Understanding the organization of memory is a mandatory first step in various fields of applications such as failure analysis, defect localization, qualification and testing of space electronics, and security evaluation. For the last category, localization of specific addresses may be used for content estimation or encryption key recovery, with several techniques being reported for this task. In this paper, we discuss the application of laser probing for descrambling memory embedded in 8 bits microcontrollers designed and manufactured by different companies in various technology nodes.

A new data retrieval approach utilizing selective staining is explored to differentiate "0" from "1" cells in EEPROM and Flash memory cells with node size of 40 nm and 250 nm. A two-step staining process based on selective oxide etching and copper galvanic displacement deposition is introduced. The underlying mechanism is attributed to the difference in electric field across the tunnel oxide, which originates from the presence or absence of charges stored in the floating gates. With proper sample preparation, the selectively stained and non-stained cells can be characterized with optical microscopy and scanning electron microscopy, to facilitate direct read-out of data in a timeefficient manner. The physical layout of individual memory cells with respect to the stored data is identified. A systematic data retrieval is achieved with an accuracy of 95% at individual bit level. This selective staining technique marks the data permanently on the chip that allows for subsequent analysis and evidence retention.

No abstract

By exposing floating gates of EEPROM memory cells with frontside sample preparation, scanning nonlinear dielectric microscopy (SNDM) succeeded in reading back the data stored in the memory cells with a 250 nm node size. At an optimized voltage bias of AC = 3 V and DC = 1 V, a clear signal contrast between programmed and erased cells is obtained. The high resolution SNDM signal reveals the details of bowling-pin shape structure of memory cells, providing high confidence in data assignment during forensic applications. Such high resolution also makes SNDM a promising technique for newer generation devices with smaller node size.

Nowadays, non-volatile memory (NVM) devices are extensively used for information storage in artificial intelligence, communication, transportation, mobile and many other applications. With their intended use in these applications, it is important to evaluate the security of stored data in these devices against extraction or modification. Hardware security analysis includes physical attacks and software attacks. Prior studies have been conducted on NVMs such as Flash and EEPROM devices using Atomic Force Microscopy (AFM) based techniques. AFM is a versatile tool that can measure different material properties along with topography and morphology information. This makes it suitable for the investigation on the emerging NVMs such as magnetic random-access memory (MRAM), ferroelectric random-access memory (FeRAM), phase-change memory (PCM), and resistive random-access memory (RRAM) in the market.In this study, RRAM and MRAM devices that are available in the market will first be analyzed through the use of failure analysis techniques such as chemical deprocessing, Xray imaging and scanning electron microscopy (SEM) with focused ion beam (FIB) to understand its device architecture. Next, deprocessing steps such as chemical etching and reactive ion etching will be developed to access the data storage layer of the RRAM/MRAM where the devices store their data depending on the resistance state, which corresponds to the binary bit of '1' or '0'. Then, the AFM technique such as conductive probe AFM (CP-AFM), using a constant dc bias, will be used to scan across the sample's surface and directly probe on the data storage layer to measure the current and thus its resistance. The collected results from the current scans will be validated with the input data in order to assess the accuracy of the technique. Precaution measures adopted to prevent the loss of data during the sample preparation process will also be discussed. The first ever successful readout of data in RRAM samples using CP-AFM has been achieved and block level data organization of the memory is also presented in this study, thus demonstrating the vulnerability of RRAM devices to security attacks, and potentially MRAM technology as well.