Hello and welcome to this #nakeddiefriday installment.
-
Hello and welcome to this #nakeddiefriday installment.
Today's guest is an NXP chip for which I do not have the part number in memory. The chip was used as a training target for the sample preparation tutorial section by Chris Pawlowicz of TechInsights at HARRIS'26, in which I had the pleasure to participate. I have an intact sample which I plan to deprocess at home during the coming days and hopefully apply all I've learned there.
Full-res map for you to explore: http://infosecdj.net:8086/map/nxp/mp091a0/infosecdj_mz_nikpa60x_s0/
Image taken using Nikon PlanApo 60x/1.40, 3260 focus-stacked tiles of 21 individual shots.
#electronics #reverseengineering #microscopy
Die ID marking in the corner lets us know this is an MP091A0, designed in 2021. 5 metal layers, all revision 1 it seems.
-
Die ID marking in the corner lets us know this is an MP091A0, designed in 2021. 5 metal layers, all revision 1 it seems.
While I don't know the specifics, the device certainly has 6 functional units of the same type distributed along the 3 out of 4 edges. The top right corner houses 3 instances of a different unit, along with at least two more of a yet different one. And if memory serves, the centre was occupied by a blob of digital logic.
-
While I don't know the specifics, the device certainly has 6 functional units of the same type distributed along the 3 out of 4 edges. The top right corner houses 3 instances of a different unit, along with at least two more of a yet different one. And if memory serves, the centre was occupied by a blob of digital logic.
The green colours seem to be of poly resistors. The setup struggles to resolve them through all the layers.
-
The green colours seem to be of poly resistors. The setup struggles to resolve them through all the layers.
Capacitors seem to be purple.
Also in the frame is one chonky resistor...
-
Capacitors seem to be purple.
Also in the frame is one chonky resistor...
Next up is removing the top metal layer, which if memory serves is a thick 3um one. Thread will update when that's done.
Until then, I wish you all a great Friday and the weekend too!
-
Next up is removing the top metal layer, which if memory serves is a thick 3um one. Thread will update when that's done.
Until then, I wish you all a great Friday and the weekend too!
Here we go. Metal5 was removed except for the central area; it was rather stubborn and didn't want to go. I will work on it a bit more and take another shot, need to be careful as metal4 started going on the edges already.
Full-res map: http://infosecdj.net:8086/map/nxp/mp091a0/infosecdj_mz_nikpa60x_s1/
-
Here we go. Metal5 was removed except for the central area; it was rather stubborn and didn't want to go. I will work on it a bit more and take another shot, need to be careful as metal4 started going on the edges already.
Full-res map: http://infosecdj.net:8086/map/nxp/mp091a0/infosecdj_mz_nikpa60x_s1/
The interconnect between metal5 an metal4 is mostly done with via banks, except for pad structures.
-
The interconnect between metal5 an metal4 is mostly done with via banks, except for pad structures.
One digit is gone from the maskset revisions.
-
One digit is gone from the maskset revisions.
After a bit more work. This is imaged using a dry objective.
Planarity is shit but no visible scratches, which is amazing.
Materials used: Allied 0.3u alumina suspension, Ted Pella Met-X cloth
-
R relay@relay.infosec.exchange shared this topic
-
After a bit more work. This is imaged using a dry objective.
Planarity is shit but no visible scratches, which is amazing.
Materials used: Allied 0.3u alumina suspension, Ted Pella Met-X cloth
The same in oil immersion. All the interference colours gone, and there's slightly more contrast.
Full-res map: http://infosecdj.net:8086/map/nxp/mp091a0/infosecdj_mz_nikpa60x_s2/
11/n
-
The same in oil immersion. All the interference colours gone, and there's slightly more contrast.
Full-res map: http://infosecdj.net:8086/map/nxp/mp091a0/infosecdj_mz_nikpa60x_s2/
11/n
The rest of metal-5 is gone from the centre, and a lot of metal-4 is now missing on the sides.
Full-res map: http://infosecdj.net:8086/map/nxp/mp091a0/infosecdj_mz_nikpa60x_s3/
12/n
-
The rest of metal-5 is gone from the centre, and a lot of metal-4 is now missing on the sides.
Full-res map: http://infosecdj.net:8086/map/nxp/mp091a0/infosecdj_mz_nikpa60x_s3/
12/n
Die ID is now gone too. Always amusing how things just vanish without a trace.
13/n
-
Die ID is now gone too. Always amusing how things just vanish without a trace.
13/n
I am most intrigued by this set of cells not connected to anything else. Same cells found in groups elsewhere. Does anyone have an idea why is this here?
14/n
-
I am most intrigued by this set of cells not connected to anything else. Same cells found in groups elsewhere. Does anyone have an idea why is this here?
14/n
@infosecdj Looks like some kind of multi finger ESD or IO drive transistor especially given the location near a bond pad, sure there's no vias up to the pad?
-
@infosecdj Looks like some kind of multi finger ESD or IO drive transistor especially given the location near a bond pad, sure there's no vias up to the pad?
@azonenberg Hmm, a good guess. Though here is the same elsewhere on the die, the only connection I can see, or rather guess, is to metal-1 on the very outside of the die. I suppose we will see what happens when I get closer to m1.
-
@azonenberg Hmm, a good guess. Though here is the same elsewhere on the die, the only connection I can see, or rather guess, is to metal-1 on the very outside of the die. I suppose we will see what happens when I get closer to m1.
@infosecdj The outer seal ring is probably ground.
The fingered structure on the very edge of the die hooking to it looks more like an ESD diode than the mystery structure you showed above.
-
@azonenberg Hmm, a good guess. Though here is the same elsewhere on the die, the only connection I can see, or rather guess, is to metal-1 on the very outside of the die. I suppose we will see what happens when I get closer to m1.
@infosecdj @azonenberg it looks like a tiny cat is reaching its paw down on the right hand side -
I am most intrigued by this set of cells not connected to anything else. Same cells found in groups elsewhere. Does anyone have an idea why is this here?
14/n
Processing is finished on the next step. Hit the metal over the logic blob almost perfectly.
Full-res map: http://infosecdj.net:8086/map/nxp/mp091a0/infosecdj_mz_nikpa60x_s4/
15/n
-
Processing is finished on the next step. Hit the metal over the logic blob almost perfectly.
Full-res map: http://infosecdj.net:8086/map/nxp/mp091a0/infosecdj_mz_nikpa60x_s4/
15/n
There have been a couple more intermediate steps captured:
http://infosecdj.net:8086/map/nxp/mp091a0/infosecdj_mz_nikpa60x_s5/
http://infosecdj.net:8086/map/nxp/mp091a0/infosecdj_mz_nikpa60x_s6/
http://infosecdj.net:8086/map/nxp/mp091a0/infosecdj_mz_nikpa60x_s7/16/n
-
There have been a couple more intermediate steps captured:
http://infosecdj.net:8086/map/nxp/mp091a0/infosecdj_mz_nikpa60x_s5/
http://infosecdj.net:8086/map/nxp/mp091a0/infosecdj_mz_nikpa60x_s6/
http://infosecdj.net:8086/map/nxp/mp091a0/infosecdj_mz_nikpa60x_s7/16/n
And when you peel all that away... little sprockets.
(I know, I know.)
17/n
