[NOTE- This article will describe a process known as “Wet-Etching“. Wet-etching is a process that can be very dangerous and we do not recommend anyone reading this try it unless you know what you are doing and have the proper equipment.
The chemicals required such as Hydrofluoric Acid (HF) attack bone marrow. HF is painless until several hours later when it’s too late to take proper action so please be careful and be responsible. ]
Previously we discussed noticing Microchip making changes to their silicon substrates (aka the die) without marking the outside of the packaging as companies normally do.
See below a picture of the second generation PIC18F1320 die (same one you saw in Part I)-
We thought we would show you what this substrate looks like with a little wet-etching. The picture below has the top metal (Metal 3 or M3) removed or stripped off-
Flylogic Engineering are experts on doing the unbelievable (unthinkable!) when it comes to silicon-substrate attacks. We are the only known lab in the world to have ever executed a technique we call, “Selective Wet-Etching” where we lay a mask down and wet-etch only areas we select. The important thing to point out here is that when we are finished, the part is still 100% functional! This plays an important role to bypass security meshes or other obstructions.
Now for the good stuff. We did not etch off the metal completely because we noticed the hole size was touching an active wire on the top metal (M3). So we decided this was enough and light could easily get back through.
A little more etching and the metal inside this hole would have been gone however the vertical track (wire) to the left would have also been gone. This was enough and 45 minutes in UV resets the fuses (unlocking the device).
As we explained earlier, this part functions 100% except now the UV light can easily get underneath down to Metal 1 without hindrance.
PS- Bunnie was right regarding the CPU running on Microcode. All Microchip PIC’s ranging from the 10 series upto the 18 series contain a micro-coded architecture. This should shed light to some of you as-to why they are sooo slow (Feed them 40 Mhz, you get an execution time of 10 Mhz). Some of the newer PIC’s include Phase Lock Loops (PLLs) to 4x the external frequency.