programming) Area Addition Algorithm Theory of relativity Touchscreen Kälteerzeugung File format Projective plane Bit Machine code Software Angle Auditory masking Blog Right angle Quicksort Disassembler
Web page Computer program Code Multiplication sign Bit Frame problem Revision control Emulator Medical imaging Process (computing) Blog Percolation theory Optics Screensaver Software testing
afternoon everyone I'm Zach Franklin and this is major malfunction hi I'm gonna be sitting quietly here for a bit and actually learning what he does because I have no idea he does his weird odd West stuff and all these really terrible smells come out of the room and you'll when he gets the chemicals that is even worse so yeah this is gonna be interesting what can I say I'm a farmer okay so we're gonna take you guys through a bit of hardware reverse engineering and I I think you're gonna have fun with it we certainly did so we are a aperture labs
we are not aperture laboratories there's something clearly different we do occasionally get a bit of miss rooted mail though so here's a piece of mail we
got dear aperture laboratories do you make portal guns do they work well I have an idea for a portal gun here is the picture the portal colors are yellow and rainbow from Joshua so apart from
that dreadful photoshopping on this picture really mean crying oh yeah you notice that the thumbs aren't pointing the right way around so I think I'm a reasonably smart guy and I was just completely not thinking when I went on to Google Images and search for the word fist I swear to God holy it's like yeah there was one I thought he was trying to pick your nose from the inside whose mind bleach okay
so just to recap okay so we're gonna
talk or I'm gonna talk about a simple decapping that you can do and the kind of benefits you'll get from it call it
the plink plink first method so need
some ingredients some nitric acid so normally between 70 and 90% you can get up to 99 70s is probably good enough and it's there are issues with chemicals like these so yeah just like you might think you really want the 99% stuff yeah probably really don't acetone which is a organically solvent a hotplate because the hot of the nitric acid is the faster the reaction so you can have a chip you can drop it in room-temperature nitric acid nothing will happen actually that's not quite true the legs will miraculously disappear and just actually disappear right into the package it's like all these very small holes on the site but as soon as you start to get it a bit warmer amazing things happen or a silicate glass because these are Pyrex speakers so they can was signed a bit of heat without shattering a pipette just for removing liquids around an acetone wash bottle again just an easy way to apply your acetone and some petri dishes which are useful for for sorting out the results so you see that what can I say and the other one the other great place to get some of this stuff from Amazon who just thought I bought some I try to think potassium nitrate from Amazon and I'm like okay and at the bottom I and I've seen this on a couple of occasions that they other people bought sulfur and charcoal Messiah my favorite was was I was looking for aluminium powder and other people bought iron oxide and magnesium Ruben I'll sling them into one of these slides actually I remember
okay so EB is your friend this the ship we've bought from EB is astounding so as
you can probably gather this stuff can get quite nasty a nitric acid
particularly particularly bad so it does what we want particularly to dissolve organics so the epoxy a packaging on the chip is the thing we want to get rid of but it will also take out metals as well dissolves copper and does all the other lovely things as it does it will burn you it has choking fumes so as soon as you take the cap off the bottle it'll start fuming away you get fumes from the acid you get fumes from the stuff the acid reacts with and that's typically nitrogen dioxide toxic of course and yeah if you get a lung full of nitric acid vapor there's about an eight hour delay before it has has a nice catastrophic effect I mean it will be really unpleasant initially and then eight hours later bad bad stuff will happen oh yeah and it causes spontaneous combustion of organics this is probably an important point to note kitchen table yeah this is this one's not for the kitchen table definitely outside eyesight and better with a cabinet so you know so people wear latex gloves and in general in labs you know people started to moving to nitrile gloves because they are my trials grace resistant to most chemicals doesn't react with them this is what happens when you take a bit of nitrile glove and you add a little bit of nitric
acid by my so you definitely definitely want to be a bit careful with it okay acetone
is only a little evil I will dissolve plastics in particular it can be really handy for getting inside smart cards and things like that has choking fumes and a partly it's a little bit carcinogenic as well oh yeah the fumes are heavier than air so if I'm working with it up here the fumes are going to cascade off the table and onto the floor and spread out so the guy back there is going to have a nice little pool of acetone fumes around them if it rolls down into the basement yeah it's interesting stuff yeah and again you won't realize you won't really smell anything but there's a nice layer of it on the on on the ground and yeah bang so
safety we use a fume cabinet you've just got to also think about how you're dealing with this stuff especially the nitric acid and where you're storing it I handling it think about where it is where you're moving it to is it is the container open if you've got a pipette and you're moving across to your sample if the prepared drips what's it gonna drip on if it spills where is it going to run and what's it going to hit as it runs so just kind of be aware in your head what's going on also you can neutralize it with baking soda because it's an acid and we use an industrial neutralizer which costs I you buy in cases of sex it costs about 200 bucks it's amazing stuff you just sprinkle on and a color changes when it's safe it's like perfect mutualization for dummies so here's our fume cabinet any
ideas where the fume cabinet was acquired eBay 10 pounds this fume cabinet cost it costs 35 pounds to have a cab go pick it up now it sounds like a great deal but it is safety equipment and this is a called a recirculating fume cabinet so some few cabinets just suck things up I'd invent them straight out site this is designed to vent back into the room so everything goes through a filter therefore there's no way I'm trusting the filters from a 10 quid ebay fume cabinet so the new set of filters cost about 500 quid to put in but you know you can use direct vein outside eye or yeah a lots on your neighbors do you yeah a lot a lot smaller food cabinets oh and again you can do this stuff at
its side I get ya and that's how I started doing it the other thing just be aware of the wind because if the wind changes your big plume of nitric acid fumes that was going over there all of a sudden you know heads towards you and even a tiny kind of a little bit very unpleasant so so yeah this is like yeah I really don't want to be near that ever again so here's a nitric acid
yeah you'll never guess where Agora of course use a beaker and pipette and the
great thing about this is you don't you don't need to use a lot you know 1215 mils of nitric acid a time is plenty to decapitate which is great it means you don't have to have tons hanging around and you're not moving large quantities about this is asked to
wash bottle so handy you just fill it up with acetone the straw when you're not using it you just pull up above the less level of the acetone and the acetone will stay as its heavier and will stay in the bottle so here is a simple
example this is our a pic chip pic32 and as you know we have a we have a tradition at Def Con that all first time speakers have to do a shot and we figured you are a first time speaker at Def Con 21 as shorter is a short of Jack oh how surprising since it's you so you realize when I the rest of my talk up I'm just gonna blame you you know what wait a minute back up excellent how come I have to drink one because he didn't Thank You Tube please may I have another thanks okay how's you work thank you so this is a microchip pic32 chip which I returned knocking around and I had more than one of them so okay so what we'll use this guy it's a very modern ship so they are highly integrated so the level of detail on is is very small but a slightly older chips are fun because you can actually really start to understand how they're built up and how the gating is done and things like that so as soon as I put this in here one of the things I want you guys to look for is on there kind of bottom side here as soon as it's dropped in the beaker it'll react instantly this asset is about ninety degrees Celsius it'll boil 120 and so as soon as the chip goes in it will start reacting immediately and what you'll see is a around that kind of bottom here you'll see a small coming off of the epoxy
so so yeah and no one's seen this video are they oh yeah that's great there's evil evil evil Microsoft okay so
look for this fall around the bottom of the beaker here we go into the reaction boom the petri dish on top is just to kind of contain the fumes a little bit so the brown frames are nitrogen dioxide and you can see here I this dark cloud
is the epoxy coming off the coming off
the chip okay so once it's finished reacting take
the acid into second beaker your disposal beaker and take the beaker rinse it with the acetone and decant it into the petri dish and what you'll end up with is a dye with all the Bourne wires still intact because the acid is going to eat not just the epoxy but the entire lead frame as well both externally and internally from the chip so get the dye rinse it in a little bit more acetone and this is what you'll end up with and
it kind of looks a bit bit yucky uh there's still a little bit of epoxy on there but I again another another
fantastic ebay purchase these are like thirty quid and they're amazing I they will just remove all the from anything including chefs known as route they're really cool so we've used them with water we've used them with and water in them and then a beaker of acetone with the chip sitting in it and absolutely fantastic and if you have watches or jewelry or glasses and you pop them in this the first thing you're gonna go is holy of my filthy person the amount you'll just you'll see oh just coming off it's like oh my god ah but they're amazing they're they're super cheap these days little ones and if you get one don't forget to do your wife's and girlfriends jewelry which you'll love it okay so after its had a trip through the cleaner this is what we've ended up with
now this is not a particularly great microscope picture because a really cool microscope doesn't have a lens big enough to to take the whole ship so this was done with a a small crappy USB microscope but you can see it's cleaned up a lot one of the other things you'll notice it's missing are the bond wires or a lot of the bond wires that's because the chip was vibrating around in the ultrasonic bath and they simply got knocked off they're pretty fragile so let's take a
bit of a closer look so this is it under
a microscope and this is one of the that kind of identification areas of the chip these numbers here represent the layers so the dye is built up in a layer upon layer upon layer so as the chips manufactured you take your your puck of silicon you've got your wafer slice of it and it's constant so basically you expose are you okay start from beginning you've got your wafer you lay down a mask which is a chemical that is etched away by typically ultraviolet light I once that coated that resist is coated on the dye you have a large image of the portion of the chip you focus it down onto the dye onto the wafer expose it with ultraviolet light and then you rinse the the resist chemical away and that just leaves an exposed area which you can then dope with another layer of silicon and just build up and build up and build up so this these identifiers czar kind of registration marks for each layer as it got laid down so they can see well actually you know we did actually put down layer one five the reason the colors are different is because because of the the different dance they are reflecting the light slightly differently okay never again not jack daniels select zoom a little bit more a little bit more so you can get some some really great detail okay here are the bond wires
these as you see this the two on the left hand side of this picture are actually missing they go simply vibrate it off so there are typically two types of bonds this is called a ball bond I have which is the more modern technique the older technique is called a wedge bond and you can actually find wedge bonders on eBay of course if you wanted to take the die and try and put it into a new lead frame but there's better techniques the ball bonds are quite clever the wire comes out it gets hit by a little paddle there's electric charge between them and it kind of causes the little gold wire to fuse into a ball and then it ultrasonically pushes that ball down and ultrasonically welded onto the pad if you go into youtube and search for die bonding i the speed the die bond machines buat is truly unbelievable i and they're literally dropping our bones on the die taking it to the lead frame tink tink tink tink TT teens at the speed of light it's unbelievable so why the hell are we
doing this there's a reasonable question you've sat there very patiently while I've rambled on well there are some really good reasons to the to do this actually so
here's like here's a really simple example a friend of mine is a cinema model maker and he was actually one of the guys that built the built the Hogwarts model and we're having a beer one day and he started talking about this plug now this is given away cheaply by one of our power companies in the UK and its power saving device you plug your computer into the master socket or your TV and your peripherals into the slave sockets on the side and when you turn the master on it turns on the peripherals simple easy but what they wanted to use it for was dust collection for portals so basically the plug a portal into the master the extraction system will be plugged into the slave and as soon as you turn it on extraction starts and they can go the only problem with this is there's a five-second delay between the master turning on and and the slave turning on and that they just can't handle that the alternatives the actual if you went to buy one of these they charge a hundred and fifty quid so about two hundred fifty bucks for something like this this cost you quit so for something that's doing pretty much exactly the same thing so he'd mentioned that someone had hacked this and I was asking me about it so let me actually take a look at it it's a pretty simple device so on the top here you have a little power supply the next important thing is this resistor here resistor 17 which is to measure the current so here here are the actual important
bets we have two chips here a service logic chip which is nice and clearly marked so this logic is the vendor it's a CS 5 4 6 6 - is Zed type that into to Google and you'll get the datasheet and you're off and then we've got the OSI 706 or if you look at the other plug it's the OSI 708 I can't find anything about this device now when you read this there's logic datasheet I this is our current frequency converter chip so it's measuring the current across that resistor and it's outputting a frequency that's proportional to the current consumed and it needs a clock as well and this when you reverse the socket this OC 706 chip is supplying the clock to the service logic chip but after a ton of googling and it's quite interesting because you'll actually see other people searching for you you know google's suggesting oh did you mean all c 708 it's like people are searching for similar parts now it makes sense that this is a small-market controller i but unless we know what it is it's completely useless so the guy that hacks it i basically pretty much replace this entire chip with a pic chip kludge tin and our we win but we can do better than that so if you plink this plink plink physicist chip this is what
you get and thank you NEC for having nice big part numbers here this is d7 t f9 - one - it's a little microcontroller you want the NEC site here's a here's a compiler for it here's all the development tools they're all free so we're we major here hasn't quite had it dumped on him to write the code but but that's that's coming shortly that's because some idiot destroyed the chip yeah plenty more where those came from okay
so other interesting things this is some a strong hey it's another chip so slightly older and we're gonna zoom in a little bit and zoom in and it starts to
look quite interesting so this is an area on the chip get really close and
you can actually really start to see some proper texture okay so one of the things we decided to do was clean the image up a bit so we're going to use an asset so the very top layer of the the dye is what's called a passivation layer it's just a simple layer of silicon dioxide glass to protect the chip the electronics underneath from you know any contaminants in the epoxy so it's just basically to to seal the top but again if we remove that we'll get a nice nice fresh image so anyone get any ideas hydrofluoric acid so some people have have tried to polish it off and and that works to a certain extent that it can be really hard getting the chip perfectly flat because these layers are incredibly thin and if it's just off slightly then you start digging in deeper on one end of the chip and you lose detail it's a nightmare hydrofluoric acid and hydrofluoric acid is used in the chip manufacture process I when I was talking about the resists I they use hydrofluoric acid that resists resists the hydrofluoric acid which they use to remove material so nitric acid pretty nasty hydrofluoric acid is horrendous not to put a finer point on it so yeah pure pure pure horrendously evil stuff not quite this time it is the piss of the devil no I say it's you can imagine some some little simmer sinners getting dipped in it repeatedly okay so for those of you not familiar now it's an acid so it does all the kind of usual bad stuff that the nitric acid does it dissolves glass so that can be a little bit of an issue but that's actually what we want it to do so so we're cool with that it's quite toxic somewhat so eats calcium and magnesium and depending on the concentration if you actually get it on you you won't notice for 24 hours so bad bad bad bad
bad okay so I mentioned it
dissolved calcium yeah loves calcium yeah you wish it looks like this
so anyone notice anything about this picture but especially the one on the right apart from its extreme grossness sorry okay so the reason his finger is all wrinkly at the top is cuz there's no bone in there anymore it's all gone and what's more it all work its way up yeah bad bad bad bad bad
so the Skellig ro isn't gonna help by the calcium gluconate gel will so the
whole point of the the gel is to feed the the acid calcium so it prefers the calcium gluconate rather than the calcium in your bones so there are lots of I mean when I say hydrofluoric bad it gets even worse so if you read any treatment regimens for hydrofluoric acid not only will they say slap on lots of calcium gluconate or potentially inject it into you so in fact they have kind of epi pens within the treatment regimen says under no circumstances give gives the victim any pain relief whatsoever no local anesthetics nothing because the nor that they finally treated you when it stops hurting so basically throughout the treatment you're gonna be an agony and they're gonna keep you in agony because they know what it stops are saying you're probably okay so I I
really wanted to do this and it's like how how the hell are we gonna do this and I had a course of dental treatment my dentist is quite kind of young and hip and we're chatting away and you know what to you to accept etc but he happens to mention over we use hydrofluoric acid I'm like really and that's really interesting and slightly scary so this is the stuff
this is dental hydrofluoric acid gel no
I company called Henry Schein dental supply so I'm sorry ask your dentist nicely absolutely oh and you'll do that too there in a minute okay so so I'm like oh we're word poetry gets oh yeah this the Vince Dental Supply as he brought me a little list and one of them was a company called Henry Shain okay so this is a little this shows you the level of insanity that's out there when I order components from one of the big UK component suppliers like RS a foreign L if I'm crazy enough to want something like a lithium coin sale like two lithium coin sales because I happen to need someone I just threw it through them you know on on another order hazard lights start flashing they say oh this is this is a hazardous material and so basically well that means is your lithium coin sales will arrive by a separate shipment three days later than you actually needed them and they'll be in a box like this no I'm not you for to coin sales slapped with big hazard diamonds it's like holy crap this alived at the little box no markings at all / okay so it arrives in these little
syringes and yeah some interesting
things so they actually use it inside your mouth so the hygienist will be there with the extractor i sucking away past the dentist is its putting it on your your crohn's to to roughen them up before he applies an adhesive but it's designed for dentists yeah it's not for chemists or for people working in fabs it's designed for for a dentist who is quite technical but yeah he's not a chemist it's not a rocket scientist he's a dentist so it comes in a gel form which is pretty cool because again I I want it to be as safe as possible for me something as simple as that I it's died so you can see exactly where that's going which is quite handy and it's a quite low concentration so 9.6% which is which is law but it's still effective and the other thing when you're doing stuff like this by yourself you don't want something to react necessarily super quickly you want to be able to control it so actually the fact that it takes a little bit longer to react that's that's just perfect but yeah you definitely want a fume cabinet for this stuff so this is a
before and after so this is the before pic and this is the after and it looks a
little bit blurry and accidently because my this image is a little bit blurry but it's cleaned up the image remarkably and as I said just removing that top passivation there so
here is another short I this is another part of the chip it has a bug in it and actually that is the bloody microscope camera and their was reasonably cheap actually was it eBay I think it might have an Eevee but yeah we bought it was super cheap and I think it got dropped and internally within it I crapped on the lens and trying to actually clean it out impossible and ideally why was there sort of imaging we - we wanted to kind of get the whole thing imaged and when it's got bits of crap on it it's not ideal this this particular bit of crap I actually think was I was on the on the die so yes
it was so you can see there's a color change between these two images and
that's because we've now removed a layer so as I said earlier colors represent depth and the depths of all changed because there's no no longer a layer and it also opens this dye up for micro probing so you can buy micro probing station which is an amazing piece of kit and it'll allow you to put probes on these lines and actually sniff the data go through I EB I think that was our most expensive EB purchase that was about five thousand bucks Earth's came from San Diego and was the best eBay deal ever they had lots of accessories and a great microscope but it said have a look it's called the micro probing station and basically it's a - a microscope with a special stage and you have Micro positioners I had that allow you to move a very fine probe and we're talking about fine I have probes that are 0.25 of a micron ah so you can move them very accurately and just plot them on these lines and you can sniff the data on the chip buses but that's for another talk so it is you did
say be nice to your dentist and it really is important to be nice to a dentist I was nice to my dentist and this is what he gave me so and I was in
for several session I said hey can I bring some stuff in and get you to x-ray them for me it's like sure that sounds like fun and I did it so I was just kind of one of those things that's like dental x-ray is it is it isn't gonna be useful and interesting for this sort of stuff and as it turns out she says so I brought a
little selection of chips and plop them plop them then he zapped them and this is what we've ended up with so the good
thing about these is x-rays are one-to-one so these are skill sized chips and it means that when you pop them under a microscope you can do
things like blow them up this these are the bond wires Institute inside the chip and actually something I never knew this guy here fine pointing at the right one possibly this this guy here has three bond wires going to the same pad and it turns out that's a power supply line so that was a ground in that case so chip needs more current needs more bond wires to handle the current so they stack three up any idea what this is the texture at the back might give you a hint no takers so this texture is is a very thin sheet of fiberglass and it's a little bit hard
to see this is a simcha so you can actually see the bond wires coming from the dye in the center the dye you can't really see but you can see the the bond wires outlining the dye going to the various pads of the same chip now this
one's particularly interesting we were doing some testing for a client it's one of the things we we do apart from kind of security reverse engineering is we do a little bit Assurance work as well and we knew we were kind of looking for with this chip and when we excrete it it's like holy we know about chips 1 & 2 these two guys over here what the is this and it turns out that that is a radial chip which we weren't expecting in this particular device and as it turns out it's they're legitimately but it could be completely illegitimate so there are issues with supply lines been compromised fabs and churning out dyes that have modifications and here I was a small RF device that could be embedded in the dye itself sorry I know that wasn't a USB stick actually I can't really tell you what it is unfortunately but it was like holy crap so given that the guy in the middle is a processor and the one on the left is an EEPROM you know what we were actually doing was looking to look at the bond wires between the processor and the EEPROM and watch the conversation between the two and yeah RF chip the way we actually figured out it was an RF chip was he pulled it out at the bottom of the jar when we clink clink kissed it and zoomed in and there was the manufacturers part number on it again just look it up holy crap but the interesting thing was I must have blinked half a dozen of these chips and I'm going through go through the debris and I'm picking out and actually in this particular case the the processor on the EEPROM those bond wires between them so they're joined together so they're easy to sport and you just pick them out and then I kept coming across yeah like a few weeks later I after done a whole bunch of them I noticed that there was there was a you know bigger chunks in the crap at the bottom and it turned out to be this this little die yeah at that point we hadn't x-rayed it so we were we didn't know that what we were dealing with and we only were expecting those two chips in there so yeah so so that was very interesting I and as I said it's like what is this oh there's several of these we're too pretty hell did these come from and actually there was every on every chip I dare I'd plink there was a one of those lurking in the the grunge of the bottom so and so with this
particular project we wanted access to sniff the data I on these lines going between the MCU and this EPROM chip I soul plink plink fizzing it isn't going to cut it because I need the chip to be operable so there is a handy machine to do it it's called an icing jet etch it's amazing it's like the size and you pop your chip in and it will etch a hole in it down to the die I all the problem 22,000 I have a constant EB search for her oh yeah I've seen one yet so it's like okay it's 22,000 bucks but I reckon it's doable so came up with this design
this device is called the Decapitator and I wrote a blog post about it and I'm saying okay I've got this design I'm gonna send out for the bet so I'll there I'll fill you in well I'm a lazy and haven't actually updated to see actually yet works so you actually get to see the results so this was my plan for it so you have a hot plate at the bottom you're a flask of nitric acid you have in this drawing a syringe pushing air in so that the nitric acid comes up I ended up using an aquarium pump and teflon is resistant to hot nitric acid so I got Teflon rod of two different sizes and I wanted to try and use simple tools so this can all be done with a drill press and and just some simple woodworking bits and the teflon cuts like a dream if you use woodworking tools on him so I chopped out these two cups I drilled a hole through the bottom I learnt a little bit about pulling glass pipettes is support unless you you want the pipette to be absolutely straight in which case it's a pair than they are but as durable and I I also wanted to be able to control where the acid was going to basket into a particular area so after a lot of research I came across this rubber this gasket material called vitamin e TP 600 s and then I tried to find it so I looked said in all the usual places eBay and Amazon and I didn't do Craigslist acts I've never done Craigslist I don't know why I'll have a look actually but it sorry okay well I eventually tracked down some people that did and on the way and I came across is made by DuPont I came across a two point distributor because apparently is quite knew that when I said oh I'd like a sample of itani TP he actually wet himself on the phone he was laughing down the phone at me and saying yes as rare as rocking horse so I finally tracked someone else that I can order a sheet off and I said okay so I'd like to order some some Viton it's like oh how much in there well I don't need a lot just really yeah six inch square would be fine it's like oh no that won't meet the minimum order which is nine hundred and forty millimeters square I'm like okay yeah that'll be fine okay that'll be seventeen hundred pounds plus VAT so basically the very power of two and a half thousand bucks and I'm like yeah I don't need the vitamin obviously III did actually track down someone that sold me a kind of six inch by section slot the piece of it actually had a hole punched in it so I think it was actually on a proper sample sheet sample of little book it was 200 quid but in the meantime I'd gotten some regular Viton on Amazon big sheet like this forty quid 60 bucks I and I realized but that actually the cheap stuff works because I'm only exposing it for a reasonably short period of time the Viton ETP 600 is designed for making gaskets for pipelines they're pumping nitric acid and like this so actually I can have something at the regular Viton you when you look at the specs from how they test this stuff it's like okay we're going to immerse in nitric acid for 24 hours it's like oh yes and it expands 5% and it's like okay that's fighting it's good to be nowhere near like 24 hours and even if it did expand 5% who cares no not with the stuff that we're doing so we ended up by not using the wing nuts we have we actually have a spring pressing down so that the nuts are still there but under the nuts as a spring and it just presses down that top plate and
there we go that slightly better and I also realized that the once you cut the aperture and the the Viton a handy thing to do is to super glue it to the chip so therefore it becomes like an a monolithic you know thing and the Viton isn't going to be slipping off the chip etc and I ended up using little strips of white on with the hole cut in the end so you could put it in and line it up with the the aperture that the acid is going to jet through so this was a an
early mask simply cut with a scalpel but you can use handy things like leather punches and and things like that and this is this
was the first trial so this was I think this is an MSP chip little TI MCU and this of this was the first school and actually the results are not too bad it got a little bit close to the edge because it wasn't particularly well Elaine's and my aperture is a lot larger than I actually needed for the died and actually that's one useful thing about doing x-rays are doing the plink plink fizz is that you can actually find out exactly how big the die is and where the die is in order to do some alignment so
I set back to this guy remember what I
want to do is intersect these five lines going from the large central chip to the chip on the left so we can we can sniff the data between them so this one was
close but it went too deep so you can see the bond wires connecting the two and but we actually ended up going underneath those chips and destroying the the lead frame that was providing the interconnects to the outside world so that one was a bust however on this one it's just right take
it down just far enough to expose the bond wires tell our eyes to tap on to know I'm actually just gonna quickly
jump back here so there are some issues with this initially one of them was the ear so I got the aquarium pump and I put a valve in so we I can adjust the floor and then I quickly realized that actually that's available and the best thing to do it for me to do is to try and remove all the variables so the the little valve chemo and the pump was simply on max all the time I another variable was the temperature so I though I thought I was getting the temperature right I wasn't so I've got a hot plate again from eBay I had a thermocouple probe which was supposed to be acid resistant and certainly was not no no I went through two before I'm like okay I so I simply made a long tube and sealed the bottom of it you know with a blowtorch and injected a thermal transfer compound into the bottom of it put my thermocouple in there so when I eventually eventually I'm gonna write this up after corn you'll see the pictures and you'll see that third probe or that third probe penetrating the stopper so my acids is at a known concentration my temperature is at a known setting my pressure is a known setting so I my only two other variables at that point are the permeability of the epoxy to the acid and time so it becomes pretty controllable so that was about three
minutes and that is a minute and a half
one minute thirty seconds and it will always do this I've done 20 chips like this I spot on one minute 30 seconds this is where you get to and that was absolute perfect for us to micro pull one two the bond wires and actually sniff the data passing through so I will
publish the results of that and I and the design we're gonna open source to the design for the Decapitator so that you guys can have a go at it as well and you know you can start micro probing eye sees that are actually running and silicon is the last bastion of security you can pull hard drives and analyze them you can sniff memory everyone know are trying to lock away their secrets and silicon that's where they hide the keys so we need to be making moves in this area the kit is very expensive Christian auskey is very well known has been a fabulous business of this however he has a lab with millions and millions of dollars worth of equipment he is not shopping on eBay actually that's not true you may well be but what you buy used fat fab equipment which is a real of on TV it's still coarse million dollars for your fib focused ion beam device sorry cable money yes exactly so so in a week's time or so I'll I have written this up and hopefully I I want to get to the point where we have a set of plans that you can just take and build and possibly we might try and put together some kits that you can buy and and screw together and and d-cap away so that's it
for me now I work from code monkey over here and and remember just to recap
the feeling no after that tada there we go okay
lovely so now I know what the smell is coming from his office anyway strange stuff okay so at this point he handed it over to me and he's bye okay so you know we're doing the probing and we're doing the you know we got the decapping working and so on now we need to get the actual code out we can sniff the data going between these two buses but how about extracting the actual code that's running on the chip we want to see what instructions what it's doing with that data now that the difference between masks from and the programmable chip is a mass ROM chip it's hard it's hard wired into the chip so it never changes every chip is identical it never gets programmed it's actually manufactured the instructions are manufactured into the chip so that the the challenge is how do we read the maths wrong well as I mentioned you know we identified the image the the part of the image that is the mass ROM which is this and then we look at it and we say okay well there's an obvious pattern there can we actually read it so maybe if we look at this and say well is that a 1 or 1 0 so a 1 1 1 0 1 0 1 0 1 0 1 1 so yes we can that's binary data if I just take that and turn it into hex there's my instructions right so if I okay this is just way too obvious this must have been done before someone's already doing this and in fact there's some code some very smart code that deals with even smarter images than this called DK anyone anyone here played with or heard of DK no ok so there's an open source of one guy at the back I guess not a lot of people actually play with this stuff so but the guys who polished the chips off developed this package called DK and what it does is image recognition so you look at what they were doing was trying to figure out a crypto algorithm so they had a bunch of gates and they were looking at all gates and then gates and so on and they wanted to build a pattern of what the chip was doing so they used pattern recognition so they would take the picture of an or gate and say right that's when or gate find all the other or gates here's a NAND gate find on the other end gate and they package it up into this cool bit of software which will then spit out a graphic representation of what that logic circuit is doing fantastic that's gonna be easy then I'll just point that code at this and we'll read the the mass ROM and then we've got the code in fact when I started playing with it I couldn't find anything in there for doing a simple here's a mouse ROM read the data please so I thought I was being thick and I emailed the authors and they said ya know we've never done that we couldn't think of a use case for it it would be easy to do but ya know we haven't done it so I'm like damn it okay who else has done this kind of stuff ok the main community now they're constantly reading roms and getting games and any of you guys actually involved in main yeah main hacking not a lot any of you use it have it play it yeah that's more like it ok so again I reached out so the main community and said well how do you guys do it and they said how it's really simple what you do is you take a picture you divide it up into chunks you send it out to hundreds of people and they say they're looking at it typing 1 or 1 1 1 okay so slave labor basically that's how they do think the technical term is crowdsourcing crowdsourcing yeah so very cool and it works obviously cuz we end up with with lame games that we can play but I really didn't want to sit there typing in 5k of ones and not 5k bikes everyone's a nought and I couldn't crowdsource it because this was a confidential project in fact you're not allowed to look at this so you never saw this okay so what to do so I thought okay well we know how to do it it just isn't in D Gate I'll just do it with image recognition so I'll write a little bit of code that does this and I use open CV which is fantastic image manipulation code makes stuff like this an absolute bottle all the hard work is done for you it's in Python which rules because I love pie yes it must be inviting if it doesn't work in Python it ain't worth payment that's my philosophy but then I thought well actually if you look at this image there's lots of problems with it so we know what the ones are nots look like so these guys a bright dot is a one and the absence of a bright dot is a zero that's pretty simple but there's a lot of clutter as well there's all this crap you know so you've got these lines we've got what look like columns of data so here we've got a chunk which is obviously data and then you've got a separator then you've got another chunk and then you've got a separator and so on you've got all this crap at the top you've got these lines that go along horizontally between the data so I figured I'm gonna spend so much time trying to get the code to tell the difference between good data and bad data that I'm not actually going to be able to successfully automate this process so then I saw okay the hell with it I'll semi all to meet the what I'll do is automate the process of creating a way of reading it cleanly and then automatically reading what's done so I created a thing called romper which is ROM parcel I'm going to switch this screen to my laptop and I apologize I hate doing this and sitting down and speaking from behind a laptop but because I'm going to be doing a lot of mousing and fiddling I'm now going to
disappear for you guys bye that's hardly wrong they promise me I'll just come straight off so the laugh is when we were in the green room and testing it with the projector in there it was my laptop I was up left right and center he was like yeah mine's played we got bags of time just talk amongst yourselves yeah go for quest me hey the question was I had a glob tops and impacts and a glob talks are I is it a chip on board you're talking about yeah okay so it's so that that the industry term is a CEO beat ship on board so basically the die is placed directly on to the PCB and then it's die bonded across and then they drop a drop of very runny epoxy to actually who's gonna reboot and solidify so we haven't tried those I mean we've tried them in to the point that we've decap using the plink plink FISMA that things like a sims which are so heavily armored in the silicon is unbelievable so you can see are all the chips we've seen here they look great you can actually see you know the pathways and areas on the chip if you look at sim which is intended to be secure silicon the top of it is just pretty much a layer of gold armor designed to disable the chip if he penetrated interesting of it may well be possible to do with the Decapitator because the dekappa DS that ended up being such a useful tool I could actually decaffeinate the chip so initially I was taking the chip off the PCB putting it through the Decapitator putting it back on I was actually able to to get to the point where I could decapitate the chip while it was still on the PCB so I was putting whole PCBs into the Decapitator and pitting that one chip and yeah that was that was pretty cool I thought it may be possible to do and it turns out it totally is I mean the boards were very small so if you had a larger board you're gonna have to have some sort of support structure but it's totally totally doable I only so the question was sometimes they're almost spherical does that impact the time add to edge and the answer is yes the simply the greater the depth of epoxy the more time it takes well so you're you're almost never to be able to do this and get it right first time around so expect to go through a few chips until you actually work out okay it's gonna take X
amount of time yeah so expect to go
through a few chips before you actually work out okay actually you know not in that case it's gonna take me 1:30 to actually get to talk we don't want to be okay major cool thank you demo gods are with me hopefully so fun okay so if you remember the original image we had columns of data and basically what you have to do is look at those columns and try and figure out exactly what you're trying to create so my idea was I'm gonna create a grid over the image and where there's an intersection because it's all nice and neat rows and columns where there's an intersection that's a point of interest and if there's a dot there that's a one and if there isn't a zero and if you're outside the grid just ignore everything so Rafa you tell it basically the image name the number of bits in your horizontal line and the number of rows the number of lines so if I say romper I counted 16 in each column and I'm gonna do two rows at their time you'll see why this is relevant in a minute so if I go back to the original view so
basically this is our image and I reckon there's 16 bits in each of these sections so the first thing we do is
apply just a color filter and I can actually filter it to try and get the dots down a bit smaller because we remember we're trying to identify whether it's there or not so now what
the tool allows you to do is create this grid so the first thing I'm going to do is say okay this column here is my start column hopefully you can see a little blue line as appeared can you see a blue line on there no okay
can you know yeah so here's my final
column 16 because it's nice and even it's drawn in the rest of the lines for
me so that's two mouse clicks so far so now here's my first row and here's my second row remember I said there's two in each row so again if I get rid of the
image we've now got a little grid which is two sets of intersections and now if
I just say okay here's another group and here's another group here's another group so we're very quickly building up
our grid I'm gonna do this fully so bear
with me a second
okay that's enough but you see how quick it is to do so we're down to you know a few dozen mouse clicks to create a grid that matches that entire thing so if we now go back to the image what I can do is say okay wherever there's an intersection tell me if there's a bit there or not so I'm going to do a read and it's now gone yeah I see a bit there these guys don't quite line up we know that this pattern is completely the same you know it's a repeating pattern so all of these lines should look the same so what I can do is click on this guy this is just me being slightly inaccurate when I'm clicking the mouse I try and center basically when I click on a mouse on a dot I try and automatically Center the line horizontally and vertically the problem is you can't really tell with a mouse where your exact click point is what I ought to do is change the cursor to something more accurate but I'm just I'm lazy and it kind of worked and it was quick and easy so so if I now go into edit mode I can just move that line till it lines up a bit better move this guy or if it's out horizontally I can move it that way and that way that's guys but you get the idea so we can now mess around and try and create the grid that perfectly lines up I can go back to looking at the original image
if I think that's a bit clearer it's kind of hard to see what's going on so again I just thought well I'm trying to automate this process and I'm not trying to fully automate it I'm trying to send me automate it so I'm gonna do things that make it easier for my eye you know the human brain is very good at processing images and pans so I'm just going to make it as easy as possible to for my eye to process this stuff so you can do things like switching off the grid and checking what's underneath switching between the original and the
masked and then I have this nice mode called peephole mode so you get rid of
everything that's not an intersection and if we also get rid of the grid you can now see well this guy is not lined up at all so if I go and edit him I can quickly line that up and you see when you're dead on and there's a nice round dot in the center of your thing and if I reread this is where it all gets probably wrong because I'm not just
playing the grid put the grid back on we've now got a clean read of those four bits yeah we also want to try and make sense of the data so in this particular case we knew that an unused piece of ROM has a hex value of c1 so what looks like if I come out of peephole mode and we
look back at the original image there are these big chunks of unused data here okay so here's obviously program and here is nothing and this repeating pattern therefore we would say that must be c1 so what we should see here because it's 16 bits I'm hoping as c1 c1 now the quick amongst you will have noticed I couldn't get that but so what I can do is say okay take these bits and she showed me a hex value I'll get rid
of the mask and the image reduce the
font so I can read it and here we have the actual values that are decoding for each of our groupings and clearly that's wrong so what the hell's going on so if
we go back to our image turns out see
these guys here these are lead wires coming in to read a column of bits and if you count them one two three four five six seven eight and if we were to scroll down and look at the bottom of the image there's another set of these coming up and they're interleaved with these guys so what we've actually got is 8 bits interleaved with another 8 bits so what we're gonna have to do is come out of here go back in say yeah actually
it's not 16 it's eight and we're gonna start again
with a
and now you can actually see okay so those apertures basically the the automatic aperture sized is is based on the size of the gaps between the lines so I can actually reduce those a bit if it's over reading will adjust this guy just that's how you can flip bits as well obviously and actually here you can see how useful peephole mode is because
when you're trying to manually check if you've got an or or a one in the right place and you've got all these other dots interleaved with these guys sometimes it can be quite confusing so if I if I go into peephole mode all the
extraneous imaging that my brain doesn't need to have to deal with is being removed and I can just look at only the dots I'm interested in yeah so that really helps and if we go over here and again show the hex values skip rid of our image so we can't read it it won't create and there we go there's our seat once thank you I'm so yeah that was quite a satisfying moment it's like it actually works so we can dumb that to a file and I've already done that so I now have a hex file which if we go and look at that this is only a tiny
portion of the code obviously but it's enough to show you that without my client having to put a hit on us okay so here we have our c1 so lots of little
blank areas so at this point it's like okay we've got the code we've extracted the code from the chip now what we need to disassemble it okay well that's easy it's a published device it's this particular thing is called the mark 4 I'll just go and download a toolkit developer's kit and disassemble it so we had to look on guess where he Bay and no we came up nil zilch so we widened the search and used the Google and the Google said yeah we can get you those it's a two hundred dollar product that stopped being produced about 20 years ago so to you I like your face 25,000 so like no thank you so we did find the manuals so we had the instruction set and we had you know how to convert it so we just sat down with
it well right all right so my friend Python comes in again so mark for dazzle was born and if you point Mike Ford azzam at a file it does something like this
so basically if this is gonna be slightly nonsensical because it's only a small chunk of the code so what it'll give you is a little summary of ROM addresses and labels things that have jumped to that address if nothing if it's obviously a subroutine with an exit but nothing calls it it's an orphan but if it's a known address like an interrupt a bit of interrupts code it will give it the correct label the other really handy thing which meant we could tell when we found the beginning of the program is there are these two guys that always have to be there there's a routine called Auto sleep and it sits in a little tight loop just waiting for an interrupt and there's a routine called reset and reset is actually what c1 is doing c1 is a jump to the address where reset lives so if your code goes mental and your program starts running off into oblivion eventually it will hit a C 1 and C 1 will reset the chip so all the blank space in the code is a jump to reset which I thought was a really smart thing to do so instead of just being a null not so no you get a little summary of what it's found you get somewhere variables and then you get the actual disassembled code which is wrapping horribly because my screen is too small
yeah so my disassembly gives you the instruction in the format that the original compiler would have done it so you could run this through the compiler if you wanted to if you had one and here's also sleep it does a not it does asleep sets branch and Karie and then it just jumps back on itself and it sits there waiting to be interrupted here's our reset sets up a stack sets up the return pointer and then jumps to 0 and off you go so we knew we've correctly identified the beginning of the code awesome how do we know we've actually read to coat all the code properly well they helpfully put a checksum at the end now it's wrong in this case because this is only a partial chunk but here's the checksum embedded in the the ROM and
here's the calculator checksum that the
disassembler gave us and if they match then we got it right everything's lovely ok one of the other things we really wanted was to be able to run the code and see what the hell this thing's doing we've read the EEPROM so we know what the data that's gone in but we don't know what it's doing with it so we could set and try and manually step through this or we could write an Ida Pro plugin or something cool like that again the development kit would have had an emulator in it 25,000 we're not going to buy that so actually oh yeah I did find a copy of the solar for the dev kit uh it was in German and it was on a Russian website so we decided to give that one a Miss so yeah python is your friend
a whole chunk of this has been cut off but I have to say I was absolutely blown away when he showed me this this is cool yeah so we can single stack the code we can set breakpoints on read or writes on the output port over here you can see you've got all the registers the stack it's got two whole variables x and y so really powerful chip we can set break some things like branches and and so on and we can just go off you go and it will just run if I take that break off it's now sitting in its little loop then you can see the branch you remember that instruction that set branch or carry and then jump to 0 that's what we do and I will probably crash it if I now generate an interrupt point yeah so it's jump it off into code that doesn't actually exist because this is only a partial fragment of the code but this gives us now the ability to run whatever we want we can feed the data in virus sudo EEPROM which is plugged into this and so we now completely own that chip and all the code that was in it and all the data it was chewing on so that's it thank you thank you sir just before we go to questions one of the cool things about this was the manufacturer was so super secure in their belief that no one was ever going to get the data off this chip i/o its master all no one can read Mass wrong once we once it gets its fuse blown their diagnostic routine that allows them once the chips assemble to verify the cord and then they blow a fuse them is gone so couldn't possibly do it no way to read it out because you know with flash you have the ability to read out but but here is math so you need that facility so it just checks the shake song yes okay okay King gets turned off the interconnect between the MCU and the EEPROM again all inside the package yeah no there's not exposed to anyone no one is ever going to get the code off as EEPROM and it just shows you what you can actually achieve and how really some of their thinking is so let's say take some questions for you guys just a tiny addition to that so sometimes we send chips off to people to do stuff like this for things that we couldn't handle before we did this and we ask them okay we got a mass ROM chip how much with that be mass ROM that's tricky 10,000 per chip to give you the code and it'll take three months yeah and that chip the chip we asked about where 512 bytes master on this 5k and actually I think he was actually 25,000 bucks it was horrendously expensive okay while we've got your attention this is unrelated but our next project which we will be launching on Kickstarter so get your camera and take a picture of that QR code that's my blog entry which I posted about an hour before we came in to give this talk that describes exactly what it is it's a software-defined which is the trendy buzzword at the moment but for RFID so this does the same thing for hafidh as stuff like hack RF does for RF so you can access to the low level raw data you do whatever the hell you want with it within a day of building it we were cloning and emulating pretty much anything we could put in front of it oh it's cheap yeah 30 pounds maximum well so depending on the complexity of the chip the chip manufacturers actually do put a lot of security features in place so they will bury things in layers so it won't be on the top layer yeah it'll be yeah eight layers down Angela I've put a security layer over the top a security mesh which is designed to destroy keys I if it's if the chips pirated it's damaged in any way so there's actually that and when we first put into we were actually kind of quite pleasantly surprised that the chip manufacturers actually take security seriously of course what they're trying to secure is their customers IP so we tend to find that we do a lot of embedded systems reverse engineering normally a lot of the security is crap so they're they're taking the crown jewels the super-secret polite word for it yeah there's super-secret master keys and they're storing them in ships that aren't really designed to secure you know keys and things like that so we looked at a an RFID vendor and they are kind of latest and greatest product and they store their keys in the pig ship and we sent it off to slightly dodgy company and they said oh that will be 900 sir and they sent us back an entire time at the code and including all their super-secret keys and we've had chips reversed that have cost as little as 90 bucks so if you have a cheap pick ship 90 bucks will get you the court so they're tending to with the higher-end ships actually put some effort into into trying to prevent this from happening proper on by security
this basic problem not just oh hi hot mic not just the physical expertise for pulling apart the chips but the software it's a mazing combination thank you that's a misspent youth yeah for for those of us with that said I'm curious is sort of the amount of time you have poured into this project into n surely they were you know from the safety luxury you took your time did your research and the Python codes spitting by um maybe what's an afternoon for you as a month for the rest of us okay but what's what's your Tunku like well we've been doing this stuff between us for twenty years so it's a bit here and a bit there I don't know if you actually sat down and tried to do it in one chunk I don't know but the whole point of stuff like this and Decapitator is we're trying to solve those problems and then step everyone forward you know we need to move into a situation where you guys can get up and running within a week not a year I mean I guess how long did we start on assets so I better say sorry guys I would have said probably this one project can have opened it they kept kept diving into new areas silence said probably I to get to the point where we had the Decapitator and we were extracting data and rompe arbors and existence maybe six months from from starting from a hard cold start and it wasn't as if it was we were working on this full-time for six months it was six months elapsed and it was a background project that was kind of taking over around so actually yeah probably if you sat down and just focused on it probably something like a like a month to to end up where we were that's fascinating thanks for sharing thank you I guess great is great stuff I love it um I have a question about a have a chip implementation question in a lot of the microcontrollers like the pigs nanos you mentioned there's fuse bits that the manufacturers can set like so burn your code verify the code blow defuse myths and the whales can read it would it be possible with the Decapitator and the probes to reconnect a fuse rather than having to read all the data back out of it absolutely sweet so and in fact a guy called bond equine did go have a look at his blog he was a little demonstration it was fantastic so he he handicapped paint chip and he maxed out he worked out where the fuses were and realized that the fuses had been covered by a little metallic gold plate and he realized that okay you're covering it with a plate but there's still a passivation layer in between the plate and your actual I can have fuse which is effectively a transistor so what he realized was right if I mask out all the other UV sensitive parts of the chip but I could have had an angle I can get the UV to bones under the shield just could and discharged a little transistor and he could read the data right so there are there are companies around that will go a lot further and will really dig for you and as y'all know related note we've used the Decapitator to drill a hole and then his very precious micro probes to selectively break wires and then probe on and actually feed our own data in instead of what was supposed to be coming from the other guy and the feeding machine so we're all about getting this into the backroom economy so you can do this yourselves so where where would we have got the thing that sends the data into these probed devices do you think not eBay no we got to come sparkfun than it costs like thirty pound and it's called the bus pirate hi this is amazing work I have to say the gentleman before me actually asked the question I was going to ask so that's easy but a quick comment about hydrogen fluoride you can add an alternate source as well which is fairly safe is these stuff which used for etching glass and it's not an Angele format in a cream form I don't know if that's also usable for the same thing oh I almost certainly I hadn't come across that I'll certainly have a look at that yeah I mean now if that may well be a better source of it than the dental stuff and I used to work in a lab where they have the real stuff and scary is an understatement in the lab of 30 people only one person was allowed it it had its own it had its own lab which was cooled to below refrigeration temperature and not only did it have a fume cupboard the actual lab was an additional fume cupboard as well it was just insane that way you got both your hands in your pockets thank you thank you hi um you said CRC right as opposed to a more sort of secure algorithm oh the checksum yeah the checksum was actually quite interesting and it's documented and obviously that the code is available you can go to the Aperture labs tools page and the mark for TASM is linked off there you can download it and if you'd like python you'll probably puke when you read my code but the checksum is actually two checks on the left-hand byte is a left-hand checksum and the right-hand byte is a right-hand checksum and they just do a slightly funny wondering algorithm that would definitely go wrong it's just there as an assurance to make sure that the code that was that runs on the so they all have a test routine that will run through and read the wrong before they blow the fuse calculate the checksum and make sure it matches so it's not going to try and recover any lost bit so just say yay or nay yeah and the fuses is they are only to disable the test routines for the chip so can you generate the CRC after the fact to make sure it's still good yes in fact that the disassembler my disassembler will show you what was stored the last two bytes in the rom are the checksum and it will also recalculate and tell you what those came out us so you can see if they if they match is this can you poke a running chip to get it to give you the
checksum or is it only this stored in the end are stored I mean can you get it to calculate the checksum you there is a test routine built into the chip right as the chips have there's two chunks of code when you look at the chip there's the chip that the customer put in and there's the chip that sorry the code that the I put in the code that the manufacturer put in and the code that the manufacturer puts in no cleaver Theory does it actually sorry I was the screen
resolutions wrong so you couldn't really see what that was but that the code the manufacturer put in will check it for you but it then gets disabled once they've done their test okay possibly you could run it with the 25,000 emulation thing but we never thought that I was wondering if you could use it as the new Torah and Oracle to glitch out perks of it as it was calculating but not if you can't I don't think so but yeah nice idea yeah thank you by the way that screensaver did anyone recognize what that was yeah so again to know if it's on is it on the the aperture allows page I don't know but in my blog I have a blog about writing the Python code that went and grabbed the last frame of every episode of The Big Bang Theory so that I could have a screensaver that has those in it and the code is published and if you want to save time so are the copyright infringing images brilliant work gentlemen I noticed that when you ran the the romper program you used the original non fluorinated versions of the chip you didn't use the etching compound before and after yeah for that image for that particular process we had already finished by the time Zack perfected his technique I was already working on the original images and in fact the reason he looked at cleaning it up was because I was having difficulty with some of the bits it was not actually clear whether it was a 1 or a 0 and I couldn't determine looking at it so I couldn't even correct it myself because I was just guessing it yeah I don't know how much time we have left is there a speaker optical in here they said that we're the last top so we can go as long as you guys can stand us so it will work with betting between you and beer is us so it will work with both then okay so it will work with both whether you oh yeah yeah yeah absolutely and it's just how clean can you get your image okay I think that was the last question anyway so thank you
Feedback