 Thank you. Yes, thank you for the kind introduction. Welcome to our talk about uncaging microchips. So the background in here is two-fold. On the one hand side, we would like to encourage you also to make some own experiments and to see what is inside a semiconductor device. That means what is inside a microchip. And so the goal is that you also have the knowledge how to open up a microchip and how to get direct access to the silicon. On the other hand also, very often there is a rumor that a ship is highly secured because the silicon is inside a plastic coverage. And well, if a plastic package is really high security, we can also explain today because very often, even with amateur equipment, it's possible to open up ships and to get direct access to the silicon. We are not only focusing on microchips, but we are also focusing on more complex systems, how to open up the other system to get access to the silicon. In our background, we have started more than 25 years ago with analyzing the first telephone cards. And so starting off with some experiments at the Commodore 64, as well as working with the first telephone card, it was our major interest to find out what is the functionality of this telephone card and also what is inside. And of course, for identifying what's inside, it was also our target to open up those plastic cards and to get access to the silicon ship inside the telephone card. Nowadays, we are also very often open up ships in order to make some analysis or in order to apply some attack methods. For example, for putting some alpha particle radiation on the top of the surface or also to apply some laser, it's, of course, necessary to have direct access to the silicon itself. And therefore, also today, we are utilizing a lot of professional equipment in order to open up the ships. So today, we would like to give a short overview about the different techniques and methods how to open up different kinds of ships and also to encourage you. Because it is very interesting also to open micro ship packages in order to get further analysis. First of all, sometimes it's not quite clear whether this is really a package which contains a ship or whether this is only a kind of label, as you can see in the lower picture. So in the lower picture, it might be only a barcode label, but perhaps also an RFID ship might be in there. And therefore, the first analysis is the question, is there a ship inside the package? Then, of course, also there's the question, what is about the ship functionality itself? That means how many functions are implemented in such a ship? Is this only a memory ship or is there also some logic inside there? And what kind of logic is implemented here? And by the way, on the most of the ships, there are also so-called die markings. That means some small numbers, and these identify the silicon itself. And with these die markings, it's possible to make some research and some finding from literature as well as also from tools in order to get more information about the detailed ship itself. And finally, watching on the silicon itself indicates also if this is a more modern ship, that means smaller technology, or whether this is an old-fashioned ship, and so you can not expect so much functionality or security from the ship itself. So from this perspective, these are some motivation which also may encourage you to open up some micro ship packages and to find out what's really inside there. We have brought also three examples to show what is a potential finding out of this. For example, it's well known that some goods are tracked down with RFID ships. And so recently, we also got a t-shirt with a dedicated label inside there. And it was not clear whether this label is just a barcode label or whether there's some more techniques inside there, especially an RFID ship. So as you can see in the second picture, it's quite easy to identify if this is more than a barcode label because simply with a torch lamp, it's possible to illuminate this from the backside. And so the flash lamp indicates whether there's something more than a barcode inside there. And indeed, as there's some structure inside there, we have put this into a glass of acetone. And after a short while, the label has deliminated. And so we got the final picture with the antenna inside there. And in the middle of the antenna, there is a small, dark spot. And this is a ship. So it was clearly from the antenna size that it's communicating in UHF frequency range. And also the small dot, it's an RFID ship. So now it's prepared for further analysis with a microscope. So you see, it might be very simple to get some more information out here. Another example brings us back to the history. And as I mentioned before, we have started with investigation on telephone cards. And of course, not only the telephone cards, but also the telephone card system has been of high interest for us. And so we were in a lucky situation that we found some printed circuit boards from a card telephone. We only got access to those because those card telephones has been burned down completely. So there was a huge fire inside this area. And so the card telephone also got burned. Anyhow, we managed to get those printed circuit boards. And in the second picture, you can also see that the x-ray picture of the printed circuit board clearly shows that all the wire rings are still OK. So it was possible for us to draw a schematic and to see how the different pins of these printed circuit boards are connected. Anyhow, it was not clear what are the different ships, because due to the heat, simply the marking on the ship itself has been vanished. So from this perspective, we have used some decapsulation method in order to get the single ships, the silicon ships, out of those devices. And as you can see in the lower picture, then with some microscopy work, we were able to find out what is each single ship. And so identifying the different names of those ships and also combining this with the schematic, it was possible for us to resolve the main function in those days from the card phone itself. And this gives us a clear clue in what direction the telephone has worked in those days. And finally also, there was something in the beginning of 2000. There was a price competition. And this price competition means that there is a small sticker, which has to be applied to the TV set. And then in this perspective, it was also that there are a lot of rumors whether there is a kind of spy ship inside there. And you see on the lower side, there is some comment from the internet at those days that there should be an electronic ship inside there. And this electronic ship not only record what you are watching on TV, but also make some sound recording in order to find out how many people are in the room watching this show and so on and so on. Well, anyhow, we clearly thought, well, this is just a rumor. And so, of course, we used our techniques in order to open up this device and also to find out what's inside there. Well, and in the end of the day, it was clearly that this was only a dot mask. And below of this, there was some film, which is photosensitive. And when you watch the special TV show, then this film has been eliminated and therefore it was clearly identifiable whether this show has been seen or not. So it was clear for us that we could identify there's no spy ship inside and this was only a rumor. So also there for the preparation techniques are quite useful and helps to understand what's going in inside there. All right, some words to the chips and their packages. So there are many thousands of different packages for chips today. And sometimes the functionality of the chip, which is inside, will directly determine the way such a chip is packaged. And this is the case for these chips here, especially. And if you look on the left, that's an interesting thing, a fingerprint sensor, which is another form even used today. With this fingerprint sensor, this is a specialty that the chip itself can be directly touched with a finger. Normally you would avoid such a situation, but here you have the direct silicon accessible and there's only a frame, which is covering the surrounding of the chip to make it mountable in the device itself. Then we have a webcam chip shown here, which is just covered by a thin plate of glass. Of course, the picture or the optical radiation has to reach the chip. And therefore, the same is true for your microscope. You can directly observe such chips without further preparation. Yeah, I think the older one of you know this e-prom type of memory, old fashioned thing. But sometimes it's still seen today. You can electrically write such an e-prom memory, but if you want to erase it, you have to put it under ultraviolet light to make the erasing function. And so this means also this package has a window. In this case, it's made of silica because this uses to be UV transparent. And again, you can have a look inside without any preparation, which sometimes is quite interesting. And then far on the right, we have an amplifier chip shown here, which is an instrumentation amplifier. And therefore, it should be sealed from the environment, but also from electromagnetic radiation. And this is done here in this case by a ceramic package. And this package has a metal lid over it. And again here, it's very easy to open this package. We will see later on, was just using a blade. So all of these four packages are quite interesting for an amateur. You don't need any equipment at all to have a look inside. But as we said, from open to armored, there are some more difficult chips to open. And here on the left side, that's a typical chip which you will encounter in millions today and all consumer goods. It's a plastic package. Here we have an older one, which is a plastic dip package, but you also know the surface mounted devices and so on. So these plastic packages are quite robust against environment, but also they are robust against chemicals. And this means you need quite harsh conditions to open them in a chemical way, or you will need laser, which we will see later on. It's epoxy resin. And the same is true for the glob top package, which is a very low cost kind of package. Just as a chip is put on the printed circuit board, then it's connected with bond wires to the circuit board itself. And then afterwards, just a drop of epoxy resin is poured over it. And you see it's not the rectangular form, which it should have. It's more just a drop which puts on top. A glob top package is also seen here in the third picture, which is a smart card package, a typical one. If you would turn this picture around, then you would see on the other side that there are the typical golden smart card contacts. And from the backside, it's a picture like this. You have the chip, and the chip is connected with bond wires to the connection points. And then afterwards, to hold it in place and also to make it resistant from the environmental conditions, it's also protected with a glob top package. So just epoxy resin is poured over it. And then finally on the right is something which, yeah, some people call a security package. You see that we made this in high-fination. Not only is it darkened, so that you can't see directly through the chip, but there's also, there can be some specialties, for example. In this case, there's an additional layer which is put on the chip, which is also made of silicone itself. But, yeah, as we show it here, it's not, I would say it's not really security in many cases of the packages, because if the security does not start in the chip itself, I would say then it's a little bit too late. All right, so what can you see if you look inside such chips? And we've chosen some examples where you don't need any preparation at all. And here, you can see some memories. For beginning, it's quite interesting to have a look at older chips, which are sometimes available still. And that's because a simple fact. In the older days, the technologies were not so small as today. So this means you can see the structures with your bare eye, or maybe you need your grandfather's magnifying glass, maybe, but you don't need a high definition microscope. And so here, on the far left, there's a chip from 1976, very old one, very small memory, and you can directly see with your eye all the structures inside, just through the window without opening it at all. And then if we proceed in time, also to a vintage chip from 1988, the one megabit EEPROM, there you see already, it's more like a gray mass with the memory cells, and you definitely would need a microscope to have a further look inside how such a memory cell is built and to analyze it. And then on the right, there's also an interesting example of a memory, but this memory has some excess rights tied to it because that's a telephone chip card. And here you have a very small memory of only 88 bits, but the rest is control logic so that only the people who are or should be allowed to load it and to erase it have these excess rights given to them. If we look at the MCOs, the microcontroller units, then they are quite more interesting than just a memory. And here again, we have four different chips brought to you. Two of those also have windows where you don't need any preparation at all. And the one on the left is again a chip from 1976, very old one. You can see directly all the different structures like ROM, RAM, the EEPROM part, and also the logic part, which contains the CPU and again, also some analog devices which are needed for the functionality of the chip. I think the PIC-16, the second picture, you know in the flash version, which is very common today. You just can program it and erase it again in a normal device. But in 1988, these types of PIC controllers were made with EEPROM, so this means you could program it. And then if you want to erase it again for reprogramming, you have to put it under ultraviolet lamp for five minutes. So therefore, there are some older versions of this PIC controller. But what you can see is that the technology is smaller and that the chip has a very high density in comparison to the chip, which is 12 years older. Interestingly, all the smart card controllers look quite the same like these older devices. And they also have ROM, RAM, EEPROM, or normally EEPROM, so electrically erasable programmable ROM. And so therefore, the smart card units, even those in the 90s, look quite the same like the older MCUs. And finally, just for comparison, we also brought a 68K CPU. This has only cache, but no non-volatile memory and was used in some older home computers, for example, but also in instrumentation technology. So what do you need if you want to start with preparing microchips? Just to have a look if it's interesting for you or to have a glimpse inside. So what you definitely need is a simple microscope. And we showed there a student version. It's about 300 euros. But there are also quite interesting USB microscopes today, which come ready for use for about 100 to 150 euros. That's quite good. Tools, you need definitely some mechanical tools like scalpers, tweezers, which we have here. Sometimes some sort of dentist tools, which also would serve quite well. An ultrasonic cleaner is a very good thing to have because this is really nice for package preparation, cleaning, but also removing particles. And also if the chip is prepared and ready, then you can remove all remaining residues and particles from it. And finally, there are three solvents, which you need for beginners, which is alcohol, ethanol, and acetone, and also benzene. These are three solvents from non-polar to polar type. And with these three solvents, you can open a lot of different packages. Then for upgrading such equipment, it's quite interesting to have a 3D view. So with a stereo microscope, you can make preparation with both your eyes. You have a 3D version. And you can directly see what you're doing, which is sometimes quite difficult if you have only a monocular sight. Then if you want to share your results, a microscope camera could serve you well, which is available for about 300 euros. But there are also some DIY versions, for example, with normal cameras, which are adapted to the microscope itself. Some further chemicals can be needed, which I will also show you later on in the table, which are not without danger, I would say, and therefore also typically a lab coat and some protective wear would be used. So now we are in a moment. We will come to different details of how to open a package and the steps itself. And this will be sorted from physical opening. So this means thermal methods or mechanical methods over to chemical methods, where you directly open the device with chemical means. But there's also a mixture of both. And therefore, I would like to hand over to Markus. Yes, thank you. Let's go to the workbench and open some packages. So beginning, as Peter mentioned, with the physical ones. And the first one is quite easy. You just need a vise. And you put the ship inside this vise with the lower part of the IC, as depicted in the first picture. And then you just put some more forces to the IC package itself. And during the time the vise will be smaller and smaller, the package will break up, and the upper part lift up. So as visible in the third picture, you can use a simple screwdriver to remove the upper lid. And then finally, in the last picture, it's visible that bare silicon ship is visible for your further analysis. Also connected to the lead frame, the lead frame which connects the ship to the outer pins and to the outer communication. So this is a quite simple method. And indeed, this is the first method we have also used in the example of the card telephone I have explained earlier. So it was quite easy to break up those ships in order to get the silicon parts out of the ICs and then analyzing them with the microscope. Even if the package would be a little bit more hardened, for example, a ceramic housing, like used in eProms, then it's also a good idea to fix this in vise and just to place a screwdriver on the top part of the IC. And with a small bump on the back of the screwdriver, the upper lid will be removed. And as you can see in the third picture, directly the access to the ship is possible. So indeed, I think these pictures clearly identify that this must be not high-sophisticated techniques or something like this, sometimes really a normal workbench is sufficient to get access. Very easy in the case if there is a special package, as Peter has explained, with such a metal lid on top of this. Because this metal lid is soldered on the ceramic housing. And typically you can think about grinding this away or try to desolder or something like this. But there's a very easy method to open up those kinds of packages. You just use a blade, as visible in the second picture, and use a hammer for a small stroke. And then this blade drives under this metal lid. And you can simply lift off this metal lid without any further effort. So it's just a two-second work to open up those kinds of packages. And even those blades are quite easy to access, because you can see in the lower pictures that they are sold also in discounters for cleaners of glass ceramic. So these blades are easy to use. Just with a hammer, you can drive them below the lid. And so this is open. So you see, physical mechanisms can be very easy. Now, as also mentioned before, our first topic has been to check what's inside a telephone card. And of course, such a physical preparation, it's more complicated on a small plastic card. And therefore, it goes into the direction of physical-chemical reaction on those cards. And you can see here in this row of pictures, we have just placed such a smart card in acetone. And after five minutes, as visible in the second picture, the plastic of the card absorbs some acetone and therefore swells. After 15 minutes, you can just wait for those minutes. Then the structure is fully distraught. And so it's quite easy to remove the remaining plastic parts as visible on the fourth picture in the upper row. So again, just by waiting about 15 minutes in acetone, the smart card is destroyed. And so as visible in the lower picture row, it's possible to remove the antenna and the chip itself. And I think the result in the last picture on the low row is quite impressive. The complete antenna, including the chip, has been resolved out of this plastic card. And so it was quite easy to analyze more the antenna and the size and how this is implemented in here. Anyhow, you may recognize that the chip is still covered by a glock top. That means a small piece of epoxy on top of this. And so it's a question how to remove this. Here, it's possible to use, for example, a laser with infrared laser, especially for about the wavelength of 10,000 nanometers. It's quite useful to open up those kinds of packages because the silicon itself is transparent for such an infrared radiation. So the chip itself will be not directly affected by the infrared radiation, but all the energy will be absorbed by the package itself. So it's just a termic destruction of the package as visible in the lower picture. And especially also, this is quite useful to open up so-called secure packages, as Peter has explained. So even those kinds of packages are just applied with the laser and are opened up so that all the silicon can be directly accessed. Anyhow, this method also bears some risk. It bears, on the one hand side, the risk that the chip still gets damaged due to the fact that the package compounds are heated up. And so this temperature could also be applied to the silicon chip itself or make some terminalical tension, and therefore the chip may break down. On the other hand, of course, infrared laser radiation may also make some health difficulties, and therefore it's very important to be careful with those laser radiations. So question is, OK, how to open up epoxy in other ways, not having such a laser? And therefore, first, again, a physical preparation takes place. So for applying chemicals, it's very good to prepare the chips with some mechanical preparation. And you see here, again, the chip in a vice, and then with a grinding disk and some parallel movement, as visible in the third picture here in this row, a small calf has been set up. And so we have two advantages in here. The first advantage is that already some material is vanished, and so therefore we have a faster access to the silicon itself. On the other hand, also, we have some area where some chemicals can be dropped on and will take place here. So let's go with this chip to the chemical treatment. And here, again, in the first two pictures, you see the preparation by the mechanical grinding. And then the chip is put into a sand bath, which is heated up. So at about 50 to 90 degrees Celsius, then some nitric acid will be dropped on there. And just after a while, the epoxy will be removed and you can get direct access to the silicon. So after you have the desired results, that means after all the epoxy has gone, you can remove the rest of the acid by using some acetone as visible in the lower picture row. And also it's a good idea to clean up this chip into the ultrasonic cleaner in order to remove the remaining particles. If you don't want to wait for a long time, then you can again use some acetone in order to have some rapid drying. And finally, you have a very good chip preparation where you have access to the silicon, but also have the connection, in most of the cases, still okay for using this chip and operating the chip in this environment. Anyhow, this acid may also damage some parts of the chips. And therefore, it's also the question if you do not need to operate the chip, but just for inspection, there's another method to open up those kinds of epoxy. And it's just using coliformi or in German coliformium. So putting parts of coliformi together with the chip into a glass, then you can heat up this to the boiling point. It's about 320 to 360 degrees Celsius. So it's possible to use simply a heat gun and makes this very fast. Anyhow, by using such a heat gun and heating up the coliformi, it also makes some ugly smell. So be prepared that this is not in your living room because otherwise you won't access the living room for the next days. Anyhow, after a short while, about five to 20 minutes, depend on the package itself, how big this package is, the epoxy is completely dissolved. And therefore, the chip could be taken out of this and can be cleaned again in acetone. So you see in the last picture on the top row, it's a very good way to extract the complete chip and to get good access to the silicon. But anyhow, in this case, of course, the chip cannot be operated any further. It's also the connections, the bonding wires and the lead frame has been dissolved in the coliformi. And therefore, it's not operational anymore. So you see there are also some chemical ways for using even as an amateur. And so for using those kinds of chemicals, that's also the question, what kind of chemicals can be used in here? Okay, Markus already showed you some examples where in the processes you need some chemicals. And so typically a problem with chemicals is that they are quite hard to obtain, especially for private persons. And they are typically, if they are pure, quite expensive, especially if you buy them in small quantities. And therefore, we have set up a small list which contains chemicals which are available readily from household products or we would say from the supermarket. And these chemicals here are listed in alphanumeric order. Also with the German name because they are quite different from the English name. And what mainly is available in supermarkets are household products are quite pure chemicals and these are solvents. And remember we need solvents for opening packages, especially if we want to dissolve one kind of plastic but not the other. For example, opening an RFID label and you don't want to destroy the antenna itself which is put on a plastic but you want to open the package where the antenna is put inside, the laminate. And so therefore, we have put together several chemicals from acetone for example over benzene, ethanol but also ethylene glycol and percloethylene which are solvents for different kinds of plastics which you can see in the use case row. There's a very special solvent which is the second last one, THF or tetrahydrophurane and because this dissolves also PVC, polyvinylchloride which is normally robust and could not be dissolved but with this special solvent you can also dissolve PVC. Then of course you need demineralized water or distilled water sometimes called because we don't want to leave residues on the chips especially if cleaning them for example in this ultrasonic bath. And there's also some chemicals like the sodium bicarbonate and sodium hydroxide which is needed to neutralize acids but it also can be used for example to dissolve aluminum. And aluminum is also used for example for antennas on RFID tags so you can dissolve it away and just the chip is left open. There's one chemical which is not available in the supermarket. I think that's also a good idea that's not sold there. That's a fuming nitric acid. And this fuming nitric acid is often used also in professional versions of package opening as we will see later on for destroying epoxy material. So it directly oxidizes the material and it's less an acid than more an oxidant at least if it's water free. So if there's water which is mixed with this acid then it gets more acid characteristics and then it will destroy metals and also the chip itself. Therefore if one uses it it should be water free. Of course if it destroys epoxy material then it can also destroy skin, clothes, your furniture, everything. All your devices are rusting away and so on. So that's really a nasty and therefore appropriate safety equipment must be used. So it can be bought. It's about 100 to 200 euro per liter. Quite expensive and also quite difficult to obtain because it's also used for some other more dangerous purposes. But there's also a way of maybe doing it by yourself. So, thanks. So of course we were looking for recipes on the internet which are there but that's much cooler. That's a book here which I got from my 15th birthday I think. It's for a science book for kids. I got it from Kurt Wazelowski and just also contains a recipe for making fuming nitric acid. Also with some nice examples how this fuming nitric acid works on wood for example when it gets burning and so on. So that's the recipe and then you of course need the equipment. So the reaction is that concentrated sulfuric acid which can be bought for example in pharmacies reacts with potassium nitrate. It's also a typical pharmacy chemical and then the fuming nitric acid which is generated is distilled from this mixture. You can see this in the middle picture so that's a normal distillation apparatus. The one which is used here is much simpler and on the right that's a micro distillation glassware which can be used for example if you only need some milliliters of this acid. So typically for opening one package I would suggest for example five to 10 milliliters of this acid so it does not make sense to have more than that. Talking about professional chemicals there are some more of these. So yeah you already recognized I think the hazard pictograms which are here on the right side. So these are chemicals which are not harmless and so therefore also they are typically only available and from professional sources. There are some chemicals which are good solvents for epoxy material. So this means in this case epoxy is not oxidized but it's dissolved or I should rather say it's swollen. So the molecules of the solvent go into the epoxy and then it swells and you can brush it away. It's not a real dissolvent process in this case. Besides these epoxy dissolving chemicals there are also some specialty teas for example the first one, Colleen. This is used in industry for chip cleaning but also for wafer cleaning and then finally the three ones on the bottom. These are the acids which are used for destructive package opening, nitric acid you know already now and then we have two other ones, sulfuric acid which must be used in a hot variant and also the so-called oleum which is a more aggressive version of the sulfuric acid which can be used also at room temperature. So looking at professional methods which are available for example for semiconductor manufacturers if they want to do failure analysis for example then also we have brought you some examples and this one here uses also fuming nitric acid. It's a chemical decapsulator. It's a typical tool for industry if packages are to be opened for example for failure analysis or other means. And so in this case here the acid is not dropped onto the surface of the package but it's first heated and then it's pumped through a small nozzle which is made of Teflon or of glass and then a jet of hot acid is pushed on the surface of the package itself. So this means all the reaction products are readily flushed away and perched and the chip only comes in connection with pure nitric acid. So this means it can also not be damaged by reaction products which is very good. So typically such devices give very good results but there's a disadvantage of course. On the one hand side it's professional equipment that's quite expensive. On the other hand you need much higher volumes of the fuming nitric acid. Typically if you do it manually you would need five milliliters or 10 and here you need much more maybe 50 milliliters or even more. This one is a CNC milling machine which we would also be using for example in professional environment. And I think if there are lock picking people here they would like to have something like this too. That's really nice machine which can make CNC programmed milling. It has standard packages pre-programmed inside but it can also learn new packages. And the interesting thing is that you can also use diamond drills and thereby open ceramic packages. Also for example from the backside if you want to get access to the chip. Backside for special purpose attacks. Nevertheless this equipment is very expensive. Also in operation. So this diamond drills have a high cost and last but not least it's very heavy so it cannot be used in all laboratories. This one here is a laser decapsulator. Laser decapsulator is mainly a laser scanner and I think you saw some of these in the assembly already for cutting wood or styrofoam and so on. And that's nearly the same but it works more on a microscopic level or millimeter level. And so hereby a complete plastic package for example can be scanned with a focused laser and the laser just evaporates the material. There's an internal fume hood so that the reaction products are purged. And so therefore that's really a nice way of opening packages. They're again like for the milling machine they are pre-programmed packages but it can also learn to use new packages. Nevertheless there are also disadvantages of such methods. Again here like Marcus already said for the laser you have a thermal stress to the chip which sometimes can lead to breaking the chip which you don't want. And also again the costs are quite high. CNC milling and also this laser decapsulation are typically not used to completely open a package. It is more used for generating a recess which is then further treated by chemical etching. So this means you would only make a recess in the plastic package which is nicely fitting the decapsulator, the chemical decapsulator and then afterwards with fuming nitric acid you would do the final opening of the package either manually or with an automated version. So if the chip is properly prepared and here for example on the right you can see a chip which is opened with a professional device. Then you can have full access first with a microscope of course. You can see if there's a chip in the package you can have a look if there are some die markings which can lead you to a more material literature data sheets and so on. Generally have a look inside what the function may be and what is this used for in the device which you are currently investigating. But sometimes after you have done that the real fun starts which means preparation of finding attack vectors and then finally also doing such attacks. So attacks could be further reverse engineering for example making a complete preparation of the chip, grinding away the different layers of it for doing a complete reverse engineering. Then if the package is opened you can do some attacks which you normally won't do or can't do with packages with chips inside which are for example laser fault attacks that you for example focus a laser on the chip to make some faults or to induce some wrong calculations inside. There are many devices which have ultraviolet fuses which can be erased for example against code protection. One can do permanent manipulations for example by focus iron beam or laser cutter if this are more older chips. One can do alpha radiation attacks because alpha radiations also would not penetrate a package but they will penetrate the silicon and then make faults for example. One can do electromagnetic attacks by applying a probe on the top of the chip or on the back side and the one which I have left out is a photon emission side channel analysis so it's quite interesting. That's the way of looking at the chip how it generates infrared photons while calculating for example if a transistor switches and photons are emitted. That's a method which we are professionally using since 2001 but recently I read in the press that there are also some other people looking for this method for example the German Bundesnachrichtendienst wants to get such a device too which sounds quite reasonable to me because there are some smart card chips today available which are not prepared against such kind of attacks and also there is maybe a way of using this photon emission side channel analysis for exploiting a back door which could be induced by physically unclonable functions. If you're interested we made a talk last year and there we have also a small chapter about it but this would lead to far in this environment here. If you're interested in the topic itself and want to have an overview then we would recommend this book that's available in German but also there's an English version of it which we have put under the literature here. It's from Siemens failure analysis guy and this contains all the package opening but also chip preparation techniques. There's a nice presentation about using a fuming nitric acid for decapsulation. It's from ONN semiconductor in 2008. If you use colophony or rosin it's sometimes called then there are two interesting projects. One is from the Kauß Computer Club Berlin. It's here in Kapstadtung with colophonium unfortunately it's only in Germany in German and then there's also a project from the lab which is called the colophonium kombuse which is an automated way of opening packages with colophonium. And then finally there's also an interesting thing about laser chip access and how to open chips with laser and 3D techniques. So these are only a few points. This book we have also in our assembly so if you want to have a look inside then be invited to visit us today. Finally if you have a look inside chips then sometimes interesting things open up not only technology, not only attack vectors but sometimes you also see some artwork. Sometimes today there's not much place left because that's also cost and so therefore this chip art is getting less and less but these are some examples which we found sailboat and here in the right corner that's city arms of Hamburg which belongs to a chip from Philips. All right, so this would complete our small presentation about chip opening and now we have some yeah some minutes for questions of course. Wow amazing, I see my shopping list grow. So are there any questions? I would say from the web, are you okay? Indeed, there's one question from the internet and it's concerning the leftovers of the chemicals. Do you have any hints about how to get rid of them after you practice in your private environment? All right, so first of all I would recommend not to buy any chemicals that you don't need because that's all environmental pollution which is generated just in the moment they are produced and so therefore by only the chemicals you need by only the amounts of chemicals that you need I would recommend and then afterwards there are also ways of neutralizing these agents. For example, a fuming nitric acid can be neutralized with baking soda which also we have on our list here and so therefore I would have a look inside and internet sources for example to see what are the special ways of neutralizing each agent. So for a private person it's I would say nearly the same like for industry also in the industry these chemicals are neutralized and then given away to the appropriate institutions. Sometimes you can just flush it away after neutralizing it but sometimes the residue is maybe toxic and then you have to give it to a special institution. Question answered I guess. Any more questions from the web? Okay, outside we do some load balancing. You start first please. Is there a way to actually verify where other chips are identical? So if you have two chips whether they are the same or generated using the same mask set or any mechanical way to actually verify that? If these chips are identical, okay I see. So if there would be a way for example to make an x-ray this would be of course fine because then you don't need any preparation at all. So some years ago I would have recommended to ask your dentist for example because he has an x-ray but normally x-rays are today not used for other purposes as the purposes they are intended to. So therefore x-ray would be of course the best one to have a look inside a chip. If these are smart cards then sometimes infrared can serve well because also with infrared you can look through the smart card itself sometimes and then see the surrounding. And also chips have typically characteristic bond wires. So this means that alignment of bond wires so where are the pads for example differ also from chip to chip. And finally of course the marking because typically a chip marking is only valid for one specific chip and another chip which would be in next generation for example would also have a different chip marking then. But anyhow of course so you can distinguish whether this is the same hardware or not. Very often today also the chips are equipped with some flash and latest if you open up one chip you can identify whether there's a non-volta memory on the chip and of course you cannot distinguish by the microscope whether the same flash content is in there or not. So it might be that in different operating system or different program is running on such a microcontroller containing some flash even if this is the same hardware. But at least you know okay this is the same hardware and also learnings you have done on a first chip you can also use on the second chip. Question answered. Right. Please go. So have you ever opened up a package just to find you've been hit by a counterfeit part? Oh personally not. So I know that there are many counterfeits especially from Asia Pacific range and sometimes it's quite interesting I've seen such devices I did not open them by myself but sometimes there's a totally different chip inside. So it does not even match the type of functionality which you would expect for example instead a microcontroller there's a 74 something logic chip inside which would not work at all. But again here also if you open up the chip package you can see the die marking and have more clue about the chip itself and also about the functionality because a logical chip like 74 series it's much less complexity and so quite clear visible in the microscope compared to a microcontroller or something like this. So it's quite easy to identify whether the printing on the package is correct or whether this is just a fake chip. Well that's quite clear but you just know it after you open the dots. Oh yeah. Right. Question answered I guess yes. Please go on. So you said you can generally look at chips using just optical microscopes. What kind of magnification would you need for different types of chips? Ah I see okay. So typically for a stereo microscope for preparation you would need only some five-fold or 20-fold magnification but usually for looking optically at chips you would need a 100-fold to I would say 500-fold magnification. That's of course there's a limit because if the technology gets smaller than the wavelengths of light then you get a problem and so therefore we also have recommended here for amateurs or for beginners in this topic to use older chips because there you have for example 1.2 micrometer technology which is far away from the wavelengths of the light but a few today would have for example 90 nanometer or 65 nanometers or for the CPUs even 22 nanometers or so that's 20 times smaller than the wavelengths of light and then you don't see anything at all just colors. Okay question answered. And please be invited to our assembly later on because we have brought a microscope and some sample chips with us so you can make some own experience in there and watch the silicon and see what kind of structure you can see. So please be invited. I'm totally sorry I totally overlooked microphone four. Please, please go ahead. Sorry. If you have just a limited amount of chips and want to maybe reuse them again like we want them. Could you please repeat the question with a microphone because then it's recorded? Yeah. So if you have like only a couple of chips and want to reuse them again and dissolve the epoxy like what method would you recommend to use? All right so if you want to use them after preparing then it's very important that there are no acid residues left because we sometimes see for example if you prepare a chip with fuming nitric acid and there's just a small amount of acid which is left then after one week or two week the chip's deteriorate and so this means that they have to be and the acid has to be neutralized very good rinsed with acetone and then afterwards dried carefully. So I would recommend to store them also maybe under dry conditions. But if you are interested in afterwards you can also contact us because we have some methods also for conserving chips. Question or answer? Great. From the internet please. Yeah, that's another one. It's about have you noticed any manufacturing factors implementing countermeasures in regards to decapping the chips? Yes indeed there are some countermeasures advertised by manufacturers who say yes we have a kind of secure package one of those secure packages has also shown in the presentation where for example special coverage on top has been placed but anyhow also there we have displayed some methods in order to open up those kinds of packages so it's always a trait of how much security you can expect from the chip package and so in my opinion I think the package there are so many methods to remove a package it could not be a completely secure package just by the package itself so if you need to have some secrets inside a chip then really the chip hardware should be secured and therefore protected against spying out of those data and this will be more on logical ways for example using encryption instead of using some material in the package. So there should be no trade-off between buying an insecure or less secure chip and then adding a package. We think that the chip itself has to be secure or secure enough I should say and it cannot be afterwards put the security cannot be put afterwards around the chip so that's not the way of clean engineering. Great, we have time for a last question if you could please keep short and you guys also please go ahead. Yeah I have a question about legal problems when you publish photos of the inner parts maybe sharing in a public database to make education better I don't know. Let's do it, sorry. So if you make photos of chips themselves which you have prepared by yourself then I think it should not be critical so we have also here some pictures which we made sometimes of our own chips, sometimes of other chips but this does not contain any trade secrets for example but of course that's a difficult question especially if it goes for example to pictures which contain material where you see for example code imagine ROM picture. If you would publish a picture of a ROM then it could be that this ROM contains code and then you would publish this code. So it's very difficult to tell which is right and which is wrong but usually we don't think that just chip pictures are critical. And it really depends also on the resolution if you have a complete chip and a low resolution that you cannot identify single lines and cannot use this as a schematic to rebuild such a chip then it's something different compared to a high resolution picture where you can draw a complete schematics in there. But we can also talk later on in the assembly more on this topic and also I see there's some further question but I think we are running out of time so we can do this later on. Great, thank you very much. Thank you for questions for guys with the open chips. Go to the assembly and ask them if you have any more questions. Please.