- Sample prep
Mask ROM is used for high volume ICs that can sacrifice flexibility in changing the program for large volume production cost savings. Stand alone mask ROMs are also produced such as the MCM6570. These are most commonly found in videogame cartridges. These chips can be read directly, there is no need to use image processing to decode them. Note however that because such chips are easy to read they often are supplemented by security processors to prevent trivial cloning (ex: Nintendo's CIC series of chips).
Small ROMs are also used to form logic arrays such as for CPU microcode.
Above: NOR examples schematic. Copyright 2005 Sergei P. Skorobogatov, used with permission
NOR ROMs work by pulling up the bit line to VCC. When a word line is select some mechanism may be present to bring it low. Thus it is a “NOR” because output is a 1 unless any of the bit lines bring the output low. For example, say WL0 is 1 and the rest are 0. BL0 produces a 1 because nothing shorted it to ground but there is a pullup to VCC at the top. Similarly for BL2, both the WL1 and the WL3 transistors are off allowing to output a 1. However, BL3 outputs a 0 because the transistor at the intersection of WL0 and BL3 is on, shorting the output to 0.
“There is an OR structure as well but the only difference between it and the NOR structure is that the transistors are connected to VCC instead of VSS” [Semi-invasive attacks, pg 28]
Above: NAND ROM reference schematic. Copyright 2005 Sergei P. Skorobogatov, used with permission
These are the logical complements of NOR ROMs. Instead bringing lines low through some sort of switches in parallel, the switches are in series. By selecting all switches not in the select row to turn on, the presence or absence of a switch in that region determines if the output changes state. For example, in above diagram output bit lines have a pullup transistor. Say WL1-3 are asserted but WL0 is not. BL0 will get a 0 because all transistors in that line were on (just the one at WL2) causing BL0 to short to ground. Similarly, BL1 also outputs a 0 because both the WL1 and the WL3 transistors are on to short out BL1. However, BL3 outputs a 1 because while the WL3 transistor is on, the WL0 transistor is not on.
There are several ways to implement the switches above. Typically these are done through manipulating mask layers but post fabrication techniques also exist (ex: laser ROM).
Above original caption: “Configuration and layout of MOS NOR ROM with active layer programming. This type of memory can be read optically.” Copyright 2005 Sergei P. Skorobogatov, used with permission
Above original caption: “Configuration and layout of MOS NOR ROM with contact layer programming. This type of memory can be read optically but usually requires deprocessing.” Copyright 2005 Sergei P. Skorobogatov, used with permission.
Typically requires delayering if a modern CMP process but older ROMs show the contacts through the metal. In the above image many transistors are formed but only a few are actually connected. The ones that are connected to the bit lines form the driving transistors that, if any are on, bring the output low.
Above original caption: “Configuration and layout of MOS NAND ROM with metal layer programming. This type of memory can be read optically.” Copyright 2005 Sergei P. Skorobogatov, used with permission
Easy to read optically. In above image transistors are formed everywhere. However, some of them are essentially bridged always on by putting metal over them. In theory I imagine that the contacts between several transistors shorted closed are unnecessary. For example, the top three contacts on the left. The middle contact essentially does nothing because both the surrounding transistors are bypassed.
Above original caption: “Configuration and layout of MOS NOR ROM with programming using implants. This type of memory offers high level of security protection against optical reading.” Copyright 2005 Sergei P. Skorobogatov, used with permission
Above original caption: “Configuration and layout of MOS NAND ROM with programming using implants. This type of memory offers high level of security protection against optical reading.” Copyright 2005 Sergei P. Skorobogatov, used with permission
Implant ROMs essentially work by starting with a mask that has a grid of normal, working transistors. Then some of them undergo additional bombardment to change the voltage threshold. In the above examples the voltage threshold was raised such that the transistor is off regardless of the gate voltage applied. This is different than a depletion transistor where the transistor is normally on and turns off when biased.
These can be tricky to read out, even on old chips, since they are not readily visible under a microscope.
Try to find a test mode, glitch, etc by studying the die circuitry. Several chips such as the N64 CIC have been dumped this way.
Generally this level of doping is not visible to the naked eye. However, I've noticed that the implanted areas have sunken epitaxial areas that can be seen by oblique illumination. It may be possible to read an implanted mask ROM by exploiting this height difference by using oblique illumination, confocal microscope, etc.
This is the generally preferred method to read these out. See this page for information on staining with Dash etch. Other mixtures may also give results but this is the most industry standard.
AFM like technique that measures capacitance change by doping. This is believed to work for ROMs, although we currently don't have any solid data on this.
This is believed to work for ROMs, although we currently don't have any solid data on this.
Discussed this with someone and they think the dopants are too low concentration to be detected. It would be nice to get someone to actually do a scan and prove this.
TOOD: confirm this is how these work
Popular on older chips. Seems to always be NAND.
A CMOS transistor forms when a cutout is made to bring metal close to active area. Presumably these are otherwise like implanted depletion ROMs described above.
Above: earlier 1C die
Above: later 2C die switched to implant ROM
Above: 2C stained with dash etch to show bits
Code is not yet released at the time of this writing but looks to be a good tool to try out. Good article highlighting some of the problems optically reading mask ROMs and how they get around it.
I heard a rumor that I'm told is false that the MAME project crowd sourced ROM decoding by putting some sort of captcha on login screens. Thus every time people log in they have to digitize a small part of the ROM and over time the whole ROM is digitized.
Considerations for preparing SEM images for automatic decoding: http://recon.cx/2013/slides/Recon2013-Olivier Thomas-Hardware reverse engineering tools.pdf
Travis Goodspeed tried to have a contest to decode some automatically and unfortunately got no submissions. The MCM6570 had two different type cell sizes (only one shown above), although I get the impression this is unusual. Ideas: