DJ🌞

A wide variety of passives in the analog sections. Interesting there seem to be microprobing pads bringing out internal signals too, I suppose they decided not to clean the design up after it was good enough.

A 3-state digital pad, it seems, as high and low side FETs are driven separately. Their layout is also unusual.

The digital section in the lower right corner provides quite a lot of signals. They are fed into a long wall of registers on the left side of the snippet. Judging by the absence of the corresponding number of pin inputs, there is at least one chain of serial-in, parallel-out action.

While packaging is labelled by Agere, the die is copyright Lucent Technologies, year 1996. Agere was spun off Lucent in 2002, according to reliable sources.

I just noticed, but when a security guard punches in the combination on a panel, the sound effect is in fact on his voice track. He literally does "poom poom" with his mouth, and I find that hilarious. #halflife

why the hell did I wake up at 6am...

@png@yap.pony.biz @drwhax@infosec.exchange That's true! In an ideal world that could be the norm. But until that's in place, at least some of us could chip in. Wasn't that the way things were ran in the good old days -- submitting patches for problems? A crowd pointing at problems all the time can be strongly demotivating, but it does not have to be that way. Yet I am still to hear of a security expert submitting solutions together with problems they point out. A rare animal indeed. ;-)

@drwhax@infosec.exchange @png@yap.pony.biz I mean, it would not kill you to also submit a patch fixing the issue you found, would it. Certainly isn't the silver bullet, but I am sure it could help many of those overworked poor souls. So.. have you submitted patches together with your reports?

@thalia@discuss.systems Unless they fail catastrophically, it is typically okay... And probably even more interesting that way, we can take turns guessing at what's the reason for them failing. Let me know when you are ready to post them, I'll drop you the address.

The prominent doodle can be noticed on the thumbnail image. Here is a close-up.

@LanceJZ@mastodon.social Ha!

I think I will close the thread here, but by any means go and have a scroll around. So much interesting stuff on this die. Thanks for joining me today! Hope you have a great end of the week, and as always, see you next Friday!

Returning upstairs, it seems this is the 8/16-bit machine, like 8 data and 16 address bits. All the SRAM blocks seem to have 8-bit I/O if you look *really* close.

A 16-bit shift or swizzle unit? Seems it can also do bit-reverse, which is useful for DSP code.

And we have a doodle! Looks like a bat? I wonder why this one was chosen by the design team.

And e-test features for this funny doodad typical for ADCs. Probe pads are not opened though, interesting.

Mask ROM is, of course, much denser, but they still had to be creative with layout. Contact size seems to be the main issue here.

RE: https://oldbytes.space/@gloriouscow/117045025719349470 I keep asking myself the same, time after time

And what do we have here, this reeks of a 8-bit CPU design. From the top: microcode PLA, control, data path. I wonder if this is something standard like a 8051?

Three fuses are also present. This design uses metal for the conductor to be blown.

I did find a spot where something other than the dummy feel or wiring can be seen! Looks like standard cells. But it'd probably be best if you refer to the original design. 😃

@Kugg@infosec.exchange Oh I don't know, we got rain tonight, will try my luck in a couple days too. Last time was decent.

I mean, yeah, sure, we buy them by the bucket anyway. #fpga

I say, you should expect more images coming from the #TinyTapeout folks -- I received a whole bunch of dies from them. Until then, stay safe, stay healthy, and I'll see you next week~

This could be the "normal" ALU for the DSP, judging by the many 16-way sub-units in there, plus a 16-bit bus running on the right.

And a 12-bit RAM block, for some reason?

Same goes for ROMs, on the example of siamesed blocks here, top vs bottom.

@thalia@discuss.systems What packaging are they in? Maybe you could snap a couple photos? But I don't see why not. Do you plan to open source your emulator?

@riley@toot.cat You are correct, the package's origin was in Brno, CZ. Though at that address is their office, not a warehouse or anything. @stefanie@social.anoxinon.de @brouhaha@mastodon.social

And (part of) the ADC proper, always an intricate design.

@root42@chaos.social How in the world does one break a screw in plastic??

A lot of funky stuff is at the bottom there, like this interesting unit. Apart from it being 16 bits wide, I can't figure much about what it does -- my best guess is multiplication. What do you think?

Damn, Boku no Kokoro no Yabai Yatsu has ended!

Almost there. :-)

The most prominent feature, however, is... empty space at the right. There used to be *something* in there -- there is a bus routed to the empty space. I wonder what it was? More memory with extra features?

RAM density looks absolutely abysmal. The chip only has 224 bytes (yes, bytes) of SRAM, taking about the same area as the whole datapath of the CPU core.

There is a block of standard cells at the top left. It looks like it's missing something as well. On another note, two routing channels are missing dummy fill and instead have something else. Mysterious!

@riley@toot.cat It seems to be the same they have in their business registration. Frankly, I did not invest too much time in OSINT here. :-) @stefanie@social.anoxinon.de @brouhaha@mastodon.social

@buherator@infosec.place It is always easier to blame our own stupidity and near-sightedness on someone else, be it aliens, gods, or enemies.

Mask alignment, IDs, and CD features.

@da_667@infosec.exchange everything holds provided you have a particular definition for "humanity". aka those who benefit and are not affected.

@teotwaki@mastodon.online Hahaha, well, good morning to you too, friend.

@stefanie@social.anoxinon.de @riley@toot.cat @brouhaha@mastodon.social I placed a Mouser order last week, we shall see how this goes. Should arrive this week, I hope.

This could be explained due to width: ROMs in the bottom half seem to be 32 bits wide, which is... interesting? Could the bottom half be a DSP?

Maskset ID and maskwork rights note, together with the original part number. This is J53W.

On the topic of memory blocks, it seems there are two distinct IP sets on this die. The top half differs significantly from the bottom half. For example, here is what I believe to be SRAM, top vs bottom.

@stefanie@social.anoxinon.de @riley@toot.cat @brouhaha@mastodon.social Huh. It was shipped from within the EU, so no extra charges got slapped on it. It was a list of 20+ positions (R, C, semi, connectors, etc). YMMV, but it seems safe to order for now?