Home IC Decapping

Thanks to a YouTube video from the Chaos Computer Club I learned that colophony can be used to decap integrated circuits. Decapping is shorthand for "de-encapsulating," meaning removing a silicon die from its packaging. Decapping usually involves concentrated sulfuric acid or even fuming nitric acid, both of which are expensive and dangerous chemicals that are difficult for the average person to get a hold of (especially fuming nitric).

Colophony however is another name for rosin, the same stuff used to make soldering flux, and is safe enough to hold in your hand. This revelation started this project to find ways of decapping ICs using inexpensive and widely available tools and chemicals.

So far boiling in rosin has proven to be a very effective means of destroying IC encapsulation, exceeding my expectations. However it is most effective with some prep work, especially sanding and cutting off the pins or solder balls of the package first. I'm still perfecting the process and am on the lookout for other methods, since while cheap and easily available online pure rosin is not something you'd normally find at a hardware store. I've also had some success with simply sanding and using careful heating to reveal dies, with no chemicals required.

Project Logs

Collapse

Chemical testing
Generic Human • 05/24/2019 at 03:05 • 0 comments

I've ruled out both the paint stripper and muriatic acid as means to dissolve encapsulation, as neither had an effect on all tested chips (except for BGA underfill).
Pentium 4 decap
Generic Human • 05/21/2019 at 05:12 • 0 comments

I promised something bigger, and here it is!

I bought a bunch of these on Ebay for about $2 a piece some time ago. I thought I would kill them off in "bare metal" assembly programming and motherboard experiments, but never delved deep enough to do so. So now I've put one on the chopping block! Sadly I broke the die in the process, but more on that later.

This is a socket 478 Willamette chip, the first of the Pentium 4 designs. It's a pin grid array package.

As earlier the first step is to remove the pins (and capacitors in this case) so that the bottom of the chip is flat for sanding. This was a bit more difficult than expected. Either the power planes and heat spreader sucked up a great deal of heat or Intel used a solder with a significantly higher melting point than most. I had to set my hot air tool over 400C to remove the pins and had to resort to my micro-torch to remove the caps, leaving me with this hot mess:

At first I tried holding on to the heat spreader during sanding but it was too slippery. So I super glued a piece of aluminum to it. The reasons for superglue is that it forms a strong bond that is easily weakened by heat, and because it was already on my bench. This piece was quite a lot larger than I'd recommend, but again it's what I had on hand.

As before I began sanding, this time using 60 grit to get through the thick interposer faster. You need to check it every so often to make sure the sanding is even.

As you sand through the layers on the interposer the color of the dust changes. Shortly after this point I switched to 600 grit.

At about this point the interposer was getting very thin and I seemed to hit the top soldermask layer. Concerned about sanding through it and hitting the die I decided to stop sanding and cut/peel it out so I could fit it in a test tube.

Here I made an interesting discovery: the die wasn't soldered to the heat spreader, but instead used thermal paste! I thought this was a recent trend, one that Intel had taken fire for from the computer enthusiast community. After consulting my friends at TechPowerUp however I learned that Intel started soldering dies mostly during the later revisions of the Pentium 4, then switched to paste again, and has now started soldering some of them again.

Even though there was still part of the interposer attached to the die I decided to put it through the rosin process in the hopes that it would separate. It did at about the 10-minute mark.

I'll never be a photographer will I?

Here is where things went wrong. I mentioned in a previous log that removing the die from the rosin with acetone was "more difficult than it sounds." With this much larger die than before, i managed to break both the die and my test tube in my prodding to extract it! Maybe next time I'll try pouring the chip and rosin out while it's still hot.

Not all is lost though, I still have most of the die intact. I can even still feel the solder bumps on it that attached the die to the interposer. However the die seems to have a top layer of metallization that makes it difficult to see the circuitry underneath. I don't know if this is just the chips clock, power and ground networks (which are generally on the upper layers of metallization) or if it's one of one of those anti-counterfeiting measures that chip companies use, but I assume it's the former.
EDIT: I just realized that this top layer of metalization may also be satisfying a "fill" requirement. Each metal layer must contain between a minimum and maximum amount of metal, with large wires having slots cut into them and large spaces having metal fill that has no electrical function. This is because the difference in hardness between the metal and passivation can cause the metal to "dish" during processing.
Still there is some diffraction that seems to be coming from the lower layers.

I'm really anxious to get a closer...
Read more »
Found it
Generic Human • 05/18/2019 at 03:52 • 0 comments

I've found the YouTube video that said rosin (aka colophony) could decap chips, which is what started this project. There's a number of different techniques given and relevant information, the rosin method is at 30:17.
Rosin Redux: Success!
Generic Human • 05/18/2019 at 02:40 • 0 comments

After the disappointing failure of rosin soldering flux to dissolve IC packages I was skeptical that plain rosin (also known as colophony) could do the job. I was wrong! Here are my steps:

Remove any pins from the IC. Our victim is a small SOP package pulled off an old motherboard. Here's the datasheet if you're curious, but it's basically a voltage regulator.

Put IC with a generous amount of rosin in a test tube (or other glass container). You don't need to fill it up, but around half of it will boil off during the next step.Heat to a rolling boil for 20 minutes. Notice that I am doing this outside. The smoke you make while soldering is from the flux that solder uses, so as you can imagine boiling a couple milliliters of the stuff produces quite a bit of smoke. Also dress appropriately: rosin boils at over 300 degrees Celsius and is very sticky, you don't want to get it on your skin! Fortunately it doesn't pop and spit nearly as much as the rosin flux did, but I was wearing long sleeves, welding gloves and a face shield. That may be a bit overkill but after getting paint stripper in my eye a week ago I'm not taking any chances! As you boil the rosin it will become dark as it eats away the encapsulation.

Let Cool. Wait, what have we here?

Dissolve the rosin with acetone. This isn't as easy as it sounds, you'll need to mix it a little and maybe warm it a little too (no, not in the microwave!).

Pour it out and look for something shiny. You'll still find black bits of encapsulation, but the die itself is a somewhat shiny square or rectangle. However it may be very small.

That's the best picture I can get of it, I'm not even sure if that's the top or the bottom! Being a voltage regulator it doesn't have the fine features that make those pretty colors in more complex chips. But boy is it small!

Maybe I'm just a horrible photographer.

Interestingly enough, the die separated from the paddle. You can see one of the bond wires attached to it. Unlike the others I've decapped this was clearly a wirebonded chip.

Stay tuned for something a whole lot bigger!
More success
Generic Human • 05/15/2019 at 06:00 • 1 comment

Another success! This time with a QFN package. Sadly my phone camera won't do it justice.

Like with the BGA flip chip earlier I sanded from the bottom with 120 grit sandpaper followed by 600 when I started to reach the leadframe. This works faster than you might expect. I stopped (slightly too late) upon seeing tiny metal dots outlining the shape of the die. Turns out this was a flip chip too, I accidentally erased a bit of the die during my sanding. This time however I torched it for a couple seconds, rubbed off what I could then let it soak in acetone for a couple hours then rubbed off the rest. No harsh stripper required!

Next time I try this I'm going to take pictures and document the process better. I guess I got a little ahead of myself.
Results so far
Generic Human • 05/12/2019 at 10:16 • 0 comments

Mechanical shock: failed. Chip destroyed along with package. Will test with smaller hammers.
Thermal shock: mixed. Heating with blowtorch until red then dropped in water. Reasonably effective with DDR2 memory chips (large die, thin package). Separation of die from interposer still difficult.

Boiling in rosin soldering flux: failed. Was tipped off that boiling colophony (aka rosin) could destroy epoxy encapsulation. Sadly rosin flux was ineffective against all ICs tested. Will test with pure rosin when it arrives.

Paint stripper w/ methylene chloride*: success! Sanded flip chip from bottom until underfill was reached. Underfill treated with paint stripper and removed. Solder bumps still attached. Will test with other ICs when able. WARNING: stripper will build pressure if contained! Now using full face shield and goggles after accident!

*methylene chloride to be banned from paint strippers in US. Will test non MC strippers.