Monday, 25 February 2013

DIY decapping machine: The Decapinator part 1

I have previously discussed the "plink plink fizz" method of decapping here, but what I really need to do is to selectively etch away a certain portion of a chip to allow me to probe it whilst it is in situ on the board. This is not possible with plink plink fizz method as it removes the package and leadframe completely. So what I ideally want to do is create a "pit" in the epoxy exposing the die and any other areas we would want to probe.

Above is a chip decapped bu Bunnie Huang. His interesting blog post here shows him defeating the protection fuses on the chip allowing it's program to be read out.

Professional decapping devices

Nisene Jet Etch the gold standard in decapping.

There is an amazingly cool device to do this which is commercially available, it's called a Nisene Jet Etch, and costs about $22,000. Now this is great if you are decapping on a daily basis, but it is just too expensive to justify us buying one. :(  Another way to do this is by hand. Carefully dripping acid drop by drop onto the chip, however the chip we are interested in, is small. A single drop of acid would easily overflow and destroy the legs. As I want to be able to put the decapped chip back into a circuit, this is a probelm. So, I'm going to attempt to create a device that will (hopefully) provide the ability to decap repeatedly, albeit without all the speed, ease of use and other amazing features of the JetEtch.

The reagent I want to use is nitric acid. This is due to it's speed at eating away epoxy. It does however also eat away at the leadframe with astonishing speed and vigour, so that must be protected. So... this led me into a short foray into things that are resistant to hot concentrated nitric acid. I came across various materials but I settled on PTFE (Teflon) and a rubber called Viton made by DuPont.

PTFE is relatively cheap, easily machineable and relatively cheap. Viton comes in several grades from relatively cheap to super expensive. It is also made in various formats such as sheets and o-rings.

So here is my initial design:

The Decapinator

Decapinator Plan A

Two PTFE rods drilled out to form two cups, one fits inside the other. The large one (main body) has two holes in the bottom. One for the acid spray and one for the acid waste. The smaller one (chip holder) has a three holes drilled in the bottom. One hole goes through the bottom of the cup, and the other two are drilled into the sides of the cup to allow me to install threaded rods. The acid sprays on a disk of Viton rubber with and aperture cut in the centre which acts as a mask for the chip, ensuring the acid only acts on that area. then there is a PTFE disk cut from the smaller rod which acts as a clamp to hold the chip firmly onto the hole. The chip holder is then inverted and inserted into the main body so that the acid sprays through the centre hole onto the chip.

I ordered my PTFE rods from Direct plastics and they arrived with an enclosed bag of haribo sweets (nice marketing guys!). I chose 50mm and 30mm diameters respectively. This was mainly based on the availability of tools to drill out the centre of the rods. I would normally use a high speed spade bit to cut larger diameter holes, but the long point on those bits would prevent me from getting the tight aperture that I wanted. I settled on a MAD (Multi Angle Drill) bit. These were available in multiple sizes and have only a small centering point that would allow me to get the shape that I wanted, and, align the centre holes nicely. MAD drill bit set:


As you can see from the above image they have very small centre points.

The next was the choice of glassware. Everything had to be borosilicate glass (Pyrex) to withstand the heat without shattering. I chose a wide necked 500ml Erlenmeyer flask because of its wide base which would give stability and good heat contact with the hotplate. As this is going to be top heavy I opted for a lab stand to securely hold the flask in place.

Nitic acid vapour is highly corrosive to items such as rubber, but I couldn't find suitable bungs to resist the acid, so I was leaning to machining down the 50mm rod on a lathe to give me a plug that I could insert into the mouth of the flask and seal with Viton o-rings. This would mean laying my hands on a lathe, and as this was a proof of concept I decided to forgo the new toy and use a rubber stopper instead. This would degrade, but they are cheap and I should get a few uses out of it.

One of my next problems is how to seal the glass tubes delivering and draining the acid into the PTFE. The drain was a problem because I would be taking it out from an angle. I came up with the idea of using a plug cutter. This is normally used to cut a small plug of wood to cover over a screw hole. Normally you would drill it into a piece of wood and then snap off the plug. I figured that if I used it in the PTFE I could then drill through the middle of the plug into the centre cavity, and then slip my drain tube over the plug. See below.

Detail of main body showing viton gasket around 
delivery capillary and plug cut drain port.

I will them drill two holes in the bottom for the delivery tube. One just deep enough to hold a Viton gasket, and the other all the way through to hold the capillary tube.

As for the glass tubes I'm planning to use a 0.8mm inside diameter capillary tube for the acid delivery which should give me a nice fine jet, and a 10mm outside diameter for the drain.

As I mentioned earlier Viton comes in a variety of grades. The only one that would appear to consistantly resist hot concentrated nitric acid is Viton ETP 600-S also known as Viton extreme.
As it turns out Viton Extreme is also rare as rocking horse s**t. One supplier I called said, and I quote: "No F*****g chance". Another said they could only order the minimum order from Dupont and that was 940mm square 1mm thick and cost 1700 quid, plus VAT, plus delivery. I managed to track down a supplier that would supply me with a 200mm square 2mm thick for about 200 pounds. Not cheap, but as I only needed to use a small piece at a time and I could re-use it on another chip if I needed the same size aperture.

So at this point various packages are converging on Aperture Labs from various parts of the UK. Once everything arrives and I start construction I'll document this in another post.


  1. I have previously discussed the "plink plink fizz" method of decapping here, but what I really need to do is to selectively. server safe

  2. Hey Zac, Did you ever build this out into a physical device? I'd love to see pics of it. I'm curious how well the acid spray method worked, and how long it took to decap?


  3. Excellent. I have done something similar.

    Here is something that you will love... 3D print most of it! Ultem (polyetherimide) will withstand pH 1-10 and up to 125C.

    You could print onto and around the glass parts. You could make the whole thing into a single piece, as long as you can add some distance between the heating element.

  4. This comment has been removed by the author.

  5. Any updates?

    It might be worth learning a bit of glassware making skills. If regular borosilicate glass is fine, then you could make that whole thing out of glass. No sealing issues that way. What volume of acid do you need to burn a small hole? You could make a simple U shaped tube with a reservoir and then narrow the tip to as fine as you need. Push in air to force the nitric out.

  6. HARDWEAR.IO "CALL FOR PAPERS" OPEN is seeking innovative research on hardware security. If you have done interesting research on attacks or mitigation on any Hardware and want to showcase it to the security community, just submit your research paper. Please find all the relevant details for the submission below.

    ABOUT HARDWEAR.IO Security Conference is a platform for hardware and security community where researchers showcase and discuss their innovative research on attacking and defending hardware.
    The objective of the conference revolves around four key concerns in hardware, firmware and related protocols i.e. backdoors, exploits, trust and attacks (BETA).


    Training: 20th – 21st Sept 2016
    Conference: 22nd – 23rd Sept 2016


    The Hague Security Delta
    Wilhelmina van Pruisenweg 104
    2595 AN The Hague
    The Netherlands

  7. I am really enjoying reading your well written articles. It looks like you spend a lot of effort and time on your blog. I have bookmarked it and I am looking forward to reading new articles. discover this info here

  8. These type of machines come in different kinds, types and sizes from hand to computer controlled. These machines consist of a column, a base, spindle, table and drill head.cordless screwdriver

  9. Bifold panel hardware from Stanley hardware is yet another multi utility hardware for sliding doors and pocket doors. These are well known for their high quality and durability.electrical shop

  10. They call it the design phase, and the team meets with the customers to find the best fitting DIY home for their needs. They make building the home easy, and the team helps with all parts of the DIY home building process.awesome slime

  11. I would like to say that this blog really convinced me, you give me best information! Thanks, very good post.
    Sliding Wardrobes
    Keep Posting:)

  12. Even the words like alluring and fascinating cannot do full justice when it comes to describing this blog.
    paypal hack

  13. This comment has been removed by the author.

  14. I'm glad I found this web site, I couldn't find any knowledge on this matter prior to.Also operate a site and if you are ever interested in doing some visitor writing for me if possible feel free to let me know, im always look for people to check out my web site. bedliners

  15. I really like your writing style, good info , thankyou for putting up : D. zf north america Online

  16. I was surfing net and fortunately came across this site and found very interesting stuff here. Its really fun to read. I enjoyed a lot. Thanks for sharing this wonderful information.

  17. I have to convey my respect for your kindness for all those that require guidance on this one field. Your special commitment to passing the solution up and down has been incredibly functional and has continually empowered most people just like me to achieve their dreams. Your amazing insightful information entails much to me and especially to my peers. Thanks a ton; from all of us. identity access management

  18. That is the excellent mindset, nonetheless is just not help to make every sence whatsoever preaching about that mather. Virtually any method many thanks in addition to i had endeavor to promote your own article in to delicius nevertheless it is apparently a dilemma using your information sites can you please recheck the idea. thanks once more. Used Mini Cooper Parts

  19. Airport security plays a vital role for the country's security as a whole. Our airports are one of the major components of border security security company