I love looking inside chips, and Flylogic takes some of the sweetest chip shots. bushing sent me some Wii chips to play with a few weeks ago, and Chris at Flylogic expertly decap’d and imaged them for me. I thought they were pretty neat, so here’s a couple of them to share with you:
The chip above is the Macronix mask ROM part inside the Wii. It also has some SRAM and a real time clock on-die. The large block on the left is the mask ROM, and the smaller block on the right is the SRAM. The top right has a fairly regular arrays of flip-flop like logic structures, so those are probably command or address registers for the chip.
The chip above is the serial EEPROM chip that’s flip-mounted onto the Hollywood package. The Hollywood GPU on the Wii actually consists of three silicon chips on a single substrate, as the image below shows. The serial EEPROM is indicated by the pink arrow.
The bond pads still have the flip-mounting bumps on them, so they show up as large black circles in the photo. Flylogic later removed the bumps using a neat hack with their wirebonder, and then rebonded the die into an 8-pin DIP so the contents could be read out with a conventional ROM burner. I found it particularly enlightening to see the ratio of logic versus the size of the actual memory array for the serial EEPROM (the memory array is the regular set of cells in the top-right corner). Essentially, at this capacity scale (2048 bits), you’re paying for a bunch of logic, and not much memory. Doubling the memory capacity would minimally impact the overall die size, since most of what’s on there looks to be flip flops for shift registers and command latches.
I’m slightly disappointed not to see a little Mario easter egg in there…
I want to see what the accelerometers look like! can those be effectively imaged?
Jered: Have a look at the Chipworks blog; they have shots of the Wii accelerometer (STM LIS3L02AE).
Thanks Mouser!! great find…
They do look really cool on the inside, so I may just decap one anyways so I can look at it under a higher-power microscope and get high-rez photos of it.
Hi Bunnie,
Great photos! You might be interested in this story from EETimes:
http://www.embedded.com/underthehood/206504319
Apparently IC startups are now “hiding” their chips in the packages of more established companies in order to build market share. I don’t think it explains the octal buffer you found hiding in a smart card controller a few months ago, but it’ll certainly make “Name That Ware” a bit more challenging if you can’t trust the labels anymore.
[…] Wii chipshots! – Link. […]
[…] Wii chipshots! – [Link] […]
Hi Bunne, Mouser and Jared,
I have imaged some of the ADXL series accelerometers from Analog Devices some time ago. I know that the nunchuck uses a ST device, however, I think the wiimote has something from Analog.
http://microblog.routed.net/2007/04/20/ic-friday-analog-devices-adxl311/
http://microblog.routed.net/2007/04/13/ic-friday-analog-devices-adxl202/
http://microblog.routed.net/2007/04/06/ic-friday-analog-devices-adxl150/
Does anyone know how much ROM and SRAM is on the chip and what the die size is?
Preved dyatlam!
SHITSHITSHITSHITSHITSHITSHITSHIT
Nice images, but do you have any of the actually fun chips? I mean, few people go YAY for images of stock memory chips…
The actual cpu cores would be much more useful.
[…] Hollywood SEEPROM: Â After meeting him at 24c3, bunnie was kind enough to decap some chips for me, including a Hollywood. One of those chips is 2kbit serial EEPROM, which stores the MS signature on the the ECC key. […]
[…] Root: This is the “grand master key”, which signs the CA key. ECC keys: The Wii uses Elliptic Curve Cryptography in a few select places — primarily, it uses this when it signs savegames before writing them to SD card. ECC is used in ways similar to RSA, but it’s somewhat newer and much faster to run on an embedded system. Other: For lack of a better place to put it, there is also an HMAC key — a 20-byte value that is used in a SHA1-based HMAC of the NAND flash contents to prevent them from being tampered with. This is a commonly used scheme in embedded systems, where a device wants to “sign” something itself, for itself. There are no public vs private keys here — you need to know this value in order to verify the hash, and you need the same value to generate the hash. This isn’t appropriate for communications between two people, but is perfectly fine for letting the Wii test to see if the chip was pulled, rewritten, and resoldered. Key storage: The public keys are stored in various places — these aren’t sensitive, so they don’t really need to be concealed (although at least one of them needs to be protected from modification, and it can then sign the others). The rest are stored in two places:Hollywood SEEPROM: After meeting him at 24c3, bunnie was kind enough to decap some chips for me, including a Hollywood. One of those chips is 2kbit serial EEPROM, which stores the MS signature on the the ECC key. […]
wow these look cool, but unfortunatly i can’t truly appreciate them as i only have one year woth of electronic products and havn’t even see inside a PIC chip :(
[…] There are two places inside the Hollywood package that contain programmable bits — a bank of OTP memory (One-Time Programmable, AKA fuses), and a serial EEPROM (which is actually reprogrammable). […]
Black Friday…
George Washington had a vision for this country. Was it three days of uninterrupted shopping? -John Melvoin :o) Happy Holidays!…
hi, i’d like to know what’s the problem with Korean Wii. and my Wii serial code starts with L KM whats that, please respond my quest…
I was looking for car related articles this was great