Having heard that Atmel actually produced three variants of the AT90SC3232 device, we did some digging and found some of this previously never-seen-by-Flylogic AT90SC3232CS. We had already several AT90SC3232 and AT90SC3232C. We assumed that the CS was just a 3232C with an extra IO pad. Well, one should never ass-u-me anything! The AT90SC3232CS is a completely new design based on the larger AT90SC6464C device.
Decapsulation revealed that Atmel actually did place an active shielding over the surface of the device. A 350nm, 4 metal process was used on the AT90SC3232CS where the AT90SC6464C was a 350nm, 3 metal.
A quick polishing session removes that residue you saw in the previous photo. Now the device looks very similar to the AT90SC6464C.
Given the AT90SC family all run encrypted code that even Atmel claims they don’t know the key on. It’s mandatory to polish down the device and image areas of interest at each level to trace through the logic.
With the chip at Metal 2, it was time to go to Metal 1. This is where the actual transistor is put together to become something such as AND, OR, INVert, …
While not really required but always desired, removal of Metal 1 leaves us with the poly/diffusion areas visible. This is always helpful to explain P/N FETs for our purposes.
Given the feedback received from the recent 3 Metal display, we thought we would do it again. This time however, we imaged it at 1000x for a distance of 25,000 pixels across by 2413 down (25,000 is the max a JPEG will allow).
Having no knowledge of how the Atmel AVR smart card family works means we have to tear it down and trace out the databus paths. Â The next 4 images are just a sample of the real image we created. Â The real image is so huge, it would take days to download.
The next four images can be clicked on to open up the full 25,000 pixel JPEG.  Metal 4 was not imaged because it was the active shield.  The active shield is an obstacle  that can be ignored until the signals determined to be important are identified.
This is definitely the memory encrypt-decrypt block (MED) or at least the entry of it ;).