Dirty Decapping

[orion242]

http://dangerousprototypes.com/store/decap

Anyone else use the service?

Awaiting a few samples and starting to think its complete bull $hit.

[sleemanj]

Dangerousprototypes are not bullshitters, completely the opposite people are sometimes put off by thier blunt frankness in thier "dirty" services.


That said contact can be hit and miss, try in thier forum.

[orion242]

I have been in contact with them...going on months now.   They respond promptly.  Everything else I purchased from them has been top notch, no complaint.  Hoping this is just a one off fail.  Its been almost 4 months now, granted some of it self induced with cheap shipping.  Even still the 3-5 day turn around is turning into 3+ weeks after confirmed delivery of a second set of samples.

[orion242]

Well aware it low res, fine for what I want.  Could do it myself, but for the price it not worth the hassle let alone I'm out of samples now.

[rsjsouza]

If you already have a good microscope, then you can decap chips on your own. You don't need nasty nitric acid to do so. 98% sulfuric acid and solid NaNO3 will do the trick. The salt, when combined with H2SO4, forms a dynamic equilibrium between NaNO3+H2SO4 and NaHSO4+HNO3. As temperature gets higher or as HNO3 gets consumed, the equilibrium shifts to the right hand side.

I've used this to decap some power mosfets, from ultra thin DFN8*8 to TO247. It's a long process with high temperature and highly activated corrosive chemicals, so ventilation and gloves as well as protective eye wears are crucial. Besides, this is a fairly safe experiment.

blueskull, the way you put it sounds soooo safe...

[Brumby]

blueskull, the way you put it sounds soooo safe...

I look at that as the same principle as working with mains power ... treat it like it can kill you if you mess up.

[SeanB]

With kJ energy that AED will remain a wall ornament. You cannot restart well done steak.

[orion242]

Well I finally got them, and can't complain too much.  Sent the first set of samples as a normal USPS letter back in Sept.  Epic fail.  Second set went priority express.

Look great.  Sent in a real device and a suspected fake.  Not really sure what to make of this.  Not the same, but their is the analog logo on both die.  Can't see anything that looks like galvanic isolation on the top sample, bottom its clearly magnetic.  Must be some other random AD part with an identical pinout, no isolation and 1/10th the cost...

These are both supposed to be an ADM2483. 

[CJay]

WEll the lower one with the intriguing 'whirls' seems to have ADM1028 in the upper right corner and it's a remote thermal diode and linear fan controller if that's the actual device.

So, it's been re-marked

[orion242]

Bottom is the real sample, purchased from digikey.  The coils, I'm guessing, are windings they are using for the galvanic isolation.  Not much too it.

The top sample has 10 pounds of crap in the 5 pound sack compared to the other.  Both chips where identical in marking and I'm pretty sure the pin out was identical though I'll recheck tonight.

This is the digikey chip next to the harvested suspect.

[Oldtestgear]

I used to work in the semiconductor industry (with OEMs & then a niche bare die disty) & we were regularly asked to give an opinion on whether a device was a fake OR a different mask revision. If we had access to the genuine die layouts this was easy. if not then it was a problem. Several (totally reputable) IC manufacturers had one mask set that was used for a range of part numbers. Fair enough for analogue parts BUT this was also done for a few complex digital devices that happened to be wire bond options of one generic type.

Fun days..............................

[orion242]

IC manufacturers had one mask set that was used for a range of part numbers. Fair enough for analogue parts BUT this was also done for a few complex digital devices that happened to be wire bond options of one generic type.

Interesting.  Figured this was a quick way to spot a fake.  This is the die marking on the real unit, its not 1023.

Dirty decapping gives you close up shots of all the markings.  Besides taking 3 weeks to turn it around, they did a nice job for the money.

[MadTux]

You can do dirty decapping (device is dead afterwards, you only need die pics) for a lot less than $75.

All you need is some 98% sulphuric acid, a test tube, a candle or similar heat source, some pliers, 15min time and a cozy place outside. Dump chip together with a few ml's of conc. H2SO4 into test tube, boil the s**t out of it, dump in in cold water and look at it on a microsocope. Sometimes a bit of IPA/acetone is helpful to remove any leftover crud on the surface of the die.

All the plastic and the copper gets oxidized by the hot acid, which produces quite a bit of smelly/toxic sulphur dioxide. The die is protected/passivated with a thin layer of silicon dioxide, which even hot H2SO4 does not attack. Thereby no special skills are required. The die won't get any damage, if you cook too long. I've done it a few times with (cheap) china chips, always worked great. My microscope could be inproved however, it's about 100years old

[Mr. Scram]

You can do dirty decapping (device is dead afterwards, you only need die pics) for a lot less than $75.

All you need is some 98% sulphuric acid, a test tube, a candle or similar heat source, some pliers, 15min time and a cozy place outside. Dump chip together with a few ml's of conc. H2SO4 into test tube, boil the s**t out of it, dump in in cold water and look at it on a microsocope. Sometimes a bit of IPA/acetone is helpful to remove any leftover crud on the surface of the die.

All the plastic and the copper gets oxidized by the hot acid, which produces quite a bit of smelly/toxic sulphur dioxide. The die is protected/passivated with a thin layer of silicon dioxide, which even hot H2SO4 does not attack. Thereby no special skills are required. The die won't get any damage, if you cook too long. I've done it a few times with (cheap) china chips, always worked great. My microscope could be inproved however, it's about 100years old

There are plenty of things people could do themselves, yet where prefer to pay to have someone else do it for them. It's not always about just money.

[orion242]

I may give that a go at some point, but the math is still pretty good in my book.

I have a fume hood at home for soldering.  Not a lab grade chem resistant job, but plywood with ESD matting and a 600cfm variable speed fan.  I have board pre heater, stereo microscope, soldering iron and hot air station all in it.  Works great to exhaust any fumes and prevents the wife bitching.

If I don't move all that crap out, just the fumes from the acid will eat the living shit out the equipment. Rusting the hell of it at a minimum.  If I go through all that hassle to unplug and move all out everything, the fumes are still likely to eat up the galvanized duct work, steel fan and any other metal part on the way outside.  If I'm lucky it will even attack the siding on the house.

I could also go outside, but its winter here and dicking around in the snow doing this isn't my idea of a good time.

All that aside, I could go thru all the hassle only to find out my microscope / camera is utter shit for this type of work making the whole exercise a total waste of time.

If someone else wants to do for $75 and can match their quality, let me know.  Thinking of sending another round of samples.  Would prefer a US based outfit, but I'm thinking there is a reason China is the only place in town for that price.

[Twoflower]

I wonder if you got both parts of the real ADM2483. At least from what I understand the device should have a transmitter and a receiver part. To get the insulation this isn't done on one die. There supposed to be a second die on top (insulated by a insulation barrier) to couple in to the three coils. The coils don't have a second winding and the die has only 8 pads, while the package shows more used pads. So you have the 'logic side' there.

[orion242]

Hmm.

I was guessing.... what I was looking at was one side of the of the isolation.  The 8 pads connect to 8 pins on one side or the other of the IC and the opposite coils and pads must be on a lower layer.  Seems reasonable way to construct such a device, but I know as much about brain surgery as IC manufacture.

[orion242]

I wonder if you got both parts of the real ADM2483

You might be onto something.  Another chip with the icoupler technology.

[Red Squirrel]

Wonder if you'd get any significant details at their resolutions doing a computer processor like an Intel chip.

Would be interesting to see what's up with the whole ME backdoor stuff and the rumours of a hidden 3G radio.   Someone who knows how to "read" dies could perhaps shed some light on what might be going on with the backdoor and perhaps even be able to find out how to disable it.  Like covering certain pads or something.

[Mr. Scram]

Wonder if you'd get any significant details at their resolutions doing a computer processor like an Intel chip.

Would be interesting to see what's up with the whole ME backdoor stuff and the rumours of a hidden 3G radio.   Someone who knows how to "read" dies could perhaps shed some light on what might be going on with the backdoor and perhaps even be able to find out how to disable it.  Like covering certain pads or something.

Why on Earth would you stuff a 3G radio in a closed metal box intended to keep exactly that type of radiation in and out? Especially considering you have the Intel Management Engine, which provides low level acces to all the components anyway. You have access. Why bother go give yourself away by radio transmissions anyone with a $25 dongle could pick up?

[Freelander]

Wonder if you'd get any significant details at their resolutions doing a computer processor like an Intel chip.

Would be interesting to see what's up with the whole ME backdoor stuff and the rumours of a hidden 3G radio.   Someone who knows how to "read" dies could perhaps shed some light on what might be going on with the backdoor and perhaps even be able to find out how to disable it.  Like covering certain pads or something.

 

[stj]

you can keep your tinfoil,
the 3g interface of the v-pro chipset was originally bragged about by intel in it's corporate marketing bullshit.
it was sold as a way to "remote-kill" lost or stolen devices with critical data on them.

they only shut up about it after people started seeing all the other possible uses.

[ebastler]

the 3g interface of the v-pro chipset was originally bragged about by intel in it's corporate marketing bullshit.

Reference, please?
(A publication from Intel, not some second-hand conspiracy article... )

[stj]

i'm sure you know how to search intel's ark.

[ebastler]

i'm sure you know how to search intel's ark.

You mean, like so?
https://www.intel.com/content/www/us/en/search.html?query=v-pro 3g

I come up empty, and you are the one who made a bold claim...