I'm a (retired) analogue IC designer and have many happy (?) memories studying other companies IC's using optical microscopes in our engineering laboratory, to reverse engineering them. It was a good way to learn tricks of the trade. I hope some engineers have studied some of my creations! We also used manual micro-manipulators to electrically probe connections when studying a powered up die. We sometimes used a laser to cut tracks in the lab. We also occasionally used an ion-beam milling machine to slice into the depth of an IC so we could modify the silicon experimentally. Oh what fun we had!
Ion beam milling machine what a unique bit of gear! Something like that would have cost millions. What companies would even manufacturer a machine like that
I forget the name of the company we used. It's not a big machine. Same principle as an electron beam microscope I think, although the polarity is obviously reversed! A tall evacuated chamber along which one accelerates charged particles. I think you have a very hot "anode" source creating a plasma (if that is the right terminology) so ions can be sucked away by the electric field. magnetic fields deflect the beam. The ions are much heavier than electrons and abrade the surface they hit... If I recall correctly, there was even technology to deposit material at a lower energy so that one could add a conducting track, very slowly......
@@fakename3344 I think it was companay in Cambridge or maybe even a university facility, I live in the UK... If you do a google for "focussed ion beam" milling etc, you should find some resources, certainly in the USA and in Europe, probably Japan and China too..
I've always been impressed with those who could read disassembled code. but at minute 11:43 , Ken is disassembling SILICON and THEN disassembling the code that is in that ROM in that silicon! Oh as if that is not enough, he also wrote a simulator of the calculator he reverse engineered BY LOOKING AT THE SILICON!? WOW...
Actually there is a method on how to perform that... Decap, hotspot, curve tracing etc. its just depending on the ic function/s thats varying and talent is required.
I studied automation engineering and almost everything here was a part of the curriculum. I wish it was taught like this! Had so much difficulties in understanding the implementation of gates on chip that I couldn’t visualize it so had to learn them and I hated ‘just learning’ part. There’s no fun without seeing it practically. Great video
Good talk but what are they doing with the camera taking shots from the back of the room and switching to the talker when he is showing something on the screen. Whoever filmed and edited this, watch some defcon talks.
If you guys like Ken Shirriff, I suggest watching the CuriousMarc channel. Ken is often there tagging along and working with the others in restoring and understanding these old computers.
That's where I knew the face from, haha. I was sitting here watching this dude like where have I seen him....watching Marc's space shuttle computer videos!
Early Mostek calculator devices (1970s) had fake contacts that would mess with reverse engineering and swiping the circuit. The fake contacts were not able to be detected under optical microscopy unless you were good at noting the direction of focus
If you have an archive of the raw footage from all of the cameras, it would greatly helpful to have the wide angle shot showing you pointing is really helpful. However, the slides are better resolution, but where he is pointing is lost. The lecture is very interesting, but when you don't see where he is pointing makes much more difficult to follow Thanks.
Yeah you can't win with the slides... laser pointer OR better quality image but you can't have both.... ideally we need speakers to use some kind of "virtual laser pointer" on the presentation laptop.
@@edgeeffect You can have both, it's called picture in picture. You can show slide, presenter and picture of where he's pointing at the same time. Then the virtual experience would in most cases actually be better than the real one. "Virtual laser pointer" as in mouse pointer? Yeah, would be nice if someone invented that.
I mean, in a way, they're essentially the same thing. With Factorio, you're taking resources and converting them into other resources. With processors you're taking inputs and converting them into outputs.
crazy how much stuff is on these tiny pieces, and its getting even crazier by the day. I can't even imagine how much engineering hours and knowlege went into any of these things.
"if you stare at it long enough it will start to make sense" ~ No, if YOU stare at it long enough it will start to make sense, if I stare at it long enough i'll get a headache. lol
Currently in school for comp E and we're slowly going over the topics presented, so this talk is really fascinating (to see this stuff in practice!) Does anybody know how large were the teams that were designing these chips?
I've seen a company photo of MOS Technologies, who did the 6502. There were about 15-20 employees, and I suspect 2/3 were engineers, the rest doing drafting, admin, finance. Intel was similarly sized at the time they began.
I have a David and Mann x,y table from a microchip factory. Very accurate. It had a 110 volt motor on the x axis. So I wonder if it was for cutting the wafers up.
How about an old SGI Tezro? SGI doesn't exist anymore, and to our knowledge these machines aren't repairable using standard services. Reengineering the ICs may be the only way to service them, and emulation requires the same thing.
When I was 11 or 12 years old I did a science fair thing where I got the chips out and let people look at them with a microscope. The way I came up with for getting the silicon out was simply by heating the package until it crumbled.
I am not a lawyer but for research purposes this is probably fine. If you reverse engineer to clone a chip for mass production it's probably a patent violation as these chips, the design and microcode would be intellectual property of the manufacturer. If the patent is even active for some of these older chips. Would Intel care if you cloned a 4004 or 8080 and sold it? Of course, it would not make sense, and the newer chips of today would be impossible to clone due to density, without the supporting design material. You can always emulate I guess, using other hardware, such as FPGAs.
well, I started programming in the late 60s, but I can still understand like maybe up to 30 percent of this. I checked with a couple other people, sure enough, they couldn't understand a single word, so I'm happy enough.
Am I the only one who saw "Instruction ROM" in the calculator chip and immediately thought, I'd love to experiment with that and see what changing values in it would do?
Excellent amount of information. Respect. Just the Saliva sound was a bit bothersome. Sounded a bit kinky while under the impression of knowledge. You know.
Good morning. I am trying to communicate with Mr Ken Shirriff, but all the emails addresses i have found in his blog or at other web pages are wrong. How can i communicate with him ? Thanks
These chips are not modern, but in fact very old. This would be nearly impossible to do with modern chips, as one of the commenters above explained very well
I think the hardest if not impossible part of doing that is more complicated/modern chips easily contain many vertical levels like shelves. This way of reverse engineering integrated circuits only works with the surface layer.
Well theoretically its possible. But you should know how to completely etch given layer not touching the level below. And to know that you should sign NDA in Intel or AMD and work there for a while... SUCCS
What about the GBA? It uses an ARM/Thumb core. Though obviously, yes, it contains a Z80 as well, for obvious reasons. (in fact, the Mega Drive/Genesis contains a z80 for basically the same reason; Technically it's the Audio co-processor, but I'm sure using it for that was an afterthought; The only reason they chose a z80 for that task is that they wanted it to play Master System games and thus needed one anyway. Might as well put it to work doing something else while it's there.) Still... Z80... Ehh. I'll stick with my 65xx family chips thanks. XD
I love the vintage processor chips, especially Z80, 8085, 805x series. Yeah I know you won't build a Pi clone with one of those but they are fun to work with!
Silicon in an elevated enthalpy reaction(add heat) undergoes an elevation of the 3p orbitol, allowing for an enthalpy controlled reduction/oxidation reaction of the atom. So start there. Then make transistors...
I always wondered if a working chip with a metal lid will continue to work with the lid popped off and exposed to ambient air. The lid would have to be removed carefully so as not to damage the bonding wires or the chip. Would light have any effect? How about a low power laser such as from a pointer? EPROMs continue to work even though the window is exposed (although erasure might occur after some time), so I guess yes?
it has to be exposed to UV light a strong UV light. Which is why some of these EEPROMs that are being pulled out of vintage computers from the 80's still have all of their EEPROM data intact.
His good . the true beauty of transistors is the differance in opening, and closing . Some are Voltage controlled, some are Ampere controlled, some are Normally Open NO, others are NC, Normally Closed , before you apply voltage to them . NPN & PNP junctions .
9:02 just for efficiency, would it not be better to use just 2 transistors to solve the NOR circuit the 3 transistor seems of no use theoretical it might be part of the drawment for the negation but why would you do that then
i got a few chips open but it just was white mush. don't know where they put the transistors and i have a feeling they had just stuffed it with potatoe
I've been wondering how the control logic schematic looks like and how it interacts with the interrupts in the instruction rom( schematic) at transistor leve of the z80 and it's burning my neural circuit. Someone plz save me!
I've found that very flat ceramic chips (which can't be chiseled) can be heated and will crumble, though occasionally with case residue on the die. The fumes are not good for breathing.
I think that we soon will have access to high power laser beams that can chisel away AND scan a chip in 3D and remodel them, as a by-product of the nascent 3D-printing technology.
I wish this were more accessible. Imagine if someone invented a machine that could scan a chip in real-time and get an oscilloscope-like trace at every point, and it was accessible enough that you don't need to be a big company or government to afford one. That would be the Holy Grail of hacking tools, and the end of manufacturers being able to hide secrets in products they sell without the owner being able to see them. But IDK how realistic that would be any time soon. :p
Anybody here still remember the early days of 1980s when the Soviets stole the blueprint for Zilog Z8000 microprocessor and tried to reverse engineer it.
you can now inkjet print transistors. 1500nm is easily possible, with some tweaks to the printer's hardware you can reach 800-500nm. If you want to spend on a super high grade research printer... 160 nm is about the limit you can do . But you can do a one-off chip design on a piece of glass, so that's pretty impressive. not to mention makes custom chips very very cheap
I'm a (retired) analogue IC designer and have many happy (?) memories studying other companies IC's using optical microscopes in our engineering laboratory, to reverse engineering them. It was a good way to learn tricks of the trade. I hope some engineers have studied some of my creations! We also used manual micro-manipulators to electrically probe connections when studying a powered up die. We sometimes used a laser to cut tracks in the lab. We also occasionally used an ion-beam milling machine to slice into the depth of an IC so we could modify the silicon experimentally. Oh what fun we had!
Ion beam milling machine what a unique bit of gear! Something like that would have cost millions. What companies would even manufacturer a machine like that
I forget the name of the company we used. It's not a big machine. Same principle as an electron beam microscope I think, although the polarity is obviously reversed! A tall evacuated chamber along which one accelerates charged particles. I think you have a very hot "anode" source creating a plasma (if that is the right terminology) so ions can be sucked away by the electric field. magnetic fields deflect the beam. The ions are much heavier than electrons and abrade the surface they hit... If I recall correctly, there was even technology to deposit material at a lower energy so that one could add a conducting track, very slowly......
@@franklydude Would you happen to remember what it was? I'm really curious as to where I'd get the equipment to do this.
@@fakename3344 I think it was companay in Cambridge or maybe even a university facility, I live in the UK... If you do a google for "focussed ion beam" milling etc, you should find some resources, certainly in the USA and in Europe, probably Japan and China too..
@@franklydude
Yeah, they also have ion implantation (basically ion doping) machines.
I've always been impressed with those who could read disassembled code. but at minute 11:43 , Ken is disassembling SILICON and THEN disassembling the code that is in that ROM in that silicon! Oh as if that is not enough, he also wrote a simulator of the calculator he reverse engineered BY LOOKING AT THE SILICON!? WOW...
Anyone that had being paying attention to EE classes (VLSI, Computer Archtecture, Microprocessors etc.) can do that. It is a lot of work though.
Actually there is a method on how to perform that... Decap, hotspot, curve tracing etc. its just depending on the ic function/s thats varying and talent is required.
I’m sayin right... what a bad ass lol
what a royal waste of time though ...
You are watching videos, what a waste of time!
Jokes aside, any hobby may seem like a waste of time to others.
Ken is awesome
u too
My hero ❤️
Reverse engineering, the ultimate hacker skillz
If this the guy from the curious Marc videos?
I studied automation engineering and almost everything here was a part of the curriculum. I wish it was taught like this!
Had so much difficulties in understanding the implementation of gates on chip that I couldn’t visualize it so had to learn them and I hated ‘just learning’ part. There’s no fun without seeing it practically. Great video
I need the laser pointer when you zoom in please! Because we have no idea where he is pointing to.
Good talk but what are they doing with the camera taking shots from the back of the room and switching to the talker when he is showing something on the screen. Whoever filmed and edited this, watch some defcon talks.
Yeah the filming is abysmal. 95% of the time he's showing something with a laser pointer, you can't see what it is.
I really wanted to see what he meant by the "oh that's bad..." slide.
Couldn't watch...camera man destroyed all follow along to the educational value seeking to be given.
Hand that man a broom.
Simply put: Great overview of silicon features and excellent approach on chip decapping.
Laser pointer vs mouse pointer :-(
"this here..."
"these ..."
WHERE?!
If you guys like Ken Shirriff, I suggest watching the CuriousMarc channel. Ken is often there tagging along and working with the others in restoring and understanding these old computers.
That's where I knew the face from, haha. I was sitting here watching this dude like where have I seen him....watching Marc's space shuttle computer videos!
FFS, somebody give this guy a glass of water!
Banana noises.
so true lmao. Michael you hit right on the head
hahah i thought i was the only one who noticed that :D :D
it's like he's chewing on the very circuitry from his lecture.
actually those dry-mouth sounds are so pleasant for me... weird...
Very nice and interesting to see how those basic components and circuits are made. Great work!
Early Mostek calculator devices (1970s) had fake contacts that would mess with reverse engineering and swiping the circuit. The fake contacts were not able to be detected under optical microscopy unless you were good at noting the direction of focus
I chuckled when I saw the instruction "waitno"
If you have an archive of the raw footage from all of the cameras, it would greatly helpful to have the wide angle shot showing you pointing is really helpful. However, the slides are better resolution, but where he is pointing is lost. The lecture is very interesting, but when you don't see where he is pointing makes much more difficult to follow Thanks.
Yeah you can't win with the slides... laser pointer OR better quality image but you can't have both.... ideally we need speakers to use some kind of "virtual laser pointer" on the presentation laptop.
@@edgeeffect You can have both, it's called picture in picture. You can show slide, presenter and picture of where he's pointing at the same time. Then the virtual experience would in most cases actually be better than the real one.
"Virtual laser pointer" as in mouse pointer? Yeah, would be nice if someone invented that.
*_THAT_* was freaking cool!!!
_So much better_ than textbook cartoons!
Thanks, had fun getting a better look into the transistor designs that actually make their way into an ic.
28:30 Looks more like a factorio base than an IC XD
this made me chuckle
I mean, in a way, they're essentially the same thing. With Factorio, you're taking resources and converting them into other resources. With processors you're taking inputs and converting them into outputs.
man you have to give the name of the music played at the end... so good
crazy how much stuff is on these tiny pieces, and its getting even crazier by the day. I can't even imagine how much engineering hours and knowlege went into any of these things.
after a decades of innovation we still haven't figured out how to get a laser pointer on youtube
Phenomenal presentation! I want to thank that guy (and get him a bottle of water!)
i actually learnt quite a lot
Guys like him and the designers are out of this world, seriously extra terrestrial ufos.....wow.... way over my head..........
It could've been even longer presentation and I still would watch it.
Thank you. I wanted to ask about the power of the microscope used
Oh, it's Ken from Marc's channel!
if this guy can reverse engineer code from silicon surely he can invent a microphone that removes the mushy banana sound from his mouth.
"if you stare at it long enough it will start to make sense" ~ No, if YOU stare at it long enough it will start to make sense, if I stare at it long enough i'll get a headache. lol
Ellotus Freeholy lol
Currently in school for comp E and we're slowly going over the topics presented, so this talk is really fascinating (to see this stuff in practice!)
Does anybody know how large were the teams that were designing these chips?
I've seen a company photo of MOS Technologies, who did the 6502. There were about 15-20 employees, and I suspect 2/3 were engineers, the rest doing drafting, admin, finance. Intel was similarly sized at the time they began.
Thank you! This is the kind of information I always tryed to find. Great links!
2nd time i watch this, still wrecking my brain about that ALU trick.
Absolutely brilliant. Thank you very much.
where did the cool opening and closing music come from? anyone know who made it?
shame I cant see the lazer pointer
Very interesting what you do Ken. Thank You.
I have a David and Mann x,y table from a microchip factory. Very accurate. It had a 110 volt motor on the x axis. So I wonder if it was for cutting the wafers up.
1:49 Apparently it's not visible in the video.
I don't think I'd wanna buy a POSFET OR a POS transistor. this is a very interesting video.
How about an old SGI Tezro? SGI doesn't exist anymore, and to our knowledge these machines aren't repairable using standard services. Reengineering the ICs may be the only way to service them, and emulation requires the same thing.
When I was 11 or 12 years old I did a science fair thing where I got the chips out and let people look at them with a microscope. The way I came up with for getting the silicon out was simply by heating the package until it crumbled.
metallitech hey that's what i do!
Thank for sharing this! Really appreciate it!
Beautiful work.
master Ken
Fantastic stuff. Is there anything like a program that can be fed a die photo and more or less make sense of it?
that's how you create Skynet
My digital logic professor brought me here. THANKS J DAWG
very nice inside of very popular chips. I always wonder how do they work still so tinny.
Fascinating talk, learned a few things new things it. Thank you so much.
is it legal to do so??
I am not a lawyer but for research purposes this is probably fine. If you reverse engineer to clone a chip for mass production it's probably a patent violation as these chips, the design and microcode would be intellectual property of the manufacturer. If the patent is even active for some of these older chips. Would Intel care if you cloned a 4004 or 8080 and sold it? Of course, it would not make sense, and the newer chips of today would be impossible to clone due to density, without the supporting design material. You can always emulate I guess, using other hardware, such as FPGAs.
Merci pour la vidéo j'aime beaucoup les recherches
كتبغيو البحث ولا كيعجبكم غير تشوفو الأخرين كيقومو بأمور خارقة بحال هكا,,العربان أش عندكم ماديرو
well, I started programming in the late 60s, but I can still understand like maybe up to 30 percent of this. I checked with a couple other people, sure enough, they couldn't understand a single word, so I'm happy enough.
:)
MikesElectricStuff does videos deencapsulating chips which is cool, but havent seen or forgot ever seeing anyone show a transistor-level look! Cool
Absolutely fascinating! Thanks a lot!
Rawr, Love the chip die art!
Am I the only one who saw "Instruction ROM" in the calculator chip and immediately thought, I'd love to experiment with that and see what changing values in it would do?
Excellent amount of information. Respect. Just the Saliva sound was a bit bothersome. Sounded a bit kinky while under the impression of knowledge. You know.
this is crazy, awesome, breathtaking
This guy should definitely write a book about this topic. I'd love to learn more about it.
I watch these videos with no background in CS, i'm just like wtf how is this even possible?!?
No, it is possible. If you study semiconductor related knowledge, it will be piece of cake.
Incredible only in America such geniuses self develop
this channel is awesome
Good morning.
I am trying to communicate with Mr Ken Shirriff, but all the emails addresses i have found in his blog or at other web pages are wrong.
How can i communicate with him ?
Thanks
This Guy is a master of the modern reverse Engineering, a God...
These chips are not modern, but in fact very old. This would be nearly impossible to do with modern chips, as one of the commenters above explained very well
im a big fan of yours since curious marc channel !!!!
So how much work would it be to reverse engineer an i5 and it's microcode to see if the NSA realy does have a backdoor at that level?
Hundreds of thousands of man hours.
AMD too now
I think the hardest if not impossible part of doing that is more complicated/modern chips easily contain many vertical levels like shelves. This way of reverse engineering integrated circuits only works with the surface layer.
Well theoretically its possible. But you should know how to completely etch given layer not touching the level below. And to know that you should sign NDA in Intel or AMD and work there for a while... SUCCS
I bet it won't take long before someone trains an AI to solve those kind of problems.
Great lecture
Who's the end theme song from? I need that track badly..
Oh hello Ken! Seen you before hanging around with Curious Marc.
It was a pleasant surprise to recognise someone. He definitely is a reverse engineering king.
Brilliant :)
My sentiments exactly.
Great job! Thank you for sharing :D
Is that a factorio megabase???
“Any Z80 fans out there?”
Yes, me! Me! Me!
Right...the game boy advance..tho..
What about the GBA? It uses an ARM/Thumb core. Though obviously, yes, it contains a Z80 as well, for obvious reasons.
(in fact, the Mega Drive/Genesis contains a z80 for basically the same reason; Technically it's the Audio co-processor, but I'm sure using it for that was an afterthought; The only reason they chose a z80 for that task is that they wanted it to play Master System games and thus needed one anyway. Might as well put it to work doing something else while it's there.)
Still... Z80... Ehh.
I'll stick with my 65xx family chips thanks. XD
Ditto!
I had to pet the Z80 I have in front of me when he said that.
I love the vintage processor chips, especially Z80, 8085, 805x series. Yeah I know you won't build a Pi clone with one of those but they are fun to work with!
Nice explaination
bro, u r amazing, that is soo cool
,nd the earth is burning,
Is chip reversing used in software reverse engineering?
For YT videos, I suggest you show the diagram next to the actual screen. I can't see that laser dot on my screen to sync with his explanation lol.
Silicon in an elevated enthalpy reaction(add heat) undergoes an elevation of the 3p orbitol, allowing for an enthalpy controlled reduction/oxidation reaction of the atom. So start there. Then make transistors...
I always wondered if a working chip with a metal lid will continue to work with the lid popped off and exposed to ambient air. The lid would have to be removed carefully so as not to damage the bonding wires or the chip. Would light have any effect? How about a low power laser such as from a pointer? EPROMs continue to work even though the window is exposed (although erasure might occur after some time), so I guess yes?
it has to be exposed to UV light a strong UV light. Which is why some of these EEPROMs that are being pulled out of vintage computers from the 80's still have all of their EEPROM data intact.
His good . the true beauty of transistors is the differance in opening, and closing . Some are Voltage controlled, some are Ampere controlled, some are Normally Open NO, others are NC, Normally Closed , before you apply voltage to them . NPN & PNP junctions .
Fantastic - very informative.
This Guy is a Beast with Silicon! Wow!
9:02 just for efficiency, would it not be better to use just 2 transistors to solve the NOR circuit
the 3 transistor seems of no use theoretical it might be part of the drawment for the negation but why would you do that then
Nice outro music. Sounds very 303-ish :-)
Audio not working in 720p
Great stuff! Is there a forum somewhere (something like reddit) where ppl take a stab at analysing these die pics?
This blew my mind
Excellent!
i got a few chips open but it just was white mush. don't know where they put the transistors and i have a feeling they had just stuffed it with potatoe
That last shot looked totally like screenshot from Factorio.
absolutely brilliant
You sounded really nervous. Relax, it was a fascinating talk and your presentation was excellent.
It'd be nice if we could actually see what he's pointing at when he keeps saying which parts "run here"
It's Master Ken!!!
I've been wondering how the control logic schematic looks like and how it interacts with the interrupts in the instruction rom( schematic) at transistor leve of the z80 and it's burning my neural circuit. Someone plz save me!
I've found that very flat ceramic chips (which can't be chiseled) can be heated and will crumble, though occasionally with case residue on the die. The fumes are not good for breathing.
I think that we soon will have access to high power laser beams that can chisel away AND scan a chip in 3D and remodel them, as a by-product of the nascent 3D-printing technology.
This looks like it takes a lot of patience. But that's okay, well worth it in the end.
I wish this were more accessible. Imagine if someone invented a machine that could scan a chip in real-time and get an oscilloscope-like trace at every point, and it was accessible enough that you don't need to be a big company or government to afford one. That would be the Holy Grail of hacking tools, and the end of manufacturers being able to hide secrets in products they sell without the owner being able to see them. But IDK how realistic that would be any time soon. :p
Anybody here still remember the early days of 1980s when the Soviets stole the blueprint for Zilog Z8000 microprocessor and tried to reverse engineer it.
I dont. Got any info? Im interested
14:50 redstone serial memory any1?
We need people like that to rebuild civilization after collapse.
you can now inkjet print transistors. 1500nm is easily possible, with some tweaks to the printer's hardware you can reach 800-500nm. If you want to spend on a super high grade research printer... 160 nm is about the limit you can do . But you can do a one-off chip design on a piece of glass, so that's pretty impressive. not to mention makes custom chips very very cheap
It would be so nice to "test" Sat TV again :) and reunite guys like Raton, Penga, Silverman etc,etc and learn from them again. I'm to old to start lol
this sounds interesting, can you tell more about it?
Hmm, chip manufacturers are playing factorio, but trying to make the base as small as possible. That's a tough one!