Sign in Subscribe

Chemical Hardware Hacking

Anthony S. Clark

• 2 min read
Chemical Hardware Hacking
Where we're going we don't need probes

One of the issues we sometimes run into when reverse engineering hardware are boards or chips that are covered in Conformal Coating. This is a sort of glaze that protects the board and components from moisture or damage, and can also make things more difficult for the reverse engineer.

There are many types of coating: Acrylic Resin (AR), Epoxy Resin (ER), Silicone Resin (SR), Parylene (XY), and Polyurethane Resins (UR). For each of these are there are different ways to remove them and often the two letter code is on a sticker on the board, but not always.

To remove these, depending which one it is, you have to use chemical solvents, heat, scraping, or microblasting, each with pros and cons. ( I need to get a micro sandblaster!)

Currently trying to attach probes to one of the chips on the Liberty Safe / Securam locking mechanism board and the conformal coating is basically blocking the probe claws.

Board Covered in Conformal Coating

It might be hard to see from the picture but there is a glaze over and under and around the pins so that has to be removed before further analysis can be performed. I didn't spot any labels giving us a hint as to which type is being used so we are going to try the chemical approach. (The device we are testing is cheap and not a customer so if we destroy it, its not a huge loss)

Chemical Approach

Its good to have a steel tray in a ventilated area (or a fume hood if you are fancy). In addition, we have the following other items:

  • Scraping devices
  • A variety of brushes for removing material
  • Some good quality chemical gloves to protect our hands (or a glove box)
  • Small pointed cleanroom polyester tip swabs (better than q-tips)
  • Some MG Chemicals 8310A Conformal Coating stripper gel since we are just spot removing and not removing all the coating from the board. This stuff works on multiple coating types including polyurethane, some epoxies, etc. and isn't as super toxic as some others. You can also use a pen from the same manufacturer for very fine detail work.
  • Isopropyl Alcohol for final cleanup.
  • A blacklight for visibility.


Once the material is removed, the probes can be attached and the chip checked with a logic analyzer, o-scope, or dumped with a BusPirate, etc.

Thanks for reading,

A.

Sign up for more like this.

Enter your email
Subscribe