Posts by infosecdj@infosec.exchange
(DIR) Post #B2Jqmg2f75jeWTCkM4 by infosecdj@infosec.exchange
2026-01-15T19:44:11Z
1 likes, 0 repeats
And of course I overwrote the previous post with my edits. Oh well. Yet again, here is TMP80C49 by Toshiba. It is one of the 8048 family of MCUs by intel.Note the microcode ROM on the left side and the absence of any semblance of a datapath block by it. RAM and ROM blocks on the right side.Many thanks to @RueNahcMohr for providing this sample!
(DIR) Post #B2Jqmh0ZWLepWHEajg by infosecdj@infosec.exchange
2026-01-15T19:47:17Z
1 likes, 1 repeats
And finally, this. I have no idea what this is, except that it is Soviet and made using a metal-gate CMOS process. :-) There is two of *something* on the die, and it might be a dual JK flip-flop chip. Unfortunately, that's about as much as I know about it.
(DIR) Post #B32hfM6a7fF0F3lTkG by infosecdj@infosec.exchange
2026-02-06T08:20:39Z
1 likes, 0 repeats
Hello! It has been a little while, but #nakeddiefriday is back in town.Today's exhibit is an old PIC1650A. Yes, one of *the* PIC series of microcontrollers. Note it was designed by General Instrument in 1980. It was fabbed in a single metal layer, metal-gate NMOS process. The image is about 4.3x3.8 mm.No full-res link as SP is still borked.#electronics #reverseengineering #icre
(DIR) Post #B32hfSQIdGZvpx2JJQ by infosecdj@infosec.exchange
2026-02-06T08:29:50Z
0 likes, 0 repeats
We are kindly provided with a slightly yellowed block diagram of this device.One can easily identify where the program ROM is on the die; it takes a lot of space in the top left of the image. The register file is in the center left. I suppose the instruction register is the structure right below the ROM. The PC register and its incrementer is above the register file. And somewhere in there must be the ALU and decoder+control logic.
(DIR) Post #B32hfYFAzXFJtBsVo8 by infosecdj@infosec.exchange
2026-02-06T08:37:38Z
0 likes, 0 repeats
This bit looks to be decoding at least some parts of the instruction and runs a lot of wiring to the next part. It's a PLA, of course.
(DIR) Post #B32hfeBqso9UKcMwSW by infosecdj@infosec.exchange
2026-02-06T08:39:02Z
0 likes, 0 repeats
And this looks like the 8-bit ALU, with a 8-bit bus running on the left from the register file to the global bus, on which this unit also sits. Not much circuitry in there, somehow.
(DIR) Post #B32hfjjMHevPVz5Gsa by infosecdj@infosec.exchange
2026-02-06T08:43:55Z
0 likes, 0 repeats
For each I/O port pin, we have 4 control signals and one data bus tap (running off to the right of the snippet here). Apparently, controls are read, write, and clear. I suppose the 4th one is global enable for the port, or similar.
(DIR) Post #B32hfph66ygK0i4YBk by infosecdj@infosec.exchange
2026-02-06T08:55:50Z
0 likes, 0 repeats
Let's have a closer look at the ROM circuitry.The bit line multiplexer is nothing more than a 8-way NOR gate; 8 active transistors and one load. Bitlines are vertical here and are formed via diffusion.
(DIR) Post #B32hfvepwIREVR3pUu by infosecdj@infosec.exchange
2026-02-06T09:00:47Z
0 likes, 0 repeats
But there are 8 bit lines coming in, and no selection in the mux itself. How do they choose which one is active?Turns out, they abuse the ROM structure itself and use the same transistor structures to choose the active bit line. Observe how the top 6 word lines form a binary pattern: 4, 2, 1 and their complements.
(DIR) Post #B32hg1Hf1NSrxIGPCq by infosecdj@infosec.exchange
2026-02-06T09:10:57Z
0 likes, 0 repeats
Another interesting structure is the data bus driver. There are two instances of this exact circuit on the die. Effectively this is 8x a NOR2 with a large pull-down transistor, and one inverter (at the right) driving the common enable signal.
(DIR) Post #B32hg7CuzvEiKK5heC by infosecdj@infosec.exchange
2026-02-06T09:19:03Z
0 likes, 0 repeats
Since we have open-drain bus drivers, the bus must be either pulled up or precharged. Chasing down that circuitry was fun! It's here. See? There are 8 L-shaped transistors, split into groups of 5 and 3. As these are actively driven, I believe the bus is precharged.
(DIR) Post #B32hgDBilHqMsLZpc8 by infosecdj@infosec.exchange
2026-02-06T09:22:34Z
0 likes, 0 repeats
Select all MOS transistors on this picture, click Skip if there are none... :D
(DIR) Post #B32hgJP3ec4q9RrZEe by infosecdj@infosec.exchange
2026-02-06T09:26:44Z
0 likes, 0 repeats
Well, that's about it for this Friday. Hope you enjoyed this little foray into the ancient tech. Thank you for sticking until the end!Just wanted to thank my whole one patron for supporting my work. 🖤 I do this in my free time, and would appreciate any and all support is appreciated to offset the costs of samples and supplies. If you feel you could spare some cash in this economy, I'd be most thankful. Link in the profile!Have an absolutely beautiful Friday and a fantastic end of the week!/🧵
(DIR) Post #B3QL3e9t19i21zxkau by infosecdj@infosec.exchange
2026-02-17T20:47:44Z
0 likes, 0 repeats
@tomjennings I dunno what everybody else does, I have a NAS box serving static content when I need to share something. I found this much more appealing than putting stuff on corpo services and being constantly pestered with "upgrade now for $$$" bullshit.
(DIR) Post #B59nSu2plL4GtPLnwe by infosecdj@infosec.exchange
2026-04-10T16:50:38Z
0 likes, 0 repeats
Well hello and welcome to #nakeddiefriday -- the second one in April.My pleasure to introduce you the guest of today: ATSAMA5D26C by Atmel. This is a SoC with one Cortex-A5 core and a boatload of peripherals.Full-res map: http://infosecdj.net:8086/map/atmel/atsama5d26c-cu/infosecdj_mz_nikpa40x/#electronics #reverseengineering #icre #microscopy
(DIR) Post #B59nSvC5UQ42SOgi0W by infosecdj@infosec.exchange
2026-04-10T16:52:37Z
0 likes, 0 repeats
I took the liberty of removing the top aluminium layer which got stripped almost completely.Note the colours; as it would seem, this is likely to be a copper process. The lower layers never shone the classic silver.Full-res map: http://infosecdj.net:8086/map/atmel/atsama5d26c-cu/infosecdj_my_nikpa40x_d1/
(DIR) Post #B59nSwKdG8UdzBh2xs by infosecdj@infosec.exchange
2026-04-10T16:56:55Z
0 likes, 1 repeats
One particularly noteworthy feature of this die is, they put mask ID markings in Morse code. These are located along the top edge of the image.
(DIR) Post #B59nT0wM7p2sHLNEJs by infosecdj@infosec.exchange
2026-04-10T16:58:48Z
0 likes, 0 repeats
I have a bit of history with the chips of this series. Previously I had a look from the power analysis angle: https://labs.withsecure.com/advisories/microchip-atsama5-soc-multiple-vulnerabilities-full-releaseThe point of the exercise thus is to locate the ROM on this die.
(DIR) Post #B5DeSTf9jBeK7DpzBA by infosecdj@infosec.exchange
2026-04-12T11:31:08Z
1 likes, 0 repeats
And off we go for another 3200 tile stacks :ablobcatrave: No rest for the machine!
(DIR) Post #B5DeSZJOizoHdThh68 by infosecdj@infosec.exchange
2026-04-12T11:31:57Z
0 likes, 0 repeats
Seriously, at this point I feel it may be worth looking into ways to speed up acquisition