Anyone w/a dead that can decap/peel chips w/ ROMs??
Message #1 Posted by Bill Wiese on 27 Aug 2003, 2:53 p.m.
Hi all...
[reference:
http://www.pmonta.com/calculators/hp-35/index.html ]
Anyone out there with a dead 15C and that has access to "chip peeling"/decap equipment? Maybe we can get a ROM dump. (15C ROMs are apparently not a separate standalone chip apparently. Dunno how to 'grab' the data electrically... but that may not matter this way.)
Decapping usu means use of a fuming nitric acid jet to debride the epoxy body/cap of a chip 'til the chip die & bond wires are exposed. (Then rinsed quickly so the acid doesn't hang around! :) BTW chips can work after this process!!
The chip MIGHT be directly (micro)photographable like Peter Monta did, unless the line widths are a great deal smaller. If that is the case, the glass passivation layer (outermost) may need to be removed too. [Late technology chips can be harder to photomicrograph given feature size vs. wavelength of light used are in similar ranges.]
Years ago I did this w/some automotive microcontrollers. A coupla chips still worked afterward for awhile - though the ones w/passivation layer ground down died shortly after.
If we can get nice photos of 15C ROM array areas we might be able to differentiate btwn '1' and '0' bits in ROM, letting us "dump" it.
Of course we'd have to figure out the array sense (that is, what is actually a '1' and '0' - or is it vice versa?) and array arrangement & interleaving (addr[n] is not necessarily next to or even near addr[n+1] or addr[n-1]).
But with a bit of help from other 'Nut calcs we prob can figure this out statistically (opcode/operand frequency analysis, positional information, etc.)
If someone can supply me with a GOOD noncompressed image(s) scan of photographs of these ROM dies I'm glad to try attempting this latter half of the work. I don't have access to the former services (decap/photograph...) anymore
Bill Wiese
San Jose, CA
| 
Go back to the main exhibit hall