Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Depackaging the Nintendo 3DS CPU

gaasedelen.blogspot.co.uk

Post reply on HN
Print view View original

41–48 of 48 posts

Re: Depackaging the Nintendo 3DS CPU

#41

Post by Ideka »

NDizzle wrote: post #36
nfoz wrote: post #14

That page has web buttons that overlap my scrollbar .... how is that even a thing? please make it stop.

Not to mention that if you click on any of the images to view the larger version of the images, hitting the back button resets you to the top of the page and you have to re-navigate to where you were. And this is in the latest version of Chrome on a Mac. What's old is new again.

I always open these up in a new tab (usually can be done fast with third click, or ctrl+click), then close the tab when I'm done. It's fast, you can keep reading the original site while the image/webpage/whatever loads, and the problem you mention never happens.

Re: Depackaging the Nintendo 3DS CPU

#42

Post by TheZenPsycho »

TazeTSchnitzel wrote: post #33
dubfan wrote: post #28

Earlier quoted context omitted.

In an ideal world, nobody would steal chip designs and boot ROMs to create counterfeit products.

In an ideal world, DS piracy wouldn't have been as rampant and Nintendo wouldn't have needed to add DRM.

No one ever "needs" to add DRM. That is just an arbitrary business strategy among many possible strategies which may or may not actually work.

Re: Depackaging the Nintendo 3DS CPU

#43

Post by amckenna »

lawl wrote: post #22

If you're interested in that kind of stuff I highly reccomend watching Karsten Nohl's "Reviving smart card analysis" talk from Chaos Communication Camp 2011 [0]. Basically he takes pictures of the circuits on the smart card and then reverses the logic from that . There's even software to assist with that [1]. As a pure software guy I was pretty baffeled when I saw this the first time. [0] https://www.youtube.com/watc…

There was also a great talk at Defcon 21 (last year) walking through a similar process all the way to using a picture of the ROM and image recognition to pull binary data. The first half is about building the lab to do this kind of work so you can skip the first 1/3 - 1/2 if you don't care about that part.

https://www.youtube.com/watch?v=0Z4aF-qiziM

Re: Depackaging the Nintendo 3DS CPU

#44

Post by azonenberg »

samatman wrote: post #39
rockdiesel wrote: post #29

As someone who knows nothing about this stuff, can someone explain to me how soaking the CPU in sulfuric acid removes the packaging material, but does no harm to the chip inside?

Sulphuric acid is powerful enough to react with polymers, but not to dissolve silicon. "does no harm" might be an exaggeration here. It's doubtful you'd have a functional chip. But the fine structure remains, clearly. Toss some nitric acid in there, forming aqua regia, and you'll dissolve the whole chip including any gold.

> It's doubtful you'd have a functional chip

I have a couple of fully functional examples on my desk that say otherwise. If you actually want to keep the device usable to the point that you can still solder it to a board, then you normally preserve most of the package, bond wires, and leadframe which requires more care during decap. For this particular specimen we didn't bother because we just wanted the ROM.

Here's an example of a fully functional decapped device soldered back to a board: http://i.imgur.com/UebB3FO.jpg

My lecture notes at http://security.cs.rpi.edu/courses/hwre-spring2014/Lecture3_... go into more detail on various methods, chemical and otherwise, for decapping with and without preserving the leadframe.

Re: Depackaging the Nintendo 3DS CPU

#45

Post by azonenberg »

coldpie wrote: post #32
Two9A wrote: post #27

I seem to recall that imaging the bootloader ROM straight off the silicon was how the original Gameboy's bootloader was finally pulled out. I just forget who did it, which is unfortunate.

I spent a fair bit of time trying to find an article or something about this, but came up empty. I was especially curious to know how you can decode the program's bits from the silicon. I found a similar idea here: http://members.iinet.net.au/~lantra9jp1/gurudumps1/decap/ind... The photo in the upper-right looks like it could reasonably be turned into binary, if you knew what you were looking at. Anyone have any more…

See my lecture notes: http://security.cs.rpi.edu/courses/hwre-spring2014/Lecture9_...

Re: Depackaging the Nintendo 3DS CPU

#46

Post by jmpe »

jmpe wrote: post #40
coldpie wrote: post #32

Earlier quoted context omitted.

I spent a fair bit of time trying to find an article or something about this, but came up empty. I was especially curious to know how you can decode the program's bits from the silicon. I found a similar idea here: http://members.iinet.net.au/~lantra9jp1/gurudumps1/decap/ind... The photo in the upper-right looks like it could reasonably be turned into binary, if you knew what you were looking at. Anyone have any more…

Currently on mobile, will update tomorrow. Start here: http://www.visual6502.org/ Somewhere in that site they detail the step by step process of decapping, delayering photographing and identifying the logic. There's also a JavaScript simulator, check it out. The CCC also had a few lectures about decapping. The most interesting one is about backside scanning the die to bypass the safety features.

The CCC backside attack is here:

https://www.youtube.com/watch?v=dtviiOJ-2hI

It contains lots of info and technical details.

Another one:

https://www.youtube.com/watch?v=KVmpBPbGPsQ

This is what an actual ROM looks like:

https://docs.google.com/document/d/18IGx18NQY_Q1PJVZ-bHywao9...

As the last image shows, the ROM table values are extracted by graphics processing the photo.

It's also possible to dump the ROM by reading it byte by byte, but this depends on the architecture (not always possible) and is typically done for mask ROMs that contain data.

Re: Depackaging the Nintendo 3DS CPU

#47

Post by coldpie »

jmpe wrote: post #46
jmpe wrote: post #40

Earlier quoted context omitted.

Currently on mobile, will update tomorrow. Start here: http://www.visual6502.org/ Somewhere in that site they detail the step by step process of decapping, delayering photographing and identifying the logic. There's also a JavaScript simulator, check it out. The CCC also had a few lectures about decapping. The most interesting one is about backside scanning the die to bypass the safety features.

The CCC backside attack is here: https://www.youtube.com/watch?v=dtviiOJ-2hI It contains lots of info and technical details. Another one: https://www.youtube.com/watch?v=KVmpBPbGPsQ This is what an actual ROM looks like: https://docs.google.com/document/d/18IGx18NQY_Q1PJVZ-bHywao9... As the last image shows, the ROM table values are extracted by graphics processing the photo. It's also possible to dump the ROM by rea…

Thanks a lot!

Re: Depackaging the Nintendo 3DS CPU

#48

Post by rockdiesel »

samatman wrote: post #39
rockdiesel wrote: post #29

As someone who knows nothing about this stuff, can someone explain to me how soaking the CPU in sulfuric acid removes the packaging material, but does no harm to the chip inside?

Sulphuric acid is powerful enough to react with polymers, but not to dissolve silicon. "does no harm" might be an exaggeration here. It's doubtful you'd have a functional chip. But the fine structure remains, clearly. Toss some nitric acid in there, forming aqua regia, and you'll dissolve the whole chip including any gold.

Interesting stuff. Thank you for taking the time to explain.
Post reply on HN