>>My name is Joe Grand, I do computer stuff, I do electronic stuff, I designed a few years of
DEFCON's electronic badges. 14-18. Today is a talk that I've been really wanting to do for a
really long time, and that's look at different ways to get access to inner layers of
circuit boards to help with reverse engineering. So, we see a lot about chip-hacking that
Chris does at a really microscopic chip level. We see a lot of hardware hacking,
embedded systems, component level, connecting up through JTAG interfaces and through UART
ports and all sorts of stuff which is slightly higher level, but we never really look at the
board level. And this is something that I've really wanted to do for a long time, so
I'm excited to give this and lucky that I guess I convinced enough people at DEFCON to let
me give it. So just to get started, reverse engineers PT boards isn't that much different
than anything else, except we look at the circuit board. We're undesigning a system that's
already been built. In this case for this work, I'm sort of assuming a black box type of
scenario. Maybe we open up a product and access a circuit board in the field that we want
to figure out what's going on with it. So we take that system, and we use destructive methods
and nondestructive methods whatever we need, depending on the situation so get all the
information about the board so we can go and perform an attack or do SGLGS something else. The
main ways soldier to access each individual copper layer, which is the primary thing I'm most
excited about. Once you get those, if you get each layer of the board, sometimes they have a
multi‑ layer board, and I'll describe the kind of typical board composition. You can kind
of lay those out together and stack them in just (?) and do imagine processing types of
things to trace out connections. Once you do that, you can say this part connected to this part
and maybe micro controllers connected to international memory to give you an idea about
what's going on. Oh, yeah, also besides the obvious sorts of things figuring out how the
system works, good to verify security schemes of things. What I really like about this is
injecting kind of new behavior into a device. This is something that's like, yeah, of course you
have the standard research type of things or forensic analysis or whatever. If you have the
board design, you have the fingerprint of the board. If you have that board level, you have
firmware and other things. Lots of governments have been doing it for quite some time, and they
must use the techniques I'm assuming. It's interesting area because now you take a board,
delayer it and figure out what's going on and find a good location to inject something
that isn't going to be detected. Whether it's enabling some new feature, whether it's some
surreptitious monitoring or whatever it is, people don't think if somebody changed the
board layout between the time I sent the board out to fab and the time it came back from
China. No one is thinking about that. At chip layer maybe. There's all sorts of kind of
gray mart areas for chips, but circuit boards, you don't think if someone adds functionality to
a board, but you should. So we look at three different sections. I've broken this out.
The first soldering, thing is getting access to the top or bottom layers of the circuit
board. Then we look at delayering for multi‑ layer boards to how to figure out and
get access to each individual layer of the board. Then imaging with nondestructive types of
stuff. A lot of tools we look at here are not that impressive, but it's just never been talked
about. So we have manual some manual methods and chemicals. All these different things are
cool to put in one spot. And a lot of thing we use are design for failure analysis, so they're
engineering tools that legitimate designers are using and legitimate fabricators are
using that we're using for hacking hardware and for reverse engineers and that's what we can
do a lot. Take advantage of tools out there and use them to our advantage. Just work was
done for a cyber fast track project so our tax dollars at work to play with circuit
boards, which is awesome. I was going to do it anyway. I didn't tell them that. So before we can
actually start getting access to the layers and start doing some of these techniques, we need to
understand how a circuit board is put together. How many are familiar with circuit boards and
how they're built? About half. How many have designed a circuit board? About the same half.
Okay. Cool. I guess that makes sense. Okay. Half of you guys are familiar with it and half
aren't. That's pretty good. Circuit boards are basically a sandwich of layers. So you have
your insulating layers and your copper layers. Your top layer is copper and then you have your
insulating layer. So I call it a circuit board sandwich and made a shirt just for the occasion. I
don't know if you can see it from way in the board. Circuit board sandwich. Circuit boards
are awesome. So this is ‑ ‑ the circuit board provides a physical carrier, so you have
all the components that go on the board with the physical carrier where the component
connects on the board and they provide the electrical pathways. If you figure out what they are,
you can do the reverse engineering. This picture on the right this cross‑ section is a
16‑ layer board I happened to pull out of my stack of circuit boards, and it's a cross‑
section. So we're looking at each individual layer from the side‑ view. There's a bunch of
-- I don't know what it is. I can't do the math in my head. There's thin layers and two
thick layers in the middle and a bunch of other ones. If you do a cross‑ section not uncommon,
sometimes you can do it from the edge of the board so you can see and try to get an idea of
interlayer spacing. The inter layers are thicker that means power or ground planes or
something carrying high current there. The picture on the left is an awesome, awesome thing if
you can ever get it. It's the Dutch Indonesian specNell, which is an awesome layer cake and not
a PC board and taste much better than PC boards. I can guarantee this. I ordered this at a
restaurant in the Netherlands. And I didn't know what it was. They brought it, and I was like
oh, my God, this is awesome. I'm putting it in my presentation. Now you know what circuit boards
look like. There's a bunch of other layers on a board. You have your copper and substrate
layers, but you have other stuff. There's a silk‑ screen layer usually for markings on
the board, and sometimes other colors. That's made of a printable ink or epoxy. Usually
part designators are on there, sometimes you see manufacturing logos and sometimes markings by
engineers for testers, things to take advantage of it. That's at the super top layer. The next
layer down, the solder mask , coating that makes the coatings green or white or blue or
whatever, basically the protective layer that protects any area of the copper that is
not intended to be exposed. If you look at your Defcon badges, all those copper pads, those
copper circles are intentionally made to be exposed. You can solder to them and tap onto them
and do things. If you look carefully you can see a bunch of trailers underneath the actual
solder mask, and those are not intended to hack on. That doesn't mean you're not allowed
to go there and do it. It means the engineer doesn't want you to access those and protects the
board from dust and erosion and a bunch of other stuff. We need to deal with that solder mask
later. The circuit board fab is almost approaching like high feature size chips, like you're
getting so ‑ ‑ these tiny, fine features so the state‑ of‑ the‑ art costs less than 1 mill,
1/1000 - thousandth of an inch. Which is amazing density. Half a mill, less of half a mill
diameter laser drill holes. Circuit boards are highly complex. They're amazing. Avia
inpad connects different layers today. Normally in a traditional PC board fab you have it going
through the board say it connects layers 2 and 6 of the board. It's still going to go
all the way through, because it's an easier fabrication process. When we have avia pad
or buried via, you can't find the via sometimes. It's insane. Via and pad is like you have a
highly integrated device where there's a matrix of solder balls underneath the part. If that pad
needs to connect to an inner layer, it doesn't have to go OP top layer somewhere else. It can
have a via straight in the pad and going straight down into an inter layer, and you would never
see it unless you did some of the techniques that we're going to do. Very, very advanced
capabilities, but normally we look at traditional capabilities tracer space, 8 mill mechanical
holes and buried vias and they only connect the layers that need connected. You can't access
it from the outside. Just amazing what PC board fab can do right now. This picture is an
iPhone 4, a cross‑ section of that. Ten‑ layer board and super thin. What is it? .75
millimeters or something. Let me convert that. 29.5 mills. 29.5, so 30/1,000 of an inch thick.
Ten layers. I didn't actually convert that in my head, and I have notes. Some can do math
really fast, but I can't. Thank you for joining us. You too, fellas. Please sit down so I can
continue so you don't interrupt me anymore. I know them. It's okay. Yeah, so this type of
board is super complex, and I use this iPhone board in a lot of experiments. I wanted to use
kind of traditional standard board. I did some two‑ layer boards and cut some six‑ layer
boards and had complete control over the design on each layer. I knew the layer spacing, knew
everything about it so I could kind of validate the success of the various techniques. Then the
iPhone board is a real world situation of an actual consumer product using current state‑ of‑
the‑ art technologies. So I grabbed a bunch of these things on eBay that were actually Apple
iPhone knock‑off boards. They looked grate and there were noticeable defects and cracks in
them. I couldn't imagine someone buying an iPhone board on bay ‑ ‑ bay and building it. It was
fun to use this for a hobbyist board to prove the technique works for the real deal. So I
mentioned we wanted to try to get access to the inner layers or all the layers of the circuit
board. If you do that, if you can only access, say, the top and bottom layers, that's still
better than nothing. If you get all layers of the board, whether it's a four‑ layer board or
whatever, you can start really putting together the entire design. So this thing here, I
show this again at the end of the presentation with one of our techniques. This is four layers
of a speech assist board I designed that is a great reference, because I know
exactly what it's supposed to look like. If you also know the components, almost all of this
stuff except maybe some of the nondestructive methods assume there's no components on the
board. If you go through the process, you make a note of the components and take them off the
board to actually start destructively getting down to the different layers. If you
don't know, then you can re‑ create a whole schematic. It's like an electronic road map, and
then you totally win. All right. So the first set of things we look at is solder mass removal.
This is getting access to the top and bottom layers, because those are the only two protected
by the solder mask. Lots of different layers. You'll see the mechanical layer that the manual
abrasion and mechanical. We go through these and see. It's surprising a lot of stuff you
see the lowest tech ends up being actually most useful, which is great for us, because
it's also the cheapest. So what I'll do is run through a bunch of these techniques. On the fast
track work, a bunch of stuff didn't work. I don't have the times to go through all the
stuff that didn't, so I have one slide for each section that didn't. You don't have to fail
the way I did. I tried lots of stuff. They're will on my website as of today, so if you
go to grandideasstudios.com. I have an academic paper published next week or something, so that
will be what I'm saying here except written down in like really nice sentences. That took
a really like time to write. Sandpaper, everyone has sandpaper. It seems like an
obvious sort of solution, and it is. It works great. So this is something, URN, for this
particular section, and just sanded it. It worked great. The one thing to worry about,
though, is you have to make sure the sandpaper is plain art to the surface. You want to make
sure you evenly sand, because if you don't you get wear and sand down into the substrate and into
the copper and the substrate. I'll show you that when we do the delayering stuff. It's using
sandpaper. You can put boards of the same height of the board you're sanding to keep things
really level. The effective lowest cost way to do it. There's just some results of
that. Different grits. Depending on the finish, some circuit boards have gold surface finish
on the pad. Some have a solder over bare copper where it's like solder kind of leveled or blown
over the pads. So depending on the surface finish required for the board, you might need a
different grit sandpaper. So the thicker the surface finish, you may need a stronger sandpaper
first, and you move up to higher grit to remove the solder mask. You see on the iPhone board, 400
grit sandpaper, you can wear off that solder mask, but you don't wear down the copper at all.
Using a fiberglass scratch brush, which I hadn't known anything about before but I
guess they use them for scraping off rust on metal that you're working with or cleaning off
different types of parts, they're great for removing solder mass. It's better for
selective areas. So say you want to access a single trace on the board, that's what the
fiberglass brush is great for it. You can do a whole board, but it will take a little while.
Make sure you wear gloves because it will flake off and you have tons of splinters all
over your hands and finger and everything. I posted a picture of some of those at some point.
One person realized fiberglass shards are really bad. I'm like, I know. Thanks for that tip. So
that's a scratch brush. Sandblasting, you don't normally associate sandblasting with
circuit boards. I don't. You sort of associate it with like building motorcycles or
something like that. Using it with big pieces of metal. But it actually works pretty well to
scrape off solder mass coatings. So I went to a place called TechShop, which is a fitness
center for nerds or something. You try to use the machines, but there's a really, really cool
idea. There's places all over the country. Different organizations do the same thing.
I went over there and say, hey, I'm working on a project. Can I use your machine. I'm not a
member. I don't want to sign up for a month to use your machine for an hour. Can I come in and
stood around for a long time, and they're like, okay, come in. I gave the guy 20 bucks so he
can go on his lunch break to do this stuff for me. It's amazing what you get when you ask nicely
and hold money up. So this one, we had to be really careful because sandblasting is normally
a very PSI, high rate of speed type of application, so the operator tried to kind of scale
it back a little bit and be a little gentle on the board. We had some pretty massive
failures, but once you got the technique right, you use the standard type of sandblasting
machine. We were at a 60 grit aluminous oxide 80 PSI, and that's the standard. He had the
best success 6 to 8 inches away shooting at an angle. This works really well with standard types
of boards. We put an iPhone in it, and it got destroyed to shreds. It was way too fragile.
The standard types of boards, even two‑layer boards with a thick substrate seem to work
best. We got noticeable pitting in the copper, so technically, so there's no damage in the
copper. For our purposes it stent matter as long as we get a good image of the layer, we can
do post‑ processing and clean it up. They do also make things that are called micro abrasive
blasting capsules, which are much smaller for fine detail on jewelry and things, and that
probably would have been a better solution. I didn't know where to get one of those. This
is fun. This is my favorite part. Making a mess. Oh, wait. Wrong conference. I mean,
removing solder mask. So these chemicals, there's lots of different chemicals out there,
and if you search the Internet, you have to use the sodium ethanol meth late to dip it in
the thing and hold it under the heat lamp and the bunson burner. They say all this stuff, but I
don't think people actually ever test the stuff except people that plow their fingers off. I
was a little wary of stuff I read on the Internet, and I think I'm using chemicals
designed for this type of thing. Luckily, there were chemicals that exist. There's two
chemicals I looked at that were actually used by circuit board fabricators if they mess up the
application of solder mass, there's a chemical to strip the solder mass off and they can
redo the process. It sort of makes sense. I don't think I have to say how dangerous this
stuff is, but it was really dangerous. I don't have a fume hood or anything, like proper
OSHA compliance or anything. This was in my backyard. I went to Home Depot, and then I went
on a shopping spree, to the Home Depot for supplies an electronic surplus stores for plies. I got
a shopping free to buy all the stuff. I have a chemical mat, a mask, respirators, hot plates.
It's not a stir plate. Kind of a magnet to stick it around or something. This was a hot plate
I got on eBay, and then the chemicals and rocks to hold the thing down. This was in my
backyard, and this particular house that I lived in was diagonal to a hotel. With all of
the doors of the rooms facing down into my backyard, which I'm sure they loved it when I was in
the hot tub, but this I think freaked them out a little bit because people are like, I'm
having a nice vacation in San Francisco. They look out and say, what is this guy doing
dressed in a crazy suit? Oh, yeah, which is ‑ ‑ yeah. There are actually was a black car
outside of my house for two days when I was doing this work. I shit you not. Who cares. If
Spartanburg sees all the stuff, I'm doing work for the government. I have a piece of
paper that says it. They approved it. I'm allowed to do it. Nothing happened with it. So
I wore the suit, and it was funny because with these chemicals you have to heat them
up to a certain temperature because that helps with chemical reactions and all this crazy
mask stuff. So I had this full chemical suit on. Who took the picture? It wasn't me. Yeah. So
my wife took the picture. Yeah. You remember her when she was pregnant and called my phone in
front of 8,000 people or something in DEF CON a few years ago. Yeah, she took the picture,
and half the stuff was like heating up on the hot plate. She got really pissed because
apparently it smells bad, but I didn't know that because I'm wearing a respirator. She took
the picture and said why are you wearing the stuff and I'm not wearing it? She got super ‑ ‑ I
would swear if ‑ ‑ I'm not going to swear, because I'm a nice person. But she was really
angry and kind of going off like a trucker. So she ran out and shut the door and stuff so the
smell wouldn't come in the house. The fumes actually went into the house. Next time if I
do this I'll do it further away from the house or just buy her a respirator. So yeah, this is ‑
‑ that was fun. I was really freaked out. I don't normally deal with chemicals that much
when I etched circuit boards. Someone else etched the circuit boards, but did you dump the
chemicals down the drain? ( Inaudible response ) >> Yeah, chemicals, I don't know. They're
very effective, as you see, but also just really freaky. So it turns out both of these
chemicals I used. One is a U.S. company, and neither of them attack the actual substrate,
which is good for solder mask removal but not if you trying to delaminate the board. When you
put the circuit board into the heated chemical, it just starts flaking off, which is really
neat. The time depends on the temperature and the thickness of the solder mask and things like
that, but the result is super awesome. Full copper exposed and no abrasion or anything like
that. Really, really well‑ done. Then lasers. Lasers. Who here has a laser? Yeah. A lot of
people, right? They're not uncommon anymore like a laser cut other something in the
hacker space. The one I use is a gigantic one, but it's no different than - I don't think
it's much different than the ones you have in hacker spaces where you're doing laser
engraving on your iPhones or something. So this one I went to a company in Milpitas. I wanted
to use the laser and shoot it at circuit boards is see what happens. They said that's weird
but sure. I went by. Places are willing to do interesting things, because for them I was
talking to the operator, this is totally fun because we have no idea what's going to happen, and
it's way better than like ‑ ‑ way better than what we do day in and day out. For them it was
something fun. It happened almost every place I went. It was kind of fun for the
operators because they didn't know what to expect. In this case, who knows. I was worried
we would set the place on fire or something. ( Inaudible comment ) >> All these guys are
wearing. I guess this is like a ‑ ‑ this is like a Defcon tradition. Thank you, guys. I
love you so much for that. Thank you. I actually told them before the talk, nothing is going to
throw me off, not even a giant dong. You said you weren't coming on stage. You broke the
rule. Take your mustache down. Okay. Where were we? Come on. Take that out of here. Okay. So
the lasers are for cutting material like flex circuit boards, the cover layer is for
doing, say, like stencils or solder stencils for circuit board. We were just trying to
see, like, could we shine the laser, and would it get through solder mask. I went to use them
to see if we can get to inner layers, which I'll explain later on. That doesn't really work.
But in this case it did. Like we just had a single pass of the laser at medium power. I don't
know what that means, because he told me there was low, medium and high. Let's just start with
medium and see what happens. So we did one at medium power, and it worked. The more you do it at
medium power or if you had high power, the more energy you're shining at the board, eventually
you destroy the board. In our case if the single pass is fine, we remove the substrate and very
little damage to the copper or to the substrate underneath. The one on the left is from my test
board and one is from annual iPhone board. This is interesting, because this
connector that we've exposed is traditionally under solder mask. If I look at a board and see
something like that, a connector under solder mask, I would say, okay, that's probably like a
programming interface or some connector used during development or some test points
the engineer wanted during development. They cover over with solder mask after. We use
that as a clue for it. Let's get access to that. It took about 30 minutes to set up the machine. I
don't know. We were waiting 30 seconds or a minute to do the passes to expose the solder
mask. If you wanted to do a full board for that, it will take a while to do that. Manual methods
seem to work better than the high tech ones. I tried to use a knife to run the solder mask
away. There's mechanical abrasion type of things, and other chemicals not from the
Internet but things that I talked to people about. Different types of heat. Because
on the Internet someone is like, if you use a heat gun and heat the solder mask, it's going to
melt. The thing with solder mask is if it's properly designed, it's meant to withstand a lot of
heat. So it did its job. So these are sort of some of the failures. So the next set is
delayering. This is where things get more interesting, because we look at the inner layers itself.
So kind of a manual method and we have different mechanical stuff. This is where I started
to learn a lot about the process as you'll see. So, again, sandpaper is very effective,
low‑ cost method. I just took the board, double‑ side taped it to the work surface. As opposed
to the solder mask, which if you use sandpaper it comes off fast in a few minutes maybe. When you
delayer an entire layer of substrate that could possibly be 40, 50, 60 thousandths thick, it
will take a toll. I don't care how strong you are. It's going to hurt. Going to get sweaty. I
know a lot of people don't like. Instead of just using handheld sandpaper, you could use a
sanding tool. On the left I have a sands stone, which is a 60 or 80‑ grit stone with a better
grip on it. I have a Norton sheet Sander tool, which you attach it to this thing and go
back and forth. It takes a while. Here's a little video of it. Time lapse, of course. So
I'm taking the stone and trying to get the top copper layer off. We'll have the substrate, and
then I have to work on the next layer. So first the sanding stone, try to use that and sort
of works. We have the sheet Sander tool and little by little it comes off. With the solder
mask removal you have to be careful with the edges of the board. If you don't sand
straight back and forth you have the wear along the edges. I show the result. It looked like it
happened really fast. That was 20 minutes and I was drenched at the end. Here's the result. We
had a little bit of scratching of the inner layer and a little bit of wear around the edge, but
we have basically the second layer of that four‑ layer board. So pretty cool, I think. So I
had the second layer exposed and I was like all right we have the three layers. I'm not that good
with mechanical things like tools or anything like that that has moving parts, so I had a lot
of failures with the Dremel tools. I damaged a lot of stuff along the way. This flap wheel,
120‑ grit flat wheel worked well. You get through that substrate a lot faster than
manually using a sheet sanding tool. I don't have a video of it, because you know what it
looks like when it works. Here's the result. This is layer three. I heard someone laughing.
There's something wrong with this picture, isn't there? There's a whole corner much
circuit board missing. I mentioned that. I'm not very good with this. We works this,
but it works fine. It's really hard to control the Dremel tool. When I did that, I was like wait
a second. I do this mechanical abrasion, and you'll use this machine to automate the process.
That took me nine minutes, by the way, with the Dremel tool. I had a CMC Miling in my office
next door to make circuit boards because circuit boards are awesome and you need to make
them all the time, I think. This is a T-Tech quick circuit 5000 and it's basically just a really
accurate CMC. Did I use a special one designed for specifically cutting fiberglass
types of material. So there's a setup. I have my computer running the whole show and the
milling machine myself. Fist I started with the known reference board, the six‑ layer board
because I knew how much I could increment each layer before I would get access to the next
layer. I knew the thickness, so I used the machine to kind of route it manually control the
machine and adjusted the access for the depth to come down and kind of move the milling machine
back and forth. With this particular board you can't see the left image at all or the
right one, really. But the left one has a bunch of numbers for the different layers, so layers
1 through VI all numbered. I went and exposed the numbers so I could prove I can access
layers 1 through 6. That was no problem. That was sort of, you know, a board with very thick
inner layer spacings, so it's sort of like cheating. I did it with the iPhone, and I tint want
to manually control it, because I wanted a precise outline I was working in. So I created that
inside the tool and adjusted the z access in 1 mill increments. I run the rub‑ out of this
particular rectangle and adjust it and keep running it again and keep running it until you got ‑
‑ this is so funny. You're dirty. So I keep doing the operation until I could almost
see the copper, and then I would use a fiberglass scratch brush to do that really fine removal
of the substrate. There's a little video. Just doing a little bit. I don't know how
long this will last, but it's like taking off a super thin layer of that substrate. I did
that for a few hours until I got it right. It actually worked, so I could see inner layers of that
ten‑ layer iPhone board, which is seriously complex. If you do that across multiple sections,
you can reverse engineer the entire board. If you can do it on something this complicated
with that technique, you can pretty much do it on any board authorized. So last one of
delayering is surface grinding, this is another one where I do the Dremel tool and the surface
grinders grind down surfaces to create nice surfaces and to do all sorts of crazy metal work.
We have this rotating wheel on our rotary table, and the table moves around and the wheel stays
where it is. It's just a very, very cool thing, but gigantic. So on the left is a typical
surface grinding machine. I went to a place in Oakland, and this is like a straight‑ up metal
shop. I don't think they deal with computer people, tech people very often. I called them
and said I want to grind down some circuit boards. They're like, yeah, I don't know about
that. I was begging. I heard that surface grinding would be awesome, and the one guy I know
in San Francisco that had a surface grinder didn't want to do it. He's like, try these
guys. Try General Grinding. It was amazing. We did it like after hours in 8:00 p.m. in the
worth neighborhood in Oakland where they escorted me to my car after the work was done, which
was awesome. I can't defend myself. At least in that neighborhood. So what we did is
we had this metal block, and the surface grinders have a magnetic chuck. So you mount what you're
working with, and usually it's metal. So it goes not this magnetic chuck. You can work
with it. The circuit board is nonferrous, and we put it onto a block and it would hold it in
place. My machine had give or take maybe half a million, .1 mill. give or take, half a mill.
A machine like that size is way more accurate. Here's a process with a little dressing of the
wheel. It just comes down and just grinds the board. It does this whole process, and it takes
like a 45 second process or so, and it doesn't look like it's doing much, but it's shaving a
really thin layer of the board. You do it over and over again as we got down, and what you can do
is if you already know the interlayer board thickness and do a cross‑ section first and
look at the side with a magnifying glass, then you can set it in the machine and you
can automatically do it to that point where you need it. What we found is that the surface finish
created by doing this was so smooth you didn't have to get to the layer itself. You could ‑ ‑
as long as you see it through the substrate, it would polish is so mush you can see the layer
through it. This is pretty cool, and a bunch of failures and heat and laser doesn't work in this
case for delayering because laser energy affects materials differently. So if you're trying
to cut through a layer of substrate, that's going to work differently than a lay of
copper. If you don't know how the substrate and copper they're laid out on the board, you have
a big mess. So for imaging here we have x‑ray, 2D and 3D. Everybody here probably had an
x‑ray or knows somebody that does. What you probably don't know where to get access to an
x‑ ray on your own. They're used a lot for failure analysis of circuit boards and of components
on SISH circuit boards. GUK to a contract manufacturer and say, hey, can I use your x‑ ray
machine? They'll say sure. That's what I did. X‑ rays shining through it, and then the
object is absorbing radiation and you'll be able to to see the results. We only see a composite
image, not individual layers in this case. Here's what the machine looks like. Here's a
veriphone pin pad from a pin pad division with the active circuit board shield on top of the
circuitry. The 2D x‑ ray isn't that great because you don't know which layer things are on.
We can use it to get a general sense of what's going on. In this case this active shield had
like four layers of basically a maze of copper we had to figure out how to defeat that to get
access underneath. If you have a simple board, you can adjust the field of view and angle of the
x‑ ray to trace it out. It gets very hard. They're that four‑ layer board. So it's already for
certain things, but this is a real money shot right here, x‑ ray. This blew my mind. This is
the best part of the whole research. CAT scans where you go in that machine and it spins
around and you get slices of your body parts or whatever, you can do that with circuit boards,
too. Just like there's manufacturers that have the normal x‑ray machine, a lot have
the 3D x‑ ray machine. You basically take a number of 2D images at different angles
around the object and mathematically processing that down into slices. Here's a VGA
solder ball with a defect in it. Normally these companies look at small objects or small defects,
so I went in and actually called the company, which is recommended by
SonicManufacturing, the manufacturing that does it's a 2D x‑ ray, and I called the CEO
and it turns out he was in Germany for a conference. So it was like 5:00 p.m. my time and
3:00 a.m. his time or something like that. As soon as I heard the ring tone change from the
U.S. to the European, I was like, oh, crap. He answered phone at 3:00 in the morning. I
woke him up, which is not a good way to start a relationship. He was just more than willing to
help. He's like, sure, I get back tomorrow. Let's set a date and let's do it. I've never done
it, and let's try it. It was totally awesome and a big surprise for everybody there. So
we took 360 different images of that board, that four‑layer board, and then once we got
ought all of that data we loaded it into a manipulation program for 3D manipulation and moved
through each layer and we could manually creates a bunch of JPEGs so we could hit a key and
look through each layer. I don't remember the actual layer or slice thickness, but it was
totally amazing. The results vary based on how many layers you have, the inner layer of
thickness and what other materials are used because some high end boards use very complex
materials. Here's the result of this CAT scan on our board. So we're slowing going through each
layer. Layer one is about to come up. Let's see. There it is. There's layer 1, and then layer
2 comes up. There's layer 2. We go through the middle of the board, the middle substrate,
which is thicker than the others. Layer 3Coms up fast. There's 3, and there's 4. So now
nondestructively we can see through the entire circuit board without doing anything, which is
awesome. Here's another view of it. So you'll notice ‑ ‑ thanks. It wasn't my machine,
but thanks anyway. So you notice the field of view is small, so if you do it across a larger
board, you have to do it multiple times. It took half an hour to get this done so totally
awesome. We had failures doing acoustic microscopy that didn't work at all. In the paper
released next week and in the presentation, I broke this down into a characterization.
Depending on how much time and money you have, likelihood of success, how much you want to
risk your life, you can look at the techniques and figure out which is good for which of your
situations. I like the manual methods because it's a quick and dirty thing. The x‑ray was
totally awesome, too. Next steps. There are some other methods that people told me
about for delayering using the key tones to actually strip the inner layer adhesive, drum
Sander which is like a surface grinder. What I want to do and started to work on is a tool to
take all of the layer images I have gotten through the various techniques and start a process
to kind of automatically or assist in reverse engineering those back into something
meaningful. Take the layers and do image processing and figure out connections and possibly
turn that into schematics. Maybe by next year I have something to show on that. It's a great
opportunity for me because it's a lot of software and I'm not much of a software guy so I have
to learn Python and stuff. It's like D‑gate, which is a tool for pattern recognition of silicone,
and then Ron par, which is major malfunction tool does recognition as well. Those are
chip level. I want to do something board level and super cool. There's the link with all
the materials, but just go to my website and find it. There we go. The end. Thanks for coming.
( Applause )