Hardware Podcasts

352: Baby's First Hydrofluoric Acid

Embedded.fm · 20 Nov 2020 · 1h 00m · Episode 352

What this episode covers

John McMaster, president of McMaster Consulting, explains the process of decapping computer chips to extract firmware and analyze their internal structure. He details the use of hydrofluoric acid, lapping machines, and focused ion beam (FIB) tools to delayer chips, allowing for the imaging of ROM and other circuitry. McMaster also discusses software tools like Rompar and bitract for converting microscope images into binary code, and shares insights on the legal and technical aspects of reverse engineering older hardware like the SNES S-PPU1.

Most relevant to

makers and hobbyists

Topics

Mentioned

Companies
McMaster Consulting
Products
SNES S-PPU1
Tools
Rompar, bitract, Scanning Electron Microscopy, Focused Ion Beam, Plasma Etcher
Also
Hardwear.io

Related episodes from other shows

Other shows on the same ground, closest first.

  • Unnamed Reverse Engineering Podcast · 1h 10m

    032 - High Molarity Rants

    John McMaster, founder of the Mountain View Reverse Engineering Meetup and operator of siliconpr0n.org, discusses the history of his hardware hacking community and his work in chip reverse engineering. He details the meetup's evolution from Red Rock Cafe to Alice's Smokehouse, highlighting the unique security community culture where attendance often exceeds RSVPs. McMaster also explains his technical approach to firmware extraction, including decapping chips with acids and using tools like the Swiss Light Source for non-invasive analysis.

    Chips, FPGAs & semiconductorsMaker community & events
    9 chapters

  • The Amp Hour · 1h 21m

    An Interview with Dmitry Nedospasov

    Dmitry Nedospasov, a hardware security researcher and founder of the startup Toothless, discusses his work in IC security and reverse engineering. He details invasive and semi-invasive techniques for analyzing chips, including using focused ion beams and infrared cameras to extract secrets from smart cards and pay TV systems. Nedospasov also explains his training curriculum at the RECon conference, which teaches engineers how to use FPGAs for protocol analysis and hardware hacking.

    Debugging & failure analysisMicrocontrollers & dev platforms
    7 chapters

  • Unnamed Reverse Engineering Podcast · 24m

    022 - Bits Through the Microscope

    Chris Gerlinksy, a reverse engineering consultant from PDR North, explains how he extracts ROM data from microcontrollers by deprocessing chips and imaging them under a microscope. He details the evolution of security in PayTV smart cards, from simple 8-bit chips to modern devices with anti-tamper shields and implant ROMs that require specialized etching to reveal data. Gerlinksy also discusses the tools of the trade, including wet etching, CMP polishing, and micro-probing stations, as well as software for automating bit extraction from optical images.

    Debugging & failure analysisChips, FPGAs & semiconductors
    7 chapters

  • Unnamed Reverse Engineering Podcast · 57m

    005 - Circuits That Go Nowhere

    Ken Shirriff, a reverse engineer and blogger, details his process for reverse engineering vintage integrated circuits, from decapping chips using safe acids to analyzing die photos with metallurgical microscopes. He discusses the restoration of the Xerox Alto computer, explaining how he and collaborators resolved hardware mismatches and reverse-engineered its complex microcode using logic analyzers. The conversation covers specific historical chips like the 8008 and Z80, highlighting design quirks such as 4-bit ALUs in 8-bit processors and the use of current mirrors in analog circuits.

    Chips, FPGAs & semiconductorsDebugging & failure analysis
    9 chapters

  • The Amp Hour · 21m

    #397.8 - An Interview with Chris Gerlinsky

    Chris Gerlinsky, an embedded reverse engineer based on Vancouver Island, explains his work decapping chips and microprobing to extract firmware and security keys from automotive ECUs and legacy cable set-top boxes. He details the physical processes of delayering ICs using chemicals and plasma etching to expose silicon bits, and discusses how aftermarket automotive companies use these techniques to integrate non-OEM parts into closed vehicle networks. Gerlinsky also contrasts the ease of reverse-engineering older pay-TV security chips with the increasing difficulty posed by modern automotive security measures like signed code and RSA signatures.

    Debugging & failure analysisSecurity & privacy
    8 chapters

The summary, chapters and topics are generated from the episode’s audio by this directory, not written by Embedded.fm. The episode itself belongs to its publisher.