Wednesday 13 November 2013

Ghettotronics

ghettotronics
gɛtəʊˈtrɒnɪks/
noun
  1. The branch of physics and technology concerned with the hacking of circuits using 
sub-optimal equipment. Typically carried out in a shed, spare room or somewhere else equally unsuitable for the task at hand.

Quite often when messing with electronics you get to the point where doing something is either too expensive to do properly or too hard to cheaply. For example, you could precision laser decap a chip you want to reverse engineer or you could throw some acid on it and hope for the best. You could buy a multi channel logic analyser or you could try and build one using your spare arduino. You could invest in a rework station for removing chips from a circuit board or you could just try your luck with your soldering iron.

The cheap and probably-going-to-fail-but-fun-trying approach is what I call ghettotronics and I seem to spend a significant amount time involved with it. 


A recent example involved wondering how to sniff a TSOP package. I didn't actually have a requirement to do so at the time, I just wanted to know how to do it in case I ever needed to. Here is a picture showing a SDRAM chip inside an old router.



The yellow wire is just a normal breadboard jumper to give a sense of scale.

I suspect with a healthy does of luck I might be able to solder a wire on that wouldn't cause a short but I also wanted to try and be as non-destructive as possible so I started thinking about an alternative approach. The first idea was to build a jig but frankly I'd still have the issue of aligning and holding contacts on the pins so that was ruled out. My second idea seemed good in theory so I gave it a go.

Hot glue. It rocks. The plan was to smother one row of pins in hot glue, allow it to solidify then peel it off gently. In theory I would have an exact template with little grooves where the pins sit. I would then insert a single wire strand into the groove of the pin I was trying to tap. As long as I also covered the corners of the chip I would also be able to align the blob perfectly. 



Sounds great in theory but this is what the end result turned out like. The idea was to hook the tap wire onto the clock pin just to verify the signal was being picked up correctly.



This is what it looks like when mounted on the chip. The red wire was just a convenient ground point for the scope. The tiny wire sticking out of the blob should have been the clock signal, but it wasn't. It looked a bit random to be honest. I'm pretty sure I was nowhere near precise enough when making the hole for the wire and despite it being a single strand it probably is still too wide.

I'd be interested to hear how others go about sniffing chips with tightly packed pins or if it is just a case of desoldering then resoldering back onto a dedicated test board.

Anyway, there is plenty of room for improvement with this technique. I'm not sure it is quite ready for the scrap bin yet. Of course, a Mantis Elite might have made life much easier, but that wouldn't have been very ghetto, would it?

6 comments:

  1. Not sure if your still doing this kind of thing but perhaps you should try radioshacks u mold plastic, it is sold under a lot of names, it's a polycaprolactone (PCL) and melts around 140F.
    I would recommend using a method that avoids the water for obvious reasons, I know when I used it to fill in an aluminum gear shift knob, I simply put it upside down in some water, dropped in the pellets and came back about 20m or so later and it was perfect. took it out with tongs (aluminum holds the heat much better than just the plastic) walked out and pressed it in place after heating up the shifter. Made sure it was straight and been working great ever since...even trips out to the desert haven't melted it...Yet....
    For what you were attempting in this post, but using pcl I would heat it up nice, and press it into place, but be careful to not force it up under the chip! get most of the shape right away then work with it a little as it cools to make it into a clip by wrapping it just a little around the sides of the chip. let it cool twice as long as you think it will take then carefully remove it. now use a micro drill bit in a HAND chuck to tap into the channel you want, make two holes so you can feed the wire through and know it isn't shorting anything. clip on and go...

    ReplyDelete
    Replies
    1. Thanks for the suggestion. I tried this exact approach a little while back and it was much better than hot glue unsurprisingly. I was impressed with the details that were preserved, you could see the individual traces from the PCB and the casting was exact. There weren't even any issues with it sticking to the components. In terms of using it to make a chip mold though, I found it too fiddly to be effective. TSOP packages were too tricky to work with so I tried a much bigger 8 pin SOIC (typical surface mount EEPROM form). The PCL was great for making a holder that could be placed on top of the chip, but it was still a bit fiddly when it came to drilling. That was trying to drill with a hand held dremel though, a more sturdy setup would have been better. I eventually found out that you can buy proper clips for a few quid so the experimenting stopped. But yeah, ThermoMorph (common brand name in the UK) is great stuff.

      Delete
    2. Not to beat a dead horse, but the use of a dremel was your mistake...with a sharp drill bit in a T handle such as for a screw tap does wonders. I found that using a plug in dremel would tend to burn it, while a battery operated one it is still hard to be precise, especially on the scale we are talking about.
      Anyways, I found your page because of your entries about the currentcost monitor, I was looking for the pinout for the device's data port as I lost the page that had it. I have 3 of the 4 pins, 4 is GND, 7 TX, 8 RX but where was +5V????

      Delete
    3. From http://currentcostgadgeteer.codeplex.com/

      1 Vcc supply
      4 Gnd
      7 EnviR Unit Rx Data
      8 EnviR Unit Tx Data

      I don't know if VCC is 3.3v or 5V, but that may not be important for you

      Delete
    4. Thanks! I already know it's 5V while the logic is 3v3, but it's not an issue since I'm using a usb ttl adapter, I just don't want to have another cable just for power simply because they didn't want to put the extra wire into the data cable...about to start attempting to dump all the data into a sql database so I can monitor the trends rather than just being able to see totals on the thing.

      Delete
    5. Trends are far more useful than the totals. To be honest, the EnviR unit really only works for me as a RF to serial converter! I've half written some code for a Uno32 that handles RF to serial, so I can capture all of the data stream rather than the cooked data that comes out of the EnviR.

      Delete