Dirty Decapping

[orion242]

http://dangerousprototypes.com/store/decap

Anyone else use the service?

Awaiting a few samples and starting to think its complete bull $hit.

[sleemanj]

Dangerousprototypes are not bullshitters, completely the opposite people are sometimes put off by thier blunt frankness in thier "dirty" services.


That said contact can be hit and miss, try in thier forum.

[orion242]

I have been in contact with them...going on months now.   They respond promptly.  Everything else I purchased from them has been top notch, no complaint.  Hoping this is just a one off fail.  Its been almost 4 months now, granted some of it self induced with cheap shipping.  Even still the 3-5 day turn around is turning into 3+ weeks after confirmed delivery of a second set of samples.

[orion242]

Well aware it low res, fine for what I want.  Could do it myself, but for the price it not worth the hassle let alone I'm out of samples now.

[rsjsouza]

If you already have a good microscope, then you can decap chips on your own. You don't need nasty nitric acid to do so. 98% sulfuric acid and solid NaNO3 will do the trick. The salt, when combined with H2SO4, forms a dynamic equilibrium between NaNO3+H2SO4 and NaHSO4+HNO3. As temperature gets higher or as HNO3 gets consumed, the equilibrium shifts to the right hand side.

I've used this to decap some power mosfets, from ultra thin DFN8*8 to TO247. It's a long process with high temperature and highly activated corrosive chemicals, so ventilation and gloves as well as protective eye wears are crucial. Besides, this is a fairly safe experiment.

blueskull, the way you put it sounds soooo safe...

[Brumby]

blueskull, the way you put it sounds soooo safe...

I look at that as the same principle as working with mains power ... treat it like it can kill you if you mess up.

[SeanB]

With kJ energy that AED will remain a wall ornament. You cannot restart well done steak.

[orion242]

Well I finally got them, and can't complain too much.  Sent the first set of samples as a normal USPS letter back in Sept.  Epic fail.  Second set went priority express.

Look great.  Sent in a real device and a suspected fake.  Not really sure what to make of this.  Not the same, but their is the analog logo on both die.  Can't see anything that looks like galvanic isolation on the top sample, bottom its clearly magnetic.  Must be some other random AD part with an identical pinout, no isolation and 1/10th the cost...

These are both supposed to be an ADM2483. 

[CJay]

WEll the lower one with the intriguing 'whirls' seems to have ADM1028 in the upper right corner and it's a remote thermal diode and linear fan controller if that's the actual device.

So, it's been re-marked

[orion242]

Bottom is the real sample, purchased from digikey.  The coils, I'm guessing, are windings they are using for the galvanic isolation.  Not much too it.

The top sample has 10 pounds of crap in the 5 pound sack compared to the other.  Both chips where identical in marking and I'm pretty sure the pin out was identical though I'll recheck tonight.

This is the digikey chip next to the harvested suspect.

[Oldtestgear]

I used to work in the semiconductor industry (with OEMs & then a niche bare die disty) & we were regularly asked to give an opinion on whether a device was a fake OR a different mask revision. If we had access to the genuine die layouts this was easy. if not then it was a problem. Several (totally reputable) IC manufacturers had one mask set that was used for a range of part numbers. Fair enough for analogue parts BUT this was also done for a few complex digital devices that happened to be wire bond options of one generic type.

Fun days..............................

[orion242]

IC manufacturers had one mask set that was used for a range of part numbers. Fair enough for analogue parts BUT this was also done for a few complex digital devices that happened to be wire bond options of one generic type.

Interesting.  Figured this was a quick way to spot a fake.  This is the die marking on the real unit, its not 1023.

Dirty decapping gives you close up shots of all the markings.  Besides taking 3 weeks to turn it around, they did a nice job for the money.

[MadTux]

You can do dirty decapping (device is dead afterwards, you only need die pics) for a lot less than $75.

All you need is some 98% sulphuric acid, a test tube, a candle or similar heat source, some pliers, 15min time and a cozy place outside. Dump chip together with a few ml's of conc. H2SO4 into test tube, boil the s**t out of it, dump in in cold water and look at it on a microsocope. Sometimes a bit of IPA/acetone is helpful to remove any leftover crud on the surface of the die.

All the plastic and the copper gets oxidized by the hot acid, which produces quite a bit of smelly/toxic sulphur dioxide. The die is protected/passivated with a thin layer of silicon dioxide, which even hot H2SO4 does not attack. Thereby no special skills are required. The die won't get any damage, if you cook too long. I've done it a few times with (cheap) china chips, always worked great. My microscope could be inproved however, it's about 100years old

[Mr. Scram]

You can do dirty decapping (device is dead afterwards, you only need die pics) for a lot less than $75.

All you need is some 98% sulphuric acid, a test tube, a candle or similar heat source, some pliers, 15min time and a cozy place outside. Dump chip together with a few ml's of conc. H2SO4 into test tube, boil the s**t out of it, dump in in cold water and look at it on a microsocope. Sometimes a bit of IPA/acetone is helpful to remove any leftover crud on the surface of the die.

All the plastic and the copper gets oxidized by the hot acid, which produces quite a bit of smelly/toxic sulphur dioxide. The die is protected/passivated with a thin layer of silicon dioxide, which even hot H2SO4 does not attack. Thereby no special skills are required. The die won't get any damage, if you cook too long. I've done it a few times with (cheap) china chips, always worked great. My microscope could be inproved however, it's about 100years old

There are plenty of things people could do themselves, yet where prefer to pay to have someone else do it for them. It's not always about just money.

[orion242]

I may give that a go at some point, but the math is still pretty good in my book.

I have a fume hood at home for soldering.  Not a lab grade chem resistant job, but plywood with ESD matting and a 600cfm variable speed fan.  I have board pre heater, stereo microscope, soldering iron and hot air station all in it.  Works great to exhaust any fumes and prevents the wife bitching.

If I don't move all that crap out, just the fumes from the acid will eat the living shit out the equipment. Rusting the hell of it at a minimum.  If I go through all that hassle to unplug and move all out everything, the fumes are still likely to eat up the galvanized duct work, steel fan and any other metal part on the way outside.  If I'm lucky it will even attack the siding on the house.

I could also go outside, but its winter here and dicking around in the snow doing this isn't my idea of a good time.

All that aside, I could go thru all the hassle only to find out my microscope / camera is utter shit for this type of work making the whole exercise a total waste of time.

If someone else wants to do for $75 and can match their quality, let me know.  Thinking of sending another round of samples.  Would prefer a US based outfit, but I'm thinking there is a reason China is the only place in town for that price.

[Twoflower]

I wonder if you got both parts of the real ADM2483. At least from what I understand the device should have a transmitter and a receiver part. To get the insulation this isn't done on one die. There supposed to be a second die on top (insulated by a insulation barrier) to couple in to the three coils. The coils don't have a second winding and the die has only 8 pads, while the package shows more used pads. So you have the 'logic side' there.

[orion242]

Hmm.

I was guessing.... what I was looking at was one side of the of the isolation.  The 8 pads connect to 8 pins on one side or the other of the IC and the opposite coils and pads must be on a lower layer.  Seems reasonable way to construct such a device, but I know as much about brain surgery as IC manufacture.

[orion242]

I wonder if you got both parts of the real ADM2483

You might be onto something.  Another chip with the icoupler technology.

[Red Squirrel]

Wonder if you'd get any significant details at their resolutions doing a computer processor like an Intel chip.

Would be interesting to see what's up with the whole ME backdoor stuff and the rumours of a hidden 3G radio.   Someone who knows how to "read" dies could perhaps shed some light on what might be going on with the backdoor and perhaps even be able to find out how to disable it.  Like covering certain pads or something.

[Mr. Scram]

Wonder if you'd get any significant details at their resolutions doing a computer processor like an Intel chip.

Would be interesting to see what's up with the whole ME backdoor stuff and the rumours of a hidden 3G radio.   Someone who knows how to "read" dies could perhaps shed some light on what might be going on with the backdoor and perhaps even be able to find out how to disable it.  Like covering certain pads or something.

Why on Earth would you stuff a 3G radio in a closed metal box intended to keep exactly that type of radiation in and out? Especially considering you have the Intel Management Engine, which provides low level acces to all the components anyway. You have access. Why bother go give yourself away by radio transmissions anyone with a $25 dongle could pick up?

[Freelander]

Wonder if you'd get any significant details at their resolutions doing a computer processor like an Intel chip.

Would be interesting to see what's up with the whole ME backdoor stuff and the rumours of a hidden 3G radio.   Someone who knows how to "read" dies could perhaps shed some light on what might be going on with the backdoor and perhaps even be able to find out how to disable it.  Like covering certain pads or something.

 

[stj]

you can keep your tinfoil,
the 3g interface of the v-pro chipset was originally bragged about by intel in it's corporate marketing bullshit.
it was sold as a way to "remote-kill" lost or stolen devices with critical data on them.

they only shut up about it after people started seeing all the other possible uses.

[ebastler]

the 3g interface of the v-pro chipset was originally bragged about by intel in it's corporate marketing bullshit.

Reference, please?
(A publication from Intel, not some second-hand conspiracy article... )

[stj]

i'm sure you know how to search intel's ark.

[ebastler]

i'm sure you know how to search intel's ark.

You mean, like so?
https://www.intel.com/content/www/us/en/search.html?query=v-pro 3g

I come up empty, and you are the one who made a bold claim...

[rdl]

It's not yet clear to me whether this 3G ability is built in or requires additional hardware. Nevertheless, the whole vPro/AMT/ME concept is something I find a bit concerning, mainly due to the fact that the PC owner doesn't appear to have complete control over it.

https://en.wikipedia.org/wiki/Intel_vPro#vPro_security

Actually, read the whole article and follow the more interesting links.

[stj]

pc users are under heavy attack these days,
most bioses since core cpu's have been around have a rootkit called "computrace" in them that patches your windows and adds files.
lenovo have another piece of malware in them too.

i have not extensivly looked into other makes but i wouldnt be surprised to find more "espionage" in the bioses.
it's in many phones too. android atleast

[stj]

https://www.intel.com/content/dam/doc/product-brief/mobile-computing-protect-laptops-and-data-with-intel-anti-theft-technology-brief.pdf

Diagnose and repair systems remotely — even if the system is powered off

http://www.dell.com/learn/us/en/19/campaigns/intel-vpro?c=us&l=en&s=gen

[CJay]

3G requires the PC to have extra hardware for the 3G connection, it's a tinfoiler's wet dream because it's mentioned vaguely enough that it can be spun as big bad surveillance state.

Pull the 3G/HSDPA hardware or even just eject the SIM and it's toast.

[rdl]

But the regular ethernet connection still works.

[stj]

3G requires the PC to have extra hardware for the 3G connection, it's a tinfoiler's wet dream because it's mentioned vaguely enough that it can be spun as big bad surveillance state.

Pull the 3G/HSDPA hardware or even just eject the SIM and it's toast.

maybe, maybe not.
you talk about tinfoil, but in the world we are in today i would say that's nieve.
a head-in-the-sand approach is not a wise idea.

[Red Squirrel]

3G requires the PC to have extra hardware for the 3G connection, it's a tinfoiler's wet dream because it's mentioned vaguely enough that it can be spun as big bad surveillance state.

Pull the 3G/HSDPA hardware or even just eject the SIM and it's toast.

maybe, maybe not.
you talk about tinfoil, but in the world we are in today i would say that's nieve.
a head-in-the-sand approach is not a wise idea.

This.

While I can't see how a 3G radio INSIDE a cpu would work that well, I also don't know enough about RF to debunk it.  Wrap your cell phone in foil and it will still be able to take a call.  Wrap it VERY WELL, and maybe you'll stop the signal.  Poke a hole big enough (a few mm?) in the foil, and you're taking calls again.  It's surprisingly hard to block RF.    If there is a radio inside the chip it could very well be engineered  to maximize it's ability to penitrate the shield, via proper placement of antenna etc. 

Or it could very well require extra hardware too, but given this is a backdoor they will try to make this as hidden as possible.  It would perhaps make more sense for it to use a wifi nic as a 3G radio though.  The NIC would probably need to be backdoored too and act somewhat as a 2 way SDR.   There only needs to be one such nic anywhere on the network as rest of communication would use ethernet.

Not really that far fetched in this state of mass surveillance.

Though I didn't mean to derail the topic.  Just would be interesting if someone who knows a lot about dye circuitry looked at many decapped Intel and AMD cpus to look for anything suspicious, or to debunk any of this - as right now it's all a conspiracy theory and not fact, but still important to consider before we can disprove it.

[Mr. Scram]

A problem would be that these chips are terribly complicated. If you indeed have malicious intentions, you might even put in some effort to make certain bits look more like other bits, just in case someone thinks to take a peek.

It's been done elsewhere, where code was very subtly manipulated to drastically alter the behaviour. There's obviously parties motivated to do these kinds of things.

https://www.securityfocus.com/news/7388

[Red Squirrel]

Yeah I imagine it would not be trivial to decode.  Heck, is it possible to layer several dies?  I can't see why not. Heck, that would be smart for flash to get more density.  I think they sorta do that already.  So you could see just the main die on top but there could be other dies below to do the nasty stuff. Obviously interference and capacitive coupling would become an issue but I'm sure that's something Intel engineers would have all figured out.

If there is an antenna that would be fairly obvious I think though. I don't imagine you could stick that very close to the actual die, it would be a bit away from all the business end.

[1design]

Ignorance is bliss....try and make a wireless connection work form under a heatsink a a ground plane/power on the other side. The antenna structure is also very easy to detect, and if you really want to debunk it, just go around your PC with a SA and an antenna. Mine doesn't have anything coming out od it and I use an Intel chipset.

There are so much easier ways of taking over you machine than complicated HW exploits. The user is the biggest backdoor the unit has, no need to tin foil conspiracies, all of your public traffic is monitored, selectively recorded and mostly never used, until targeted. If you are OK with this, welcome to the WWW, otherwise please unplug.

[Mr. Scram]

Ignorance is bliss....try and make a wireless connection work form under a heatsink a a ground plane/power on the other side. The antenna structure is also very easy to detect, and if you really want to debunk it, just go around your PC with a SA and an antenna. Mine doesn't have anything coming out od it and I use an Intel chipset.

There are so much easier ways of taking over you machine than complicated HW exploits. The user is the biggest backdoor the unit has, no need to tin foil conspiracies, all of your public traffic is monitored, selectively recorded and mostly never used, until targeted. If you are OK with this, welcome to the WWW, otherwise please unplug.

There's examples where the bus was used as an antenna, but as I've stated before I agree with you. No need to complicate things with hardware that might get spotted when you have the Intel ME built in there already.

[stj]

the rumor is that it's in the chipset, not the cpu.
so there is no metal cap on the package and a track or even several in different orientations could be placed on the top of the package pcb at the edges.

it would actually be very easy - all it takes is intent.

[Mr. Scram]

the rumor is that it's in the chipset, not the cpu.
so there is no metal cap on the package and a track or even several in different orientations could be placed on the top of the package pcb at the edges.

it would actually be very easy - all it takes is intent.

A computer case is designed to keep RF both out and in. I think someone once sent in to Dave's mailbag a wifi operated tool to remotely start your computer, but had issues with reception when the thing was in a closed case.

It doesn't seem to make a lot of sense. You're trying to use something you are also trying to prevent, which is RF in your case, and transmissions can be picked up by anyone with a $25 dongle. Added to that is the fact that any modern computer is already equipped with Intel's ME or AMD's TrustZone. Any computer connected to a network already has hardware built in to abuse. Computers not attached to a network for safety reasons are much more likely to be additionally protected, like being in a TEMPEST case or environment, which renders your 3G apparatus moot.

It doesn't really add up. It's a lot of effort with a good chance of being caught for little to no gain.

[ebastler]

the rumor is that it's in the chipset, not the cpu.

But the link which you provided (thanks for that!) is pretty clear that 3G is implemented in external hardware:

This feature works even if the OS is not running or has been reinstalled thanks to a hardware-to-hardware link between the 3G card and the Intel AT [anthi theft] system.²

²This feature requires a laptop with Intel Anti-Theft Technology 3.0, a 3G laptop modem that supports Intel AT 3.0 functionality [...] and OEM-enabled communication between the 3G modem and laptop.

https://www.intel.com/content/dam/doc/product-brief/mobile-computing-protect-laptops-and-data-with-intel-anti-theft-technology-brief.pdf

[Twoflower]

@orion242: You can't get enough insulation on a single die. That's the idea I had that there has to be a second die separated by a insulation layer. The missing pads for the bond-wires and the single coil just were additional hints. You can actually see more than just one layer. Have a look at the coils: You see the coil itself AND the wire from the inner point of the coil out to the right side. That's already two layers you easily can identify on the pictures.

And it seems your thread is already derailed very far (and I won't comment to it) that I'm not sure if you read this late response.

[orion242]

Yep, that's the conclusion I'm coming to.  Asked DD what the story was as I sent two orders.  What I got back was a zip file with two folders of pictures.  The numbers on the folders don't match the order numbers, etc, no response from them.  Assumed it was both chips.  No clue what I'm really looking at now.

At this point, I'm no closer to an answer than I was back in Sept when I originally sent the samples in.

Broke down and ordered 98% sulfuric, test tubes, clamps holders, bla, bla, bla.  Guess if I want real answers in a timely fashion, I'll have to do it myself.

Cost of all that crap, cost of another device to harvest samples from, another digikey order for more known good samples.  My quest for a quick decap and compare is getting fairly costly.

[Twoflower]

How about x-ray them? Sure not 100% sure, but in your case the two die package might be a great help to identify genuine ones. And big plus: The device survive.

[stj]

A computer case is designed to keep RF both out and in.

once long ago when vents had metal screens etc.
they arent so good now - some even have side windows.
i cant even remember how long ago i last saw the plastics with copper-spray on the back and an earthing spring either.

transmissions can be picked up by anyone with a $25 dongle.

really?? the only ones i'v seen in that price range top out at 1.7GHz and you would need to scan 2.4GHz

[CJay]

3G requires the PC to have extra hardware for the 3G connection, it's a tinfoiler's wet dream because it's mentioned vaguely enough that it can be spun as big bad surveillance state.

Pull the 3G/HSDPA hardware or even just eject the SIM and it's toast.

maybe, maybe not.
you talk about tinfoil, but in the world we are in today i would say that's nieve.
a head-in-the-sand approach is not a wise idea.

No 'maybe' about it, it can be disabled, the only functionality that's built into the chipset is the facility to 'talk' to an external 3G module without involving the OS meaning it's OS/driver independent.

It's a swivel eyed conspiracy nut theory.

[Mr. Scram]

once long ago when vents had metal screens etc.
they arent so good now - some even have side windows.
i cant even remember how long ago i last saw the plastics with copper-spray on the back and an earthing spring either.

really?? the only ones i'v seen in that price range top out at 1.7GHz and you would need to scan 2.4GHz

RF requirements have become tighter, rather than more lax than before. You might see less protection because the computers themselves have become much more refined devices, not spewing RF noise everywhere. However, with the proliferation of mobile phones being what it is, you can't build a computer that's not properly shielded against GSM transmissions without failing various tests.
 
Even if it turns out being a $300 device, it's still cheap enough for the chances of detection being very high, especially considering a lot of these devices have to be used right next to a computer in the first place.