>>My name is Joe Grand, I do computer stuff, I do electronic stuff, I designed a few years of DEFCON’s electronic badges. 14-18. Today is a talk that I’ve been really wanting to do for a really long time, and that’s look at different ways to get access to inner layers of circuit boards to help with reverse engineering. So, we see a lot about chip-hacking that Chris does at a really microscopic chip level. We see a lot of hardware hacking, embedded systems, component level, connecting up through JTAG interfaces and through UART ports and all sorts of stuff which is slightly higher level, but we never really look at the board level. And this is something that I’ve really wanted to do for a long time, so I’m excited to give this and lucky that I guess I convinced enough people at DEFCON to let me give it. So just to get started, reverse engineers PT boards isn't that much different than anything else, except we look at the circuit board. We're undesigning a system that's already been built. In this case for this work, I'm sort of assuming a black box type of scenario. Maybe we open up a product and access a circuit board in the field that we want to figure out what's going on with it. So we take that system, and we use destructive methods and nondestructive methods whatever we need, depending on the situation so get all the information about the board so we can go and perform an attack or do SGLGS something else. The main ways soldier to access each individual copper layer, which is the primary thing I'm most excited about. Once you get those, if you get each layer of the board, sometimes they have a multi‑ layer board, and I'll describe the kind of typical board composition. You can kind of lay those out together and stack them in just (?) and do imagine processing types of things to trace out connections. Once you do that, you can say this part connected to this part and maybe micro controllers connected to international memory to give you an idea about what's going on. Oh, yeah, also besides the obvious sorts of things figuring out how the system works, good to verify security schemes of things. What I really like about this is injecting kind of new behavior into a device. This is something that's like, yeah, of course you have the standard research type of things or forensic analysis or whatever. If you have the board design, you have the fingerprint of the board. If you have that board level, you have firmware and other things. Lots of governments have been doing it for quite some time, and they must use the techniques I'm assuming. It's interesting area because now you take a board, delayer it and figure out what's going on and find a good location to inject something that isn't going to be detected. Whether it's enabling some new feature, whether it's some surreptitious monitoring or whatever it is, people don't think if somebody changed the board layout between the time I sent the board out to fab and the time it came back from China. No one is thinking about that. At chip layer maybe. There's all sorts of kind of gray mart areas for chips, but circuit boards, you don't think if someone adds functionality to a board, but you should. So we look at three different sections. I've broken this out. The first soldering, thing is getting access to the top or bottom layers of the circuit board. Then we look at delayering for multi‑ layer boards to how to figure out and get access to each individual layer of the board. Then imaging with nondestructive types of stuff. A lot of tools we look at here are not that impressive, but it's just never been talked about. So we have manual some manual methods and chemicals. All these different things are cool to put in one spot. And a lot of thing we use are design for failure analysis, so they're engineering tools that legitimate designers are using and legitimate fabricators are using that we're using for hacking hardware and for reverse engineers and that's what we can do a lot. Take advantage of tools out there and use them to our advantage. Just work was done for a cyber fast track project so our tax dollars at work to play with circuit boards, which is awesome. I was going to do it anyway. I didn't tell them that. So before we can actually start getting access to the layers and start doing some of these techniques, we need to understand how a circuit board is put together. How many are familiar with circuit boards and how they're built? About half. How many have designed a circuit board? About the same half. Okay. Cool. I guess that makes sense. Okay. Half of you guys are familiar with it and half aren't. That's pretty good. Circuit boards are basically a sandwich of layers. So you have your insulating layers and your copper layers. Your top layer is copper and then you have your insulating layer. So I call it a circuit board sandwich and made a shirt just for the occasion. I don't know if you can see it from way in the board. Circuit board sandwich. Circuit boards are awesome. So this is  ‑ ‑ the circuit board provides a physical carrier, so you have all the components that go on the board with the physical carrier where the component connects on the board and they provide the electrical pathways. If you figure out what they are, you can do the reverse engineering. This picture on the right this cross‑ section is a 16‑ layer board I happened to pull out of my stack of circuit boards, and it's a cross‑ section. So we're looking at each individual layer from the side‑ view. There's a bunch of  -- I don't know what it is. I can't do the math in my head. There's thin layers and two thick layers in the middle and a bunch of other ones. If you do a cross‑ section not uncommon, sometimes you can do it from the edge of the board so you can see and try to get an idea of interlayer spacing. The inter layers are thicker that means power or ground planes or something carrying high current there. The picture on the left is an awesome, awesome thing if you can ever get it. It's the Dutch Indonesian specNell, which is an awesome layer cake and not a PC board and taste much better than PC boards. I can guarantee this. I ordered this at a restaurant in the Netherlands. And I didn't know what it was. They brought it, and I was like oh, my God, this is awesome. I'm putting it in my presentation. Now you know what circuit boards look like. There's a bunch of other layers on a board. You have your copper and substrate layers, but you have other stuff. There's a silk‑ screen layer usually for markings on the board, and sometimes other colors. That's made of a printable ink or epoxy. Usually part designators are on there, sometimes you see manufacturing logos and sometimes markings by engineers for testers, things to take advantage of it. That's at the super top layer. The next layer down, the solder mask , coating that makes the coatings green or white or blue or whatever, basically the protective layer that protects any area of the copper that is not intended to be exposed. If you look at your Defcon badges, all those copper pads, those copper circles are intentionally made to be exposed. You can solder to them and tap onto them and do things. If you look carefully you can see a bunch of trailers underneath the actual solder mask, and those are not intended to hack on. That doesn't mean you're not allowed to go there and do it. It means the engineer doesn't want you to access those and protects the board from dust and erosion and a bunch of other stuff. We need to deal with that solder mask later. The circuit board fab is almost approaching like high feature size chips, like you're getting so  ‑ ‑ these tiny, fine features so the state‑ of‑ the‑ art costs less than 1 mill, 1/1000 - thousandth of an inch. Which is amazing density. Half a mill, less of half a mill diameter laser drill holes. Circuit boards are highly complex. They're amazing. Avia inpad connects different layers today. Normally in a traditional PC board fab you have it going through the board say it connects layers 2 and 6 of the board. It's still going to go all the way through, because it's an easier fabrication process. When we have avia pad or buried via, you can't find the via sometimes. It's insane. Via and pad is like you have a highly integrated device where there's a matrix of solder balls underneath the part. If that pad needs to connect to an inner layer, it doesn't have to go OP top layer somewhere else. It can have a via straight in the pad and going straight down into an inter layer, and you would never see it unless you did some of the techniques that we're going to do. Very, very advanced capabilities, but normally we look at traditional capabilities tracer space, 8 mill mechanical holes and buried vias and they only connect the layers that need connected. You can't access it from the outside. Just amazing what PC board fab can do right now. This picture is an iPhone 4, a cross‑ section of that. Ten‑ layer board and super thin. What is it?   .75 millimeters or something. Let me convert that. 29.5 mills. 29.5, so 30/1,000 of an inch thick. Ten layers. I didn't actually convert that in my head, and I have notes. Some can do math really fast, but I can't. Thank you for joining us. You too, fellas. Please sit down so I can continue so you don't interrupt me anymore. I know them. It's okay. Yeah, so this type of board is super complex, and I use this iPhone board in a lot of experiments. I wanted to use kind of traditional standard board. I did some two‑ layer boards and cut some six‑ layer boards and had complete control over the design on each layer. I knew the layer spacing, knew everything about it so I could kind of validate the success of the various techniques. Then the iPhone board is a real world situation of an actual consumer product using current state‑ of‑ the‑ art technologies. So I grabbed a bunch of these things on eBay that were actually Apple iPhone knock‑off boards. They looked grate and there were noticeable defects and cracks in them. I couldn't imagine someone buying an iPhone board on bay  ‑ ‑ bay and building it. It was fun to use this for a hobbyist board to prove the technique works for the real deal. So I mentioned we wanted to try to get access to the inner layers or all the layers of the circuit board. If you do that, if you can only access, say, the top and bottom layers, that's still better than nothing. If you get all layers of the board, whether it's a four‑ layer board or whatever, you can start really putting together the entire design. So this thing here, I show this again at the end of the presentation with one of our techniques. This is four layers of a speech assist board I designed that is a great reference, because I know exactly what it's supposed to look like. If you also know the components, almost all of this stuff except maybe some of the nondestructive methods assume there's no components on the board. If you go through the process, you make a note of the components and take them off the board to actually start destructively getting down to the different layers. If you don't know, then you can re‑ create a whole schematic. It's like an electronic road map, and then you totally win. All right. So the first set of things we look at is solder mass removal. This is getting access to the top and bottom layers, because those are the only two protected by the solder mask. Lots of different layers. You'll see the mechanical layer that the manual abrasion and mechanical. We go through these and see. It's surprising a lot of stuff you see the lowest tech ends up being actually most useful, which is great for us, because it's also the cheapest. So what I'll do is run through a bunch of these techniques. On the fast track work, a bunch of stuff didn't work. I don't have the times to go through all the stuff that didn't, so I have one slide for each section that didn't. You don't have to fail the way I did. I tried lots of stuff. They're will on my website as of today, so if you go to grandideasstudios.com. I have an academic paper published next week or something, so that will be what I'm saying here except written down in like really nice sentences. That took a really like time to write. Sandpaper, everyone has sandpaper. It seems like an obvious sort of solution, and it is. It works great. So this is something, URN, for this particular section, and just sanded it. It worked great. The one thing to worry about, though, is you have to make sure the sandpaper is plain art to the surface. You want to make sure you evenly sand, because if you don't you get wear and sand down into the substrate and into the copper and the substrate. I'll show you that when we do the delayering stuff. It's using sandpaper. You can put boards of the same height of the board you're sanding to keep things really level. The effective lowest cost way to do it. There's just some results of that. Different grits. Depending on the finish, some circuit boards have gold surface finish on the pad. Some have a solder over bare copper where it's like solder kind of leveled or blown over the pads. So depending on the surface finish required for the board, you might need a different grit sandpaper. So the thicker the surface finish, you may need a stronger sandpaper first, and you move up to higher grit to remove the solder mask. You see on the iPhone board, 400 grit sandpaper, you can wear off that solder mask, but you don't wear down the copper at all. Using a fiberglass scratch brush, which I hadn't known anything about before but I guess they use them for scraping off rust on metal that you're working with or cleaning off different types of parts, they're great for removing solder mass. It's better for selective areas. So say you want to access a single trace on the board, that's what the fiberglass brush is great for it. You can do a whole board, but it will take a little while. Make sure you wear gloves because it will flake off and you have tons of splinters all over your hands and finger and everything. I posted a picture of some of those at some point. One person realized fiberglass shards are really bad. I'm like, I know. Thanks for that tip. So that's a scratch brush. Sandblasting, you don't normally associate sandblasting with circuit boards. I don't. You sort of associate it with like building motorcycles or something like that. Using it with big pieces of metal. But it actually works pretty well to scrape off solder mass coatings. So I went to a place called TechShop, which is a fitness center for nerds or something. You try to use the machines, but there's a really, really cool idea. There's places all over the country. Different organizations do the same thing. I went over there and say, hey, I'm working on a project. Can I use your machine. I'm not a member. I don't want to sign up for a month to use your machine for an hour. Can I come in and stood around for a long time, and they're like, okay, come in. I gave the guy 20 bucks so he can go on his lunch break to do this stuff for me. It's amazing what you get when you ask nicely and hold money up. So this one, we had to be really careful because sandblasting is normally a very PSI, high rate of speed type of application, so the operator tried to kind of scale it back a little bit and be a little gentle on the board. We had some pretty massive failures, but once you got the technique right, you use the standard type of sandblasting machine. We were at a 60 grit aluminous oxide 80 PSI, and that's the standard. He had the best success 6 to 8 inches away shooting at an angle. This works really well with standard types of boards. We put an iPhone in it, and it got destroyed to shreds. It was way too fragile. The standard types of boards, even two‑layer boards with a thick substrate seem to work best. We got noticeable pitting in the copper, so technically, so there's no damage in the copper. For our purposes it stent matter as long as we get a good image of the layer, we can do post‑ processing and clean it up. They do also make things that are called micro abrasive blasting capsules, which are much smaller for fine detail on jewelry and things, and that probably would have been a better solution. I didn't know where to get one of those. This is fun. This is my favorite part. Making a mess. Oh, wait. Wrong conference. I mean, removing solder mask. So these chemicals, there's lots of different chemicals out there, and if you search the Internet, you have to use the sodium ethanol meth late to dip it in the thing and hold it under the heat lamp and the bunson burner. They say all this stuff, but I don't think people actually ever test the stuff except people that plow their fingers off. I was a little wary of stuff I read on the Internet, and I think I'm using chemicals designed for this type of thing. Luckily, there were chemicals that exist. There's two chemicals I looked at that were actually used by circuit board fabricators if they mess up the application of solder mass, there's a chemical to strip the solder mass off and they can redo the process. It sort of makes sense. I don't think I have to say how dangerous this stuff is, but it was really dangerous. I don't have a fume hood or anything, like proper OSHA compliance or anything. This was in my backyard. I went to Home Depot, and then I went on a shopping spree, to the Home Depot for supplies an electronic surplus stores for plies. I got a shopping free to buy all the stuff. I have a chemical mat, a mask, respirators, hot plates. It's not a stir plate. Kind of a magnet to stick it around or something. This was a hot plate I got on eBay, and then the chemicals and rocks to hold the thing down. This was in my backyard, and this particular house that I lived in was diagonal to a hotel. With all of the doors of the rooms facing down into my backyard, which I'm sure they loved it when I was in the hot tub, but this I think freaked them out a little bit because people are like, I'm having a nice vacation in San  Francisco. They look out and say, what is this guy doing dressed in a crazy suit? Oh, yeah, which is  ‑ ‑ yeah. There are actually was a black car outside of my house for two days when I was doing this work. I shit you not. Who cares. If Spartanburg sees all the stuff, I'm doing work for the government. I have a piece of paper that says it. They approved it. I'm allowed to do it. Nothing happened with it. So I wore the suit, and it was funny because with these chemicals you have to heat them up to a certain temperature because that helps with chemical reactions and all this crazy mask stuff. So I had this full chemical suit on. Who took the picture? It wasn't me. Yeah. So my wife took the picture. Yeah. You remember her when she was pregnant and called my phone in front of 8,000 people or something in DEF CON a few years ago. Yeah, she took the picture, and half the stuff was like heating up on the hot plate. She got really pissed because apparently it smells bad, but I didn't know that because I'm wearing a respirator. She took the picture and said why are you wearing the stuff and I'm not wearing it? She got super  ‑ ‑ I would swear if  ‑ ‑ I'm not going to swear, because I'm a nice person. But she was really angry and kind of going off like a trucker. So she ran out and shut the door and stuff so the smell wouldn't come in the house. The fumes actually went into the house. Next time if I do this I'll do it further away from the house or just buy her a respirator. So yeah, this is  ‑ ‑ that was fun. I was really freaked out. I don't normally deal with chemicals that much when I etched circuit boards. Someone else etched the circuit boards, but did you dump the chemicals down the drain? (  Inaudible response  ) >> Yeah, chemicals, I don't know. They're very effective, as you see, but also just really freaky. So it turns out both of these chemicals I used. One is a U.S. company, and neither of them attack the actual substrate, which is good for solder mask removal but not if you trying to delaminate the board. When you put the circuit board into the heated chemical, it just starts flaking off, which is really neat. The time depends on the temperature and the thickness of the solder mask and things like that, but the result is super awesome. Full copper exposed and no abrasion or anything like that. Really, really well‑ done. Then lasers. Lasers. Who here has a laser? Yeah. A lot of people, right? They're not uncommon anymore like a laser cut other something in the hacker space. The one I use is a gigantic one, but it's no different than - I don't think it's much different than the ones you have in hacker spaces where you're doing laser engraving on your iPhones or something. So this one I went to a company in Milpitas. I wanted to use the laser and shoot it at circuit boards is see what happens. They said that's weird but sure. I went by. Places are willing to do interesting things, because for them I was talking to the operator, this is totally fun because we have no idea what's going to happen, and it's way better than like  ‑ ‑ way better than what we do day in and day out. For them it was something fun. It happened almost every place I went. It was kind of fun for the operators because they didn't know what to expect. In this case, who knows. I was worried we would set the place on fire or something. (  Inaudible comment  ) >> All these guys are wearing. I guess this is like a  ‑ ‑ this is like a Defcon tradition. Thank you, guys. I love you so much for that. Thank you. I actually told them before the talk, nothing is going to throw me off, not even a giant dong. You said you weren't coming on stage. You broke the rule. Take your mustache down. Okay. Where were we? Come on. Take that out of here. Okay. So the lasers are for cutting material like flex circuit boards, the cover layer is for doing, say, like stencils or solder stencils for circuit board. We were just trying to see, like, could we shine the laser, and would it get through solder mask. I went to use them to see if we can get to inner layers, which I'll explain later on. That doesn't really work. But in this case it did. Like we just had a single pass of the laser at medium power. I don't know what that means, because he told me there was low, medium and high. Let's just start with medium and see what happens. So we did one at medium power, and it worked. The more you do it at medium power or if you had high power, the more energy you're shining at the board, eventually you destroy the board. In our case if the single pass is fine, we remove the substrate and very little damage to the copper or to the substrate underneath. The one on the left is from my test board and one is from annual iPhone board. This is interesting, because this connector that we've exposed is traditionally under solder mask. If I look at a board and see something like that, a connector under solder mask, I would say, okay, that's probably like a programming interface or some connector used during development or some test points the engineer wanted during development. They cover over with solder mask after. We use that as a clue for it. Let's get access to that. It took about 30 minutes to set up the machine. I don't know. We were waiting 30 seconds or a minute to do the passes to expose the solder mask. If you wanted to do a full board for that, it will take a while to do that. Manual methods seem to work better than the high tech ones. I tried to use a knife to run the solder mask away. There's mechanical abrasion type of things, and other chemicals not from the Internet but things that I talked to people about. Different types of heat. Because on the Internet someone is like, if you use a heat gun and heat the solder mask, it's going to melt. The thing with solder mask is if it's properly designed, it's meant to withstand a lot of heat. So it did its job. So these are sort of some of the failures. So the next set is delayering. This is where things get more interesting, because we look at the inner layers itself. So kind of a manual method and we have different mechanical stuff. This is where I started to learn a lot about the process as you'll see. So, again, sandpaper is very effective, low‑ cost method. I just took the board, double‑ side taped it to the work surface. As opposed to the solder mask, which if you use sandpaper it comes off fast in a few minutes maybe. When you delayer an entire layer of substrate that could possibly be 40, 50, 60 thousandths thick, it will take a toll. I don't care how strong you are. It's going to hurt. Going to get sweaty. I know a lot of people don't like. Instead of just using handheld sandpaper, you could use a sanding tool. On the left I have a sands stone, which is a 60 or 80‑ grit stone with a better grip on it. I have a Norton sheet Sander tool, which you attach it to this thing and go back and forth. It takes a while. Here's a little video of it. Time lapse, of course. So I'm taking the stone and trying to get the top copper layer off. We'll have the substrate, and then I have to work on the next layer. So first the sanding stone, try to use that and sort of works. We have the sheet Sander tool and little by little it comes off. With the solder mask removal you have to be careful with the edges of the board. If you don't sand straight back and forth you have the wear along the edges. I show the result. It looked like it happened really fast. That was 20 minutes and I was drenched at the end. Here's the result. We had a little bit of scratching of the inner layer and a little bit of wear around the edge, but we have basically the second layer of that four‑ layer board. So pretty cool, I think. So I had the second layer exposed and I was like all right we have the three layers. I'm not that good with mechanical things like tools or anything like that that has moving parts, so I had a lot of failures with the Dremel tools. I damaged a lot of stuff along the way. This flap wheel, 120‑ grit flat wheel worked well. You get through that substrate a lot faster than manually using a sheet sanding tool. I don't have a video of it, because you know what it looks like when it works. Here's the result. This is layer three. I heard someone laughing. There's something wrong with this picture, isn't there? There's a whole corner much circuit board missing. I mentioned that. I'm not very good with this. We works this, but it works fine. It's really hard to control the Dremel tool. When I did that, I was like wait a second. I do this mechanical abrasion, and you'll use this machine to automate the process. That took me nine minutes, by the way, with the Dremel tool. I had a CMC Miling in my office next door to make circuit boards because circuit boards are awesome and you need to make them all the time, I think. This is a T-Tech quick circuit 5000 and it's basically just a really accurate CMC. Did I use a special one designed for specifically cutting fiberglass types of material. So there's a setup. I have my computer running the whole show and the milling machine myself. Fist I started with the known reference board, the six‑ layer board because I knew how much I could increment each layer before I would get access to the next layer. I knew the thickness, so I used the machine to kind of route it manually control the machine and adjusted the access for the depth to come down and kind of move the milling machine back and forth. With this particular board you can't see the left image at all or the right one, really. But the left one has a bunch of numbers for the different layers, so layers 1 through VI all numbered. I went and exposed the numbers so I could prove I can access layers 1 through 6. That was no problem. That was sort of, you know, a board with very thick inner layer spacings, so it's sort of like cheating. I did it with the iPhone, and I tint want to manually control it, because I wanted a precise outline I was working in. So I created that inside the tool and adjusted the z access in 1 mill increments. I run the rub‑ out of this particular rectangle and adjust it and keep running it again and keep running it until you got  ‑ ‑ this is so funny. You're dirty. So I keep doing the operation until I could almost see the copper, and then I would use a fiberglass scratch brush to do that really fine removal of the substrate. There's a little video. Just doing a little bit. I don't know how long this will last, but it's like taking off a super thin layer of that substrate. I did that for a few hours until I got it right. It actually worked, so I could see inner layers of that ten‑ layer iPhone board, which is seriously complex. If you do that across multiple sections, you can reverse engineer the entire board. If you can do it on something this complicated with that technique, you can pretty much do it on any board authorized. So last one of delayering is surface grinding, this is another one where I do the Dremel tool and the surface grinders grind down surfaces to create nice surfaces and to do all sorts of crazy metal work. We have this rotating wheel on our rotary table, and the table moves around and the wheel stays where it is. It's just a very, very cool thing, but gigantic. So on the left is a typical surface grinding machine. I went to a place in Oakland, and this is like a straight‑ up metal shop. I don't think they deal with computer people, tech people very often. I called them and said I want to grind down some circuit boards. They're like, yeah, I don't know about that. I was begging. I heard that surface grinding would be awesome, and the one guy I know in San  Francisco that had a surface grinder didn't want to do it. He's like, try these guys. Try General Grinding. It was amazing. We did it like after hours in 8:00 p.m. in the worth neighborhood in Oakland where they escorted me to my car after the work was done, which was awesome. I can't defend myself. At least in that neighborhood. So what we did is we had this metal block, and the surface grinders have a magnetic chuck. So you mount what you're working with, and usually it's metal. So it goes not this magnetic chuck. You can work with it. The circuit board is nonferrous, and we put it onto a block and it would hold it in place. My machine had give or take maybe half a million,  .1 mill. give or take, half a mill. A machine like that size is way more accurate. Here's a process with a little dressing of the wheel. It just comes down and just grinds the board. It does this whole process, and it takes like a 45 second process or so, and it doesn't look like it's doing much, but it's shaving a really thin layer of the board. You do it over and over again as we got down, and what you can do is if you already know the interlayer board thickness and do a cross‑ section first and look at the side with a magnifying glass, then you can set it in the machine and you can automatically do it to that point where you need it. What we found is that the surface finish created by doing this was so smooth you didn't have to get to the layer itself. You could  ‑ ‑ as long as you see it through the substrate, it would polish is so mush you can see the layer through it. This is pretty cool, and a bunch of failures and heat and laser doesn't work in this case for delayering because laser energy affects materials differently. So if you're trying to cut through a layer of substrate, that's going to work differently than a lay of copper. If you don't know how the substrate and copper they're laid out on the board, you have a big mess. So for imaging here we have x‑ray, 2D and 3D. Everybody here probably had an x‑ray or knows somebody that does. What you probably don't know where to get access to an x‑ ray on your own. They're used a lot for failure analysis of circuit boards and of components on SISH circuit boards. GUK to a contract manufacturer and say, hey, can I use your x‑ ray machine? They'll say sure. That's what I did. X‑ rays shining through it, and then the object is absorbing radiation and you'll be able to to see the results. We only see a composite image, not individual layers in this case. Here's what the machine looks like. Here's a veriphone pin pad from a pin pad division with the active circuit board shield on top of the circuitry. The 2D x‑ ray isn't that great because you don't know which layer things are on. We can use it to get a general sense of what's going on. In this case this active shield had like four layers of basically a maze of copper we had to figure out how to defeat that to get access underneath. If you have a simple board, you can adjust the field of view and angle of the x‑ ray to trace it out. It gets very hard. They're that four‑ layer board. So it's already for certain things, but this is a real money shot right here, x‑ ray. This blew my mind. This is the best part of the whole research. CAT scans where you go in that machine and it spins around and you get slices of your body parts or whatever, you can do that with circuit boards, too. Just like there's manufacturers that have the normal x‑ray machine, a lot have the 3D x‑ ray machine. You basically take a number of 2D images at different angles around the object and mathematically processing that down into slices. Here's a VGA solder ball with a defect in it. Normally these companies look at small objects or small defects, so I went in and actually called the company, which is recommended by SonicManufacturing, the manufacturing that does it's a 2D x‑ ray, and I called the CEO and it turns out he was in Germany for a conference. So it was like 5:00 p.m. my time and 3:00 a.m. his time or something like that. As soon as I heard the ring tone change from the U.S. to the European, I was like, oh, crap. He answered phone at 3:00 in the morning. I woke him up, which is not a good way to start a relationship. He was just more than willing to help. He's like, sure, I get back tomorrow. Let's set a date and let's do it. I've never done it, and let's try it. It was totally awesome and a big surprise for everybody there. So we took 360 different images of that board, that four‑layer board, and then once we got ought all of that data we loaded it into a manipulation program for 3D manipulation and moved through each layer and we could manually creates a bunch of JPEGs so we could hit a key and look through each layer. I don't remember the actual layer or slice thickness, but it was totally amazing. The results vary based on how many layers you have, the inner layer of thickness and what other materials are used because some high end boards use very complex materials. Here's the result of this CAT scan on our board. So we're slowing going through each layer. Layer one is about to come up. Let's see. There it is. There's layer 1, and then layer 2 comes up. There's layer 2. We go through the middle of the board, the middle substrate, which is thicker than the others. Layer 3Coms up fast. There's 3, and there's 4. So now nondestructively we can see through the entire circuit board without doing anything, which is awesome. Here's another view of it. So you'll notice  ‑ ‑ thanks. It wasn't my machine, but thanks anyway. So you notice the field of view is small, so if you do it across a larger board, you have to do it multiple times. It took half an hour to get this done so totally awesome. We had failures doing acoustic microscopy that didn't work at all. In the paper released next week and in the presentation, I broke this down into a characterization. Depending on how much time and money you have, likelihood of success, how much you want to risk your life, you can look at the techniques and figure out which is good for which of your situations. I like the manual methods because it's a quick and dirty thing. The x‑ray was totally awesome, too. Next steps. There are some other methods that people told me about for delayering using the key tones to actually strip the inner layer adhesive, drum Sander which is like a surface grinder. What I want to do and started to work on is a tool to take all of the layer images I have gotten through the various techniques and start a process to kind of automatically or assist in reverse engineering those back into something meaningful. Take the layers and do image processing and figure out connections and possibly turn that into schematics. Maybe by next year I have something to show on that. It's a great opportunity for me because it's a lot of software and I'm not much of a software guy so I have to learn Python and stuff. It's like D‑gate, which is a tool for pattern recognition of silicone, and then Ron par, which is major malfunction tool does recognition as well. Those are chip level. I want to do something board level and super cool. There's the link with all the materials, but just go to my website and find it. There we go. The end. Thanks for coming. (  Applause  )