Bits From The Matrix: Optical ROM Extraction
summary
Shows an end-to-end optical ROM extraction workflow: fuming nitric acid decap, wet etch with hydrofluoric acid (wink rust stain remover as a dilute HF shortcut), optional dash‑etch (HF+HNO3+AcOH) to reveal implant ROM, and CMP polishing for planarization. Images come from a motorized‑stage optical microscope or, for subwavelength features, SEM/FIB. Stitching and automated bit‑thresholding convert tiles to a bit matrix, then to bytes; one example yields 260k bits with 105 bit errors, enough to disassemble and find a glitch to dump the chip.
AI-written summary · about
chapters (11)
- 0:00Intro
- 1:08Why extract ROM?
- 2:58What does ROM look like?
- 9:55Photographing chips
- 16:22Implant ROM
- 22:15Bit extraction
- 25:39Decoding bit matrix into bytes
- 30:51Example: ST19 K7 series
- 38:41Bit errors
- 41:44Difficulties
- 44:13Download links
related talks
23mExtraction of Secrets from 40nm CMOS Gate Dielectric Breakdown Antifuses by FIB...
03mExploring chip decaping techniques for silicon die inspection and reverse engineering
44mIC Surgery: getting to the heart of the problem with the smallest scalpel
33mBreaking Into Chips By Reading The Datasheet
47mHow To Dump, Parse, And Analyze i.MX Flash Memory Chips
34mCryo-Mechanical RAM Content Extraction: A DIY Cold Boot Robot For A Thousand Bucks
01h 46mTutorial: Introduction to Reverse Engineering
24mRed Team Vs. Blue Team