Post B53BKH6Ynn2vDTFvk0 by infosecdj@infosec.exchange
(DIR) More posts by infosecdj@infosec.exchange
(DIR) Post #B4qwi4CQbafgvpMtJg by infosecdj@infosec.exchange
0 likes, 0 repeats
Hello and welcome to this #nakeddiefriday installment.Today's guest is an NXP chip for which I do not have the part number in memory. The chip was used as a training target for the sample preparation tutorial section by Chris Pawlowicz of TechInsights at HARRIS'26, in which I had the pleasure to participate. I have an intact sample which I plan to deprocess at home during the coming days and hopefully apply all I've learned there.Full-res map for you to explore: http://infosecdj.net:8086/map/nxp/mp091a0/infosecdj_mz_nikpa60x_s0/Image taken using Nikon PlanApo 60x/1.40, 3260 focus-stacked tiles of 21 individual shots.#electronics #reverseengineering #microscopy1/n
(DIR) Post #B4qwi4UVWN8JptpKUq by infosecdj@infosec.exchange
0 likes, 0 repeats
Die ID marking in the corner lets us know this is an MP091A0, designed in 2021. 5 metal layers, all revision 1 it seems.2/n
(DIR) Post #B4qwi4hcjbcoUZxnwO by infosecdj@infosec.exchange
0 likes, 0 repeats
While I don't know the specifics, the device certainly has 6 functional units of the same type distributed along the 3 out of 4 edges. The top right corner houses 3 instances of a different unit, along with at least two more of a yet different one. And if memory serves, the centre was occupied by a blob of digital logic.3/n
(DIR) Post #B4qwi4w9rZFdDelPay by infosecdj@infosec.exchange
0 likes, 0 repeats
The green colours seem to be of poly resistors. The setup struggles to resolve them through all the layers.4/n
(DIR) Post #B4qwi579Ci2dljuBiy by infosecdj@infosec.exchange
0 likes, 0 repeats
Capacitors seem to be purple.Also in the frame is one chonky resistor...5/n
(DIR) Post #B4qwi5EwjiHQ9vYPse by infosecdj@infosec.exchange
0 likes, 0 repeats
Next up is removing the top metal layer, which if memory serves is a thick 3um one. Thread will update when that's done.Until then, I wish you all a great Friday and the weekend too!6/n
(DIR) Post #B4qwi5OWA7w6dc23nc by infosecdj@infosec.exchange
0 likes, 0 repeats
Here we go. Metal5 was removed except for the central area; it was rather stubborn and didn't want to go. I will work on it a bit more and take another shot, need to be careful as metal4 started going on the edges already.Full-res map: http://infosecdj.net:8086/map/nxp/mp091a0/infosecdj_mz_nikpa60x_s1/7/n
(DIR) Post #B4qwi5YnXu9x9UqGp6 by infosecdj@infosec.exchange
0 likes, 0 repeats
The interconnect between metal5 an metal4 is mostly done with via banks, except for pad structures.8/n
(DIR) Post #B4qwi5lul8eRoAykGe by infosecdj@infosec.exchange
0 likes, 0 repeats
One digit is gone from the maskset revisions. :-)9/n
(DIR) Post #B4qwi5tiI8tECMcyQK by infosecdj@infosec.exchange
0 likes, 0 repeats
After a bit more work. This is imaged using a dry objective.Planarity is shit but no visible scratches, which is amazing.Materials used: Allied 0.3u alumina suspension, Ted Pella Met-X cloth10/n
(DIR) Post #B4qwi66TWh68pwbAJc by infosecdj@infosec.exchange
0 likes, 0 repeats
The same in oil immersion. All the interference colours gone, and there's slightly more contrast.Full-res map: http://infosecdj.net:8086/map/nxp/mp091a0/infosecdj_mz_nikpa60x_s2/11/n
(DIR) Post #B4qwi6GkuTJzLpPNL6 by infosecdj@infosec.exchange
0 likes, 0 repeats
The rest of metal-5 is gone from the centre, and a lot of metal-4 is now missing on the sides.Full-res map: http://infosecdj.net:8086/map/nxp/mp091a0/infosecdj_mz_nikpa60x_s3/12/n
(DIR) Post #B4qwi6RkFc6ztuY9T6 by infosecdj@infosec.exchange
0 likes, 0 repeats
Die ID is now gone too. Always amusing how things just vanish without a trace.13/n
(DIR) Post #B4qwi6axhLU6MUrVpo by infosecdj@infosec.exchange
0 likes, 0 repeats
I am most intrigued by this set of cells not connected to anything else. Same cells found in groups elsewhere. Does anyone have an idea why is this here?14/n
(DIR) Post #B4qwi6lF57hwsNfirI by azonenberg@ioc.exchange
0 likes, 0 repeats
@infosecdj Looks like some kind of multi finger ESD or IO drive transistor especially given the location near a bond pad, sure there's no vias up to the pad?
(DIR) Post #B4qxUrxUuAiz9neh9s by infosecdj@infosec.exchange
0 likes, 0 repeats
@azonenberg Hmm, a good guess. Though here is the same elsewhere on the die, the only connection I can see, or rather guess, is to metal-1 on the very outside of the die. I suppose we will see what happens when I get closer to m1.
(DIR) Post #B4qy8y1hlREBYkk9rM by azonenberg@ioc.exchange
0 likes, 0 repeats
@infosecdj The outer seal ring is probably ground.The fingered structure on the very edge of the die hooking to it looks more like an ESD diode than the mystery structure you showed above.
(DIR) Post #B53BKH6Ynn2vDTFvk0 by infosecdj@infosec.exchange
0 likes, 0 repeats
@azonenberg The same ROI on metal1. Just as mysterious.