MINDSHARE: DECAPPING CHIPS FOR ELECTROMAGNETIC FAULT INJECTION (EMFI)

IoT 6个月前 admin
73 0 0


· 以热空气站形式的热源

·      A crocodile clip “helping hands”
· 一只鳄鱼夹“救命”

·      A squirt bottle with acetone
· 一个装有丙酮的喷射瓶

·      A PE pipette · PE移液管
·      A waste container.
· 一个废物容器。

To begin, the device under attack is fixed in the clip, and a small drop of acid was applied with the pipette in the package center.
开始时,将受攻击的器械固定在夹子中,并在包装中心用移液管滴入一小滴酸。

MINDSHARE: DECAPPING CHIPS FOR ELECTROMAGNETIC FAULT INJECTION (EMFI)

Figure 3 – Applying sulfuric acid
图3 -应用硫酸

The device was then heated using the hot air station set to 200°C  and a moderate air flow of around 40%. The aim of this process is to slowly dissolve the packaging epoxy. The device was heated until some fuming was observed from the drop and stopped before any bubbling would occur. If the acid gets hot enough to produce bubbles, the material will form a hard carbonized “cake” which will be problematic to remove. Unfortunately, this has been a problem before.
然后使用设定为200°C的热空气站和约40%的中等气流加热装置。该过程的目的是缓慢溶解封装环氧树脂。加热装置直到从液滴中观察到一些发烟,并在发生任何起泡之前停止。如果酸变得足够热而产生气泡,则材料将形成硬的“饼”,这将是难以去除的。不幸的是,这以前是个问题。

After the acid visibly darkened, which should take around 1 minute +- 50%, the heating was stopped, and the device was allowed to cool down somewhat. Then, the acid was washed off with acetone into the waste container. The device then was dried off with hot air to remove moisture.
在酸明显变暗后,这应该需要大约1分钟± 50%,停止加热,并使装置稍微冷却。然后,用丙酮将酸洗掉,放入废物容器中。然后用热空气干燥器械以去除水分。

The process was then repeated multiple times, with each iteration removing a bit of the packaging material. This was captured in the following series of images (more steps were taken than is presented here):
然后,该过程重复多次,每次迭代都会去除一点包装材料。这是在以下一系列图像中捕获的(采取的步骤比这里介绍的更多):

MINDSHARE: DECAPPING CHIPS FOR ELECTROMAGNETIC FAULT INJECTION (EMFI)

Figure 4 – Time lapse of decapping process
图4 -开盖过程的时间间隔

A stack of dice slowly emerged from the package: the larger one is the microcontroller itself, and the smaller one is the serial Flash memory holding all the programmed code and data. Unfortunately, the current process does not preserve the bond wires, rendering the device inoperable. Its operation was not required in our case. This could possibly be mitigated by using a 98% acid and anhydrous acetone – something to attempt in the future.
一堆骰子慢慢地从封装中出现:较大的是微控制器本身,较小的是保存所有编程代码和数据的串行闪存。不幸的是,目前的工艺不能保留接合线,导致器件无法操作。在我们的情况下不需要它的操作。这可能会通过使用98%的酸和无水丙酮来减轻—这是未来的尝试。

Measurements 测量

The end result of the decapping process is pictured below.
开盖过程的最终结果如下图所示。

MINDSHARE: DECAPPING CHIPS FOR ELECTROMAGNETIC FAULT INJECTION (EMFI)

Figure 5 – End result of decapping
图5—开盖的最终结果

Using a graphics editor, it is possible to take measurements in pixels of the package, the die, and the die positioning. This came out to be the following:
使用图形编辑器,可以测量封装、芯片和芯片定位的像素。结果如下:

·      Package size 1835×1835 pixels (measured) = 20×20 mm (known from the datasheet)
· 封装尺寸1835×1835像素(实测)= 20×20 mm(从图中可知)

·      Pixels per mm: 91.75
· 像素每毫米:91.75

·      Die size 366×366 pixels (measured) = 4x4mm (computed)
· 芯片尺寸366×366像素(测量)= 4x4mm(计算)

·      Die offset from bottom left: 745×745 pixels (measured) = 8.12×8.12mm (computed)
· 芯片从左下偏移:745×745像素(测量)= 8.12×8.12mm(计算)

The obtained numbers are immediately useful to program the EM probe motion restricted to the die area only. To find out how much experiment time this could save, let’s compute the areas: 4×4 = 16 mm2 for the die itself, and 20×20 = 400 mm2 for the whole package. This is 25 times decrease in the area and thus the experiment time.
所获得的数字是立即有用的编程EM探头运动仅限于芯片区域。为了找出这可以保存多少实验时间,让我们计算面积:4 × 4 = 16 mm2的芯片本身,20 × 20 = 400 mm2的整个封装。这是在面积上减少25倍,从而减少实验时间。

Another approach that could avoid the decapping process is moving the probe in a spiral fashion, starting from the package center and moving outwards. This is of course possible to implement. However, the challenge here is the possibility of the two dice getting packaged side-to-side instead of being stacked like in this example – this would severely decrease the gain from this approach. Given the decapping only takes no more than 1-2 hours including cleanup, this was deemed well worth the information gained – and the die pictures obtained.
另一种可以避免开盖过程的方法是以螺旋方式移动探头,从封装中心开始向外移动。这当然是可以实现的。然而,这里的挑战是两个裸片被并排封装而不是像本示例中那样堆叠的可能性-这将严重降低这种方法的增益。考虑到开盖只需要不超过1-2个小时,包括清理,这被认为是非常值得获得的信息-和模具图片获得。

Conclusion 结论

I hope you enjoyed this brief tutorial. Again, please take caution when using sulfuric acid or any other corrosive agents. Please dispose of waste materials responsibly. The world of hardware hacking offers many opportunities for discovery. We’ll continue to post guides and methodologies in future posts. Until then, you can follow the team on Twitter, Mastodon, LinkedIn, or Instagram for the latest in exploit techniques and security patches.
我希望你喜欢这个简短的教程。同样,使用硫酸或任何其他腐蚀剂时请小心。请以负责任的方式处理废弃物。硬件黑客的世界提供了许多发现的机会。我们将在以后的文章中继续发布指南和方法。在此之前,您可以在Twitter,Mastodon,LinkedIn或Instagram上关注该团队,以获取最新的漏洞利用技术和安全补丁。

原文始发于Dmitry Janushkevich:MINDSHARE: DECAPPING CHIPS FOR ELECTROMAGNETIC FAULT INJECTION (EMFI)

版权声明:admin 发表于 2024年5月24日 下午9:58。
转载请注明:MINDSHARE: DECAPPING CHIPS FOR ELECTROMAGNETIC FAULT INJECTION (EMFI) | CTF导航

相关文章