Towards Direct-Control Data Acquisition by Nano-Probing Non-Volatile Memory Cells

Abstract

This chapter describes a data acquisition method for non-volatile memory that directly interfaces with the floating-gate transistors on a silicon die using nano-probes under a scanning electron microscope. The method involves chip preparation, memory cell reverse engineering, contact point identification and disinterring, following which nano-probes are positioned on control points on the die that are attached to the address, bit and ground lines associated with an individual memory cell. After the connections are established, a highly-sensitive sourcemeter applies voltage in a sweeping pattern to the address lines to enable current to flow between the bit and ground lines. The sourcemeter measures the minuscule current flow in the floating-gate transistor of the targeted memory cell to determine if it stores a zero or one. The research literature does not describe a data acquisition method that actively probes individual memory cells to read data.

Extensive experiments on ATmega328P microcontrollers demonstrate that the chip preparation, memory cell reverse engineering and contact point identification steps are successful. However, after the contact point disinterring step, it was difficult to verify that the contact points were fully exposed and free from contamination and damage. Indeed, the difficulty establishing consistent electrical connections between the nano-probe tips and address, bit and ground lines yielded non-ideal results. Nevertheless, the direct-control data acquisition method for non-volatile memory and the accompanying workflow that customizes a direct-control data acquisition method to a specific microcontroller or memory chip are technically sound.