Low-Cost IC Emission Reverse Engineering

on YouTube ↗40m

" summary

Demonstrates that visually correlating 1100nm infrared emissions to logic is practical with low-cost gear: a back-illuminated CMOS or cooled CCD with the IR cut filter removed, 1060/1200nm LEDs, and image processing like dark-frame subtraction and histogram equalization. Experiments show ESD diodes, a two-input NAND and a 4-bit counter switching; night-vision goggles capture live frames. Backside thinning by hand to ~25–30 µm is possible but yields ~18× attenuation versus frontside; CMOS logic remains challenging due to low switching current.

AI-written summary · about

" chapters (21)

1. 0:00Intro
2. 1:24Infrared (IR) emissions
3. 2:40Selecting an 1100 nm camera
4. 7:25Lighting preparation
5. 9:02Microscope optimization
6. 10:32Locating ESD diodes (CD4050)
7. 11:17Improving contrast
8. 13:48hardwear.io Mystery logic
9. 14:37Mystery logic: black box
10. 15:18Mystery: output driver
11. 17:05Mystery: input buffering
12. 18:09hardwear.io Mystery: input diodes
13. 18:33Mystery: logic states (O to Rdiv)
14. 24:15CD4050 dynamic logic
15. 26:51Backthinning: metrology
16. 27:50L7805CV (5V regulator)
17. 28:46Backthinning: sanding
18. 32:12Backthinning: chemical
19. 33:06Alternative sensor: PDA400 InGaAs photodiode
20. 33:56Alternative sensor: IR scope
21. 37:16Summary

" related talks

• 30mInfrared: Old Threat Meets New DevicesWang Kang · HITBSecConf 2019 Amsterdam
• 23mExtraction of Secrets from 40nm CMOS Gate Dielectric Breakdown Antifuses by FIB...Andrew D. Zonenberg, Antony Moor, Daniel Slone, Lain Agan, Mario Cop · 19th USENIX WOOT Conference on Offensive Technologies (WOOT '25)
• 21mOpen Source IC Design and Hardware Reverse Engineering Or: How I Learned to Stop...Johanna Baehr · Spring 2022 RISC-V Week — RISC-V International Day
• 15mBasilisk: Remote Code Execution by Laser Excitation of P–N Junctions Without...Joe Loughry, Kasper Rasmussen · WOOT '24
• 14mBreaking Infrared Recapture Detection: Optical-Synthesis Attacks and Depth-Aware...Sara Rampazzi, Tetsu Ishizue, Takeshi Sugawara · 20th USENIX WOOT Conference on Offensive Technologies (WOOT '26)
• 14mRed Bleed: A Pragmatic Near-Infrared Presentation Attack on Facial Biometric...Bowen Hu, Kuo Wang, Chip Hong Chang · USENIX Security '25
• 22mRADOPA: Robustifying a Design Against Optical Probing AttacksSajjad Parvin · ORConf 2023
• 55mReliable and Secure Embedded SystemsWei Jiang, Xianzhang Chen, Yujuan Tan, Duo Liu, Junjie Feng, Weigong Zhang, Jiapin Wang, Rongwei Zheng, Elbruz Ozen, Alex Orailoglu, Shengjie Wang, Xiaohang Wang, Yingtao Jiang, Amit Kumar Singh, Jinyu Zhan, Zhibei Pu, Junting Wu, Yongjia Yang · CODES+ISSS 2022