Using a Desktop Laser Engraver to Probe into Chip Silicon

Laser fault injection is a common method of attacking devices, but sometimes we want to first understand what a device looks like or what certain blocks on the surface of the device die are. This article shows how you can use a low-cost laser engraver to map out these blocks, even without more advanced fault injection equipment.

- By Colin O'Flynn

This article will look at low-cost ways you can see into a chip and explore its functionality. Normally when we talk about topics such as imaging the surface of a chip, we probably imagine more complex processes such as dissolving the silicon encapsulation in acid and using expensive microscopes. Luckily, however, there is a quick hack: using a common type of package called Wafer Level Chip Scale Package (WLCSP).

FIGURE 1 WLCSP device on a PCB

WAFER-LEVEL PACKAGING

WLCSP are a type of package which means there is very little “extra” silicon besides the IC die itself. A photo of the underside of such an IC (a STM32 chip) is shown in Figure 1. It’s important to remember that many ICs come in various packages, and typically the actual die is the same. We still find information about the WLCSP useful for other packages, as it can help us if we are trying attacks that require understanding the position of certain parts of the chip.

I first discussed this when performing security analysis in my article “IC Packaging and Security: Do They Affect One Another?” (Circuit Cellar 362, September, 2020) [1]. In that article, I mentioned we could use that to probe the backside of the ICs dies. This time, I’m going to do everything without touching the backside. And in fact, we're not even going to be attempting to perform an attack, we’re just going to be looking at how we can measure important information such as understanding the layout of a target IC.