Giulioz gives a sequel to last year’s talk “Proprietary silicon ICs and dubious marketing claims? Let’s fight those with a microscope!“, where he showed how he reverse engineered a pretty old device by looking at microscope silicon pics alone, with manual tracing and some custom tools.

Fast forward, he shows how he reverse engineered a much modern chip: the custom Roland/Toshiba TC170C140 ESP chip (1995). Completing this task required a different approach, as doing it manually would have required too much time. He used a guided, automated approach that combines clever microscopy with computer vision to automatically classify standard cells in the chip, saving us most of the manual work.

They then sped things up even further by directly probing the chip: by exploiting test routines and sending random data to the chip he figured out how the internal registers worked to create a bit-accurate emulator. He even gives the source code out on github so you can emulate the devices yourself.

Listen to the result at 32:19 where they play Darude Sandstorm.

Links:

• https://media.ccc.de/v/39c3-from-silicon-to-darude-sand-storm-breaking-famous-synthesizer-dsps
• https://github.com/dsp56300/gearmulator