You are on page 1of 29

Reverse Engineering using X-Ray

George Tarnovsky
U.S.A
George@target-eng.com
All Rights Reserved George Tarnovsky 2017
Circuit boards come in various shapes and
sizes.

All rights reserved George Tarnovsky 2017


PCBs outward appearances, the internal complexity is not
evident. Below are cross sectional views of circuit boards
illustrating the unseen differences.

Simple 2 layer design Complex 12 layer

Both PCBs are the same thickness, the 12 layer


is expanded to better illustrate the layer properties.

All rights reserved George Tarnovsky 2017


Common methods used for reverse engineering
circuit board designs:
Back lighting, to aid visual circuit tracing mostly effective on:
Single sided--mask or component placement can obscure view
Double sided
Few multilayer boards--multilayer boards without plane layers
Conductive tracing, using a method such as an Ohm meter:
Effective on most single, double, and some multilayer boards
Mechanical delayering:
Very destructive; populated boards very difficult

These methods are virtually ineffective with most


BGA designs.
All rights reserved George Tarnovsky 2017
Back lighting aids in tracing
double-sided board.

Back lighting is
ineffective on
multilayer with internal
planes.

All rights reserved George Tarnovsky 2017


A Word of Caution!

All rights reserved George Tarnovsky 2017


All rights reserved George Tarnovsky 2017
Using X-Ray everything can be seen.
Practically nothing can be hidden for view.

All rights reserved George Tarnovsky 2017


Decapsulated Dies

Compliments of Christopher Tarnovsky Semiconductor Gurus


All rights reserved George Tarnovsky 2017
X-Ray view of the die area

All rights reserved George Tarnovsky 2017


Live view

All rights reserved George Tarnovsky 2017


Live view zoom

All rights reserved George Tarnovsky 2017


Live trace

All rights reserved George Tarnovsky 2017


Reverse engineering BGAs becomes an easy task with X-ray

All rights reserved George Tarnovsky 2017


Geometric zoom allows us to see the finer details without
sacrificing S/N.

.024 Spheres
BGA internal
bond wires are visible

BGA VIAs and PCB VIAs


All rights reserved George Tarnovsky 2017
Angular view simplifies tracing multilayer circuitry.

Direct view Angular view

All rights reserved George Tarnovsky 2017


Live active tracing with tilt

All rights reserved George Tarnovsky 2017


Few traces are visible to the X-ray view of the same
eye. area circled in yellow.

All rights reserved George Tarnovsky 2017


Methods to obscure the design using epoxy are
ineffective when using X-ray.

=
All rights reserved George Tarnovsky 2017
Analysis of obstructed views using lead
Normal View Lead sheet applied

56kv 125ua 79kv 99ua

Normal View of BGA and PCB Same PCB with .025 lead sheet

All rights reserved George Tarnovsky 2017


RAD Hardened Devices View

Fig. 1 Fig.2
Device view is harder to see requiring Hardened device compared to
more power. PCB
All rights reserved George Tarnovsky 2017
Failure Analysis

All rights reserved George Tarnovsky 2017


FPGA with Internal Flash

All rights reserved George Tarnovsky 2017


JTAG Interface Not Found

All rights reserved George Tarnovsky 2017


TDI Unreachable Access

All rights reserved George Tarnovsky 2017


JTAG TDI Access by Drilling

All rights reserved George Tarnovsky 2017


Temporary JTAG TDI Connection

All rights reserved George Tarnovsky 2017


Success

All rights reserved George Tarnovsky 2017


Questions?