The CM8870 is an integrated circuit chip manufactured by Philips Semiconductors. It contains a touch decoder that interprets x-y coordinates from a touch screen panel. Cracking this IC means deciphering its functionality and replicating it. Here is a step-by-step guide on how to crack the CM8870 IC.
Gather Required Tools and Equipment
To crack the CM8870 IC, you will need the following tools:
- Soldering iron and solder
- Multimeter
- Oscilloscope
- IC sockets
- Breadboard
- Jumper wires
- PC with USB interface
It is also recommended to have basic electronic skills and knowledge of circuits and soldering.
De-cap the IC
The first step is to carefully remove the plastic encapsulation from the IC chip. This process is known as decapsulation or de-capping. It will expose the silicon die inside the IC package. There are a few methods to de-cap ICs:
- Mechanical abrasion – Removing the packaging using sandpaper or a knife. Risks damaging the silicon.
- Chemical dissolution – Immersing the IC in acids like nitric acid to dissolve the packaging. Needs safety equipment.
- Thermal shock – Alternately heating to brittleness and rapid cooling. Works for plastic packaged ICs.
Take precautions not to damage the tiny structures and wire bonds on the extracted silicon die.
Analyze the Die Structures
Once the IC die is exposed, analyze it under a microscope to identify key functional blocks and structures. Look for:
- Rectangular functional blocks
- Wires connecting blocks
- Markings from manufacturing process
Also use magnification, staining, and chemical etching if needed to reveal more details.
Die Analysis of CM8870
The CM8870 die contains these key blocks:
| Block | Purpose |
|---|---|
| Analog frontend | Touch detection and A/D conversion |
| Microcontroller | Coordinate calculation and processing |
| Memory | Program and data storage |
| I/O control | Interface to external system |
Determine Pinouts
Identify the function of each pin on the IC package using the exposed die and datasheet. Use multimeter probes to trace connections from each die block to the pin pads.
For CM8870, important pins include:
- VDD and VSS for power supply
- XI and XO for external crystal
- Y+ and Y- for touch signals
- I/O ports for digital signals
Tabulate the pinouts for reference.
Replicate Functionality
After analyzing the IC, the next step is to replicate its functionality with basic electronic components.
For CM8870, this may involve:
- Op amps to detect and amplify touch signals
- ADC and microcontroller for coordinate calculation
- Memory chips to store program instructions
- Discrete logic gates for I/O control
Build the circuity on a breadboard and verify it works before creating your own PCB.
Testing and Applications
Once the IC functionality has been cracked and replicated, test it thoroughly across different conditions. Try different touch screens, power supplies, controller interfaces etc.
The replicated IC can then be used in place of CM8870 in touch screen designs. It can help repair devices or build new ones without requiring the original ICs.
Some applications include:
- Touchscreen kiosks and displays
- Tablets and handheld devices
- Industrial touchscreen HMIs
- Arcade machines
Frequently Asked Questions
Here are some common questions about cracking the CM8870 IC:
Q: Is reverse engineering ICs legal?
A: Laws vary by country. In some cases, reverse engineering chips for research or repair purposes is allowed under fair use exemptions. But duplicated commercial use may violate copyrights. Seek legal counsel before proceeding.
Q: How long does it take to crack an IC?
A: It depends on the complexity, but simple ICs like CM8870 may be cracked in a few days by an experienced engineer. More complex ICs with billions of transistor could take weeks or months.
Q: Does cracking an IC require expensive equipment?
A: Basic tools like multimeters and microscopes are accessible to hobbyists. But advanced techniques like SEM, FIB, AES need expensive setups costing over $100k.
Q: Can the original IC design files be recovered?
A: Reverse engineering can only recover a logical representation of the chip components and connectivity. The original HDL or GDSII layout files remain proprietary.
Q: What are the alternatives to cracking ICs?
A: Emulation using FPGAs, simulating the IC, finding drop-in replacement ICs, or seeking manufacturer datasheets. But cracking provides most insight.
