INSIGHTS, NEWS & DISCOVERIES
FROM IOACTIVE RESEARCHERS

Saturday, August 7, 2010

Parallax Propeller P8X32A Quick Teardown

Parallax has a really neat 8 core 32 bit CPU called the 'Propeller'.  It's been out for a few years but it is gaining popularity.  There is no security with the device as it boots insecurely via a UART or I2C EEPROM.  None the less, we thought it was interesting to see an 8 core CPU decapsulated!



The image above is the Propeller optically imaged 50x magnification.  One can clearly see 8 columns that appear almost symmetric (except in the middle region).  The upper 8 squares are each 'cogs' 512 * 32 SRAMs as described in the manual.  The middle left 4 and right 4 squares are the ROM's Parallax describes.  The 8 rectangular objects are the 32KB SRAM as described.  The 8 cores are basically the 8 columns above the middle ROM's to include the 512 * 32 SRAMs because they describe each cog as having it's own 512 * 32 SRAM :).



After removing the top metal (consisted mainly of routing tracks), we can see the 8 cores a little more clearly.  The metal over the 4 left ROMs has begun to remove as well in the image.



Above is a single COG rotated 90 degrees clockwise.  There are 8 of these objects in the upper half of the die.



Last but not least is the logo by Parallax.  Nice job Parallax on this beast!  We have one favor-  implement some flash on the next generation with a security bit ;).

18 comments:

  1. nice pictures, chris!
    one minor complaint: can you add scale bars the next time so we have an idea about the dimensions of the process?

    ReplyDelete
  2. You got it Dogbert (if time permits :). The Propeller appears to be 350nm.

    ReplyDelete
  3. I love the teardown posts, pity we're seeing them less and less, keep up the good work.

    ReplyDelete
  4. Nice job Chris,

    In fact I prefer see some security feature broken, but these image are interesting as well.

    ReplyDelete
  5. This kind of feedback will keep them coming more frequent! Thank you.

    ReplyDelete
  6. Any chance well see a post about the teardown/demetaling process?

    ReplyDelete
  7. How so? Please explain more.

    ReplyDelete
  8. I was curious about your 'magic' process used in decapusulating and de-layering chips - which I do realize may be a trade secret but it does sound very intriguing.

    ReplyDelete
  9. Red fuming nitric acid is usually used to dissolve the plastic. I think that hydrofluoric acid is used to dissolve the layers on the chip.

    ReplyDelete
  10. Yep along with some physical processes after stripping depending on the residue left behind.

    ReplyDelete
  11. It's nice to see someone really digging into the Propeller. We have some pictures of the die too, but we cheated and used raw dies to get the photos (see http://www.parallax.com/Portals/0/Images/Prod/0/PropDieDiagram.jpg ) I haven't seen what it looks like with the top metal layer removed, though.

    We are designing the next version will to have OTP fuses that can be used to store a key for a symmetric cipher. Onboard flash won't be feasible, but we are hoping to be able to boot directly off of an SD card. The boot ROM would load in the firmware image and optionally decrypt it. We haven't chosen the cipher, but we are leaning toward XXTEA. Only the boot ROM will have access to the key, and once written it cannot be modified.

    — David Carrier
    Parallax Inc.

    ReplyDelete
  12. As David said, you did not need to do this as Parallax publishes the photos of the die with an explanation of the parts of the chip. It is a fantastic chip and I thank you for bringing it to the attention of others.

    Are you able to determine the ROM code in your process? Parallax has already released the code, so this question is more about whether you can and indeed if you can determine the fuse settings of the OTP expected in Prop II?

    ReplyDelete
  13. We could read the ROM out yes if needed. It is either implanted via ION implantation which case we stain it or it is a masked rom which is visible. In case you didn't know, Flylogic is used to encrypted data, scrambled address ROMs so this would be child's play. Alternatively, we could trojan the ROM out as has been witnessed on ST19 series system-ROM dumps.

    Regards!

    ReplyDelete
  14. XXTEA would be very nice to implement to allow encrypted download into the Propeller from serial EEPROM. Thus, sort-of following the Xilinx Virtex-PRO into Virtex-4 path :).

    Cannot wait to see it! If you have any wafers laying around with a bunch of bad dice, feel free to send here!

    ReplyDelete
  15. hello Chriss interesting blog
    can you tell me is there any solution for remove metal layers mechanically ? without dangerous hf acid needed ?

    ReplyDelete
  16. You can manually polish (lap) the layers off using a very fine lapping film or solution. If there is enough interest in this, we can produce a write-up on this process.

    Regards

    ReplyDelete
  17. hmm you mean sandpaper ? (lap) ?

    ReplyDelete
  18. [...] what the inside of a tiny, 8 core microcontroller looks like? Flylogic.com has a teardown of the propeller. This entry was posted in Uncategorized. Bookmark the permalink. ← Lighting a lightbulb [...]

    ReplyDelete