 Good afternoon everybody. My name is George Tarnofsky. I work with Cisco and I'm a lab manager at one of our labs in Herndon, Virginia. Thank you for coming. This is a talk about hardware. It's not x-rays, it's x-rays, so if you're here for software, you might learn something anyway, so stick around. Anyway, be patient with me because we're going to start out elementary and we'll work up to something pretty interesting, okay? So here we go. So as most of you know, the circuit board's come in various shapes and sizes and the complexity really is an evident from the outside of the board. So this is the x-ray machine that we use. It's a Glenbrook Technologies jewel box 90, so it's a 90 kilovolt machine. As you can see, it's got a window in the front. It's a leaded glass, so it's pretty safe. You're not going to have too many issues at all. We check the machine every day when we use it to make sure that there's nothing happening that's going to affect us because when you're running the x-ray, when you go to the dentist, your x-ray is on for three-quarters of a second, half a second. This machine is on for up to 15 minutes, so the exposure time is huge. So for your own sake, it's best that you check it, right? So the slide to the right is the actual stage and the red dot, I don't know if you can see the red dot on that slide, that is where we'll be looking in this particular case in that picture. So it gives you an idea of where you are, where you're looking. So, you know, they say that x-rays are dangerous, but obviously I don't believe that's the case because this was me just five years ago. So you can see nothing's changed. No, that's actually some of you probably I'm dating myself because that's pre-IBMPC. So it's like 79, 80. Anyway, okay, enough of that. So let's get down to business. So cross-sectional views of some PC boards, as I said, I'm going to start out elementary, so just bear with me and we'll work up to something a little more technical, but in any event. The slide to the left is a two-layer, simple design. You've all probably seen that you can easily trace through that top and bottom layers easily. It's not a problem. If you look at the slide to the illustration to the right, it's a complex 12-layer board. Not only is it 12 layers, but it's 12 layers including plain layers. Does everybody understand the illustration or should I get into that with regard to what these columns go into it? No. Okay. Just keep moving. All right. Very good. So in any event, because you have plain layers in there, obviously you're not going to be able to see anything if you're trying to do any reverse engineering like, for instance, with opticals. So common methods for reverse engineering, backlighting, conductive tracing, and mechanical delayering. So backlighting is effective, again, without plain layers. If you have a plain layer or even with a multi-layer board, it's difficult, but it can be done. With a plain layer, all bets are off. When you're talking about conductive tracing, well, that's a pretty tedious task. It can be done. It's difficult, though. Mechanical delayering is very destructive. Again, it can be done. Even with populated, here I say it's ineffective with populated boards. It can be done with populated boards. In recon Canada, they gave an illustration of mechanical delayering that was effective. Of course, you've got nothing left besides a pile of powder when you're done, but you get your layers separated and you have what you wanted, the drawing. In backlighting on a simple double-sided board, you can see the top illustration. It would be pretty easy to go through and trace that board, right? I mean, everything is pretty evident with the exception of what's underneath the devices, and that you can find. So that's pretty simple. The bottom illustration, you've got backlighting on boards that have internal plain layers. Both of those, I mean, you can see that you're not going to get anything except the top and bottom layer. You're not going to find anything within internally. Everybody familiar with BGA, ball grid arrays? Great. This is an FPGA. What it actually is, it's a device sitting on a circuit board that's placed on a circuit board. As compared to conventional means where you've got leads and you put them through a hole and you solder them, in this case, you've got spheres of solder. That's the center slide and they actually melt onto the pad and that becomes your contact. Obviously conventional solder means are not going to get the job done. So it's done through hot air and there's some precision. You can do it in a toaster oven, however, good luck. You could very well separate the board layers. It's a little risky. The vial to the right is standard balls for replacing FPGA spheres or balls after you remove it. For instance, if you remove the FPGA, you want to re-ball it and replace it. With the X-ray, the picture to the left compliments of semiconductor gurus is a decapsulated device. The picture on the right is the same device, panelized and X-rayed. What you're seeing is to the left you see details of the actual device. Memory layout, everything is there. With X-ray, all you're seeing is the parameter of the dye. X-ray sees right through the silicon so that's going to be useless for anything like that. Because that question has come up before where people think you can use an X-ray to reverse engineer a device. You can't for that reason. There's practically nothing that you can hide from an X-ray. I'll show you some devices we've had to reverse engineer that tried to hide their design from us. It didn't work out too well. Here's an illustration of a BGA. It looks pretty complicated because you're looking at or convoluted. You've got these standard spheres. You've got internal bond wires. That's that matrix you can see coming off of them. You've got vias on top of vias and then you've got vias of different sizes. That can be rather confusing. The reason that you're seeing this is as I showed you in the first picture of the BGA, you've got a circuit board on top of a circuit board. The small feature sizes on the BGA, do I have a pointer? No, I don't. Never mind. The small vias are on the circuit board that the BGA is on. The large ones are on the circuit board that the BGA is mounted on. That's why it looks a bit odd when you see a via on top of a via or slightly offset. Can everybody see the bond wires? I guess that's pretty clear. The larger via, by the way, is about eight thousandths of an inch. You can see that the bond wires are fractional. That's internal to the BGA. I'm going to skip this slide. What happened? Maybe I won't skip the slide. I can't move. Did it go? It went. Never mind. I'll just show this to you this way. The X-ray machine allows me to do angular views. To give you an idea of the direct view on the left side, you can see the traces are one on top of the other. You really can't differentiate between where the trace falls within the structure of the circuit board. What layer is it on? You can angle it and at that point, if you look at the view on the right, you can see where now they've separated out. You can clearly see, well, maybe you can't clearly see, but if you look at the vias, the three vias that are along the bottom, you can see that the lines that are coming off are actually stepped in different positions and you can figure out what layer it's on, and then you can go through and you can trace it the rest of the way. The one feature that this has that's pretty unique is a geometric zoom. Remember I told you this is a live view, but I don't think I can do it. Oh yeah, here we go. The signal to noise is sacrificed when you're doing that because you want the sampling rate to be high. So that's why it looks a little grainy. But once you get to where you want to be, then you can go back to 256 samples and averages and then clears up. So here we go. Okay, there you go. So you can see the benefit of this machine because you can do it live. And I'll show that to you with a live trace. So here we go. So this is a trace where we actually have to trace where we go. Okay, here we go. Okay, so we're going to trace that second line off. Well anyway, you'll see what it's going to mean. So this is again the signal to noise isn't as good because we want to see what's going on, otherwise it would take minutes. But when we get someplace and we want to get clarity, like for instance that vertical line, that's where we're tracing. So it looks a little convoluted. So see now I did the 256 samples so it's clear now where it's going. And now we can continue to trace. And this would be typical if you were looking at something and you wanted to trace a line. So now we're getting into a BGA. And again, I can't differentiate whether it's the top or the bottom. So we increase the sampling rate. We stop for a minute. We might zoom in. I forget if I do that or not. But anyway, just to clarify for our own sake where we are. Okay, so now we're going to zoom in a little bit. We don't want to lose our place. And you're seeing this in real time. I'm not speeding this up or slowing it down for that matter. But ideally that's what you would be doing if you were actually, if you were, it was necessary for you to go through and do this to reverse engineer something. Okay, now we're getting into the BGA. I don't know if anybody followed this, but it's the center, pretty much center via. And it goes up. And there we are. So that would be typical trace if you went through it. So here was another one where we had a BGA and we had to figure out where it was going and we didn't know where the IO lines were going. So we used the x-ray to get there. I'm sorry, I'm not seeing the right things here. Okay, so here's another one where they had the plane layer on the outside. So consequently you're not going to see anything on the inside. And you can see it's pretty complicated. Here's some methods of obscuring the view. The top is epoxy. So the board was coated with epoxy. The epoxy is the same resin as the board. So consequently if you try to dissolve it, you dissolve the board. So using x-ray we were able to reverse engineer that. And that was pretty easy. The one on the bottom, that was a little different because we weren't sure what was going on. It turns out that they took a smart card, they chopped out the smart card itself. To the right you can see that there's a footprint of a smart card there. And they glued it in there and they covered it up so nobody knew what they did. Okay, so here's one of the other methods was to epoxy a sheet of lead on top of the board and then covered with epoxy to try to hide the design from x-ray. That didn't work either. All you have to do is increase the power. You'll see. Yeah, there's some variation but you'll see it. Also we were able to pull the lead out. But anyway, okay, red hardened devices. So the red hardened devices, it's interesting. You can see through it. However, if you look at the slide to the right, you can see the variation between a red hardened device that's that dark area. You can see some of the pads, but that's compared to a normal BGA where we would have seen everything. And of course failure analysis is a big reason to have an x-ray. So the slide to the top left, there's a missing sphere. I don't know if everybody can see that. It's like the fourth one in from the left and fourth one up. So that's one reason. The center slide shows you shorts that would not be evident to anybody because that would be on the inside. You can see the spheres on the outside of the BGA. If you tilt it, you can see them, but you'd never see the inside where they are. To the right, that's a real mess. That happens when you allow moisture. The sphere is a hydroscopic, so they're going to absorb moisture. And if you don't out-gas them and you place them, this is what happens. So this is a little problem we had. This was a design using a Xilinx FPGA. So there's the bottom view of the circuit board on the right. And we were trying to talk to it through J-Tag. So there was no identification, so we had nothing. So consequently, I took a look at the board and I found that TDI was not connected. There was no connection to TDI. But I knew which sphere was TDI. So rather than removing the device and going through that, I took a pin vice, drilled a hole, touched the sphere. And the reason I used a pin vice rather than a drill is because I wanted to be able to feel when I broke through and I was just to the ball. Because if I didn't do that, I'd probably drill right through the device. So I took a pin, stuck it in there, and voila, the device was identified and everything was working. So we were able to program it. Well, that concludes my talk. Do we have time for questions? Question? Joe! Well, yeah, they pretty much... It has an internal timer, so it shuts off. That's Joe Gran, by the way, if anybody didn't recognize him. What's the interval you have to wait for? Seconds. Yeah, you can just restart it again. You know, they're concerned that somebody's going to walk away with it on and forget about it. And that's happened, you know, even happened to us. You get involved with something else and it's still on, so time out. But yeah, that's the reason. Yes? Yes. They have some lead in them. They actually have some shielding in there. And again, you could see the difference. In that one slide, you could see the difference between the two of them. Yeah. Yes. Yes, thank you very much. Devices. But thank you for asking. Any other questions? Yes. I'm sorry? Yes, yes. Oh yeah, it came just the way you saw it. Yeah. Oh okay, I got the X. Two more questions? Three? Yeah. We do quite a bit of work, different things. One more question. Oh, you can't buy tilting it. When you tilt it, you can actually see roughly where it is. You can gauge where it is, how many layers it went down. And then you can trace it out. If anybody else has questions, please come and see me because I'm getting thrown off the stage. Thank you very much for coming everybody. Thank you, thank you.