Hacker News Reader

Comment by networked | Hacker News Reader

I've got to add that this is pretty much how Intel's x86 processors were reverse engineered [1] for use in Soviet IBM PC clones like Poisk [2]. Most resources on the Web talk about clones of CPUs up to and including the 80286 but I am told there was at least one successful attempt at cloning an earlier version of the 80386. The smaller sub-1 µm process used by Intel for later 80386 and 80486 units proved too much, however.

[1] http://www.cpu-world.com/info/exUSSR-chips.html

[2] http://www.oldcomputermuseum.com/poisk.html

View on HN

I am the one who have done all these chip photos.

I am still looking to find soviet 286 (КР1847ВМ286), but it seems it is extremely rare. If anyone have one - contact me ASAP :-)

Just to be fair - I didn't find that soviet "clones" were clones - layout was changed significantly. Centralized planning demanded 100% compatible chips to make near-100% compatible computers, that's the root of all evils.

Thanks for all the work. That was an amazing read.

I've always wondered how people map chip-die photos into something like this: http://chip-architect.com/news/2007_02_19_Various_Images.htm...

or this: http://chip-architect.com/news/2003_09_21_Detailed_Architect...

I can see how figuring out the cache and the internal buses might be doable, but the rest... Any insights?

Maybe interesting:

http://www.righto.com/2013/01/a-small-part-of-6502-chip-expl...

http://www.visual6502.org/

Awesome work. A simple suggestion: make clear that the labels point to the right picture, say with a horizontal line separating them, since the description for the next image is right below the one before it.

What sort of camera rig did you use? The pictures are lovely.

It's metallographic microscope BM-158J with some unnamed 5 megapixel camera attachment. To make large photo I had to take 20-100 shots, and then stitch them into 1 large photo.

Great work. Did you ever see these? http://micro.magnet.fsu.edu/creatures/pages/russians.html

Also, there are a few collectors over here: http://www.cpu-world.com/forum/

Maybe they can get you a lead on one.

This is also how mifare security was reverse engineered and broken. If I remember correctly they sanded down each layer and used image recognition.

https://www.youtube.com/watch?v=QJyxUvMGLr0

It's pretty much how modern ASICs are reverse-engineered today - mainly for patent infringement investigation.

There are actually substantially more steps involved in reverse engineering more modern SOCs. After depackaging the chips you have to strip the metal layers, special protective layers etc to get to the base layers. Modern processes can have upwards of 8 metal layers along with a top layer composed of filled metal (there are issues with processing if a relatively uniform amount of metal isn't on each layer).

After you get the images of the metal layers (you likely can't do this optically for things down near Metal1) you can image the poly and diffusions. You can probably guess which transistors are which based on which power rails they would have been connected to.

Things might be easier if you know what standard cell library the designers used when laying out the chip, as then you'd more easily be able to identify the base logical functions faster.

If you're being thorough you'd also have to make sure you obtain measurements of the widths of each of the transistors (so you can later figure out the relative drive strength which matters for things like identifying keeper circuits or more precision analog elements etc).

Determining some transistor behavior make require even more complicated tests to identify doping levels and if you were trying to duplicate the process you'd have to identify a large number of other materials (for example if they use copper you'd want to find what chemical they used to control the diffusion etc).

It's pretty interesting stuff though.

Yes, and that does not even get into the extremely complex principle of the process technology itself, mixed with the design placement techniques that tend to be very closely tied to the process.

Reverse engineering Digital can be conceivable by looking at blocks, but for analog it can be incredibly difficult.

Whoa!

Never knew a microprocessor/microcontroller/ASIC could be reverse engineered.

How do they even tackle such complexity?

Do you know of any resources which explain how it is done?

Check out these videos: http://www.youtube.com/user/Andorianin/videos?view=0&flo...

There is also software for automatic photo->schematics conversion, but this is quite complicated & not something you can buy at store.

> There is also software for automatic photo->schematics conversion, but this is quite complicated & not something you can buy at store.

You're right, it's too cool for stores.

https://github.com/nitram2342/degate

Reply on news.ycombinator.com