Not a product teardown
A teardown tells you which chips a device contains and how it is assembled. Reverse engineering tells you how one of those chips is designed internally. The two differ by several orders of magnitude in resolution.
IC Reverse Engineering Services
IC reverse engineering services — from physical silicon to a schematic you can read
Reverse engineering an IC is not photographing a die. It is taking a shipping part down through its metal layers, identifying every device and every net, and rebuilding it as a hierarchical schematic you can trace and cross-reference against the layout. CPS has been doing this since 2008, across more than 5,000 reports.
What IC reverse engineering actually is
The term gets used loosely. Here is what we mean by it.
IC reverse engineering recovers a chip’s circuit design from the physical part: the package is removed to expose the die, metal and dielectric layers are stripped one at a time, each layer is imaged at high resolution, transistors, resistors, capacitors and their interconnections are identified from those images, and the result is rebuilt as a hierarchical schematic and netlist. What you get back is the design itself, not its appearance.
Not failure analysis
Failure analysis answers “why did this part fail?” and works towards locating a defect. Reverse engineering starts from a working part and answers “how was this designed?”. The equipment overlaps; the question does not.
Not copying
CPS reports have never been about reproducing a chip. The same architecture often behaves quite differently in another product domain. Their value is that an engineer who has seen more real solutions makes better original judgements.
How it is physically done
Six stages, all in our own lab. Samples never leave the building.
- 01
Decapsulation
The package is removed to expose the die without damaging the topmost metal. Acid, laser and mechanical lid removal each need parameters tuned to the specific package — get this wrong and nothing downstream is recoverable.
- 02
Delayering
Metal layers are stripped one at a time from the top down. Each layer differs in material and thickness, so removal rates are adjusted layer by layer. CPS uses RIE and CMP; advanced nodes can run to more than ten metal layers.
- 03
Layer-by-layer imaging
Every layer is imaged as it is exposed, optically or by SEM depending on feature size. A large die takes thousands of frames stitched into one layer — and stitching error turns directly into wiring error further down.
- 04
Device identification and net annotation
Every transistor, resistor and capacitor is read out of the imagery, along with which layer each connection runs on. This stage decides whether the report is correct, and it is the one that rests most on experience.
- 05
Circuit extraction and partitioning
Flat connectivity is rebuilt into a schematic and partitioned by function — supply, bias, protection and output stages each become their own block. An unpartitioned schematic is a rat’s nest: visible, but not usable.
- 06
Double extraction and comparison
The same imagery is extracted independently by two teams and the results compared difference by difference. A quality team of senior engineers reviews every low-level block, with a final review once all blocks are complete.
What is delivered is a BrigenOne project, Cadence-compatible schematics and a hierarchical PDF — not a folder of image files.
What we can and cannot do
Stating the boundary up front is cheaper than explaining it later.
We can
- Circuit analysis of 3nm process devices — more than ten completed
- 3D NAND beyond 128 layers
- SiP packages containing ten dies
- Whole-die analysis, or a single critical functional block
- High-resolution layer-by-layer die imaging on its own, without circuit recovery
- Device identification and net annotation on their own, without a hierarchical schematic
Not included
- Circuit simulation. The delivered schematics are Cadence-compatible and can be converted to a netlist for your own simulation, but simulation itself is outside the service.
- Process recipes or material composition. Reverse engineering answers questions about circuit design, not process parameters.
- Mask reproduction or chip duplication in any form.
- Firmware or software reverse engineering. CPS works on physical circuits, not code.
If you are not sure which of these your question falls under, sending a sample for evaluation is the fastest way to find out — and the evaluation fee is credited against the full analysis.
Where we draw the line
This section describes how CPS operates. It is not legal advice — rules differ by jurisdiction and we do not assess legality on a customer’s behalf.
Reports are for design study and competitive analysis: understanding how a proven design solved a problem, as input to architecture choices, process decisions and technology roadmaps. Patent law firms also use them as the factual technical basis underpinning their work.
We do not disclose who is reading a report. Who commissioned it, which device they asked about, and when — we do not tell anyone. That line has held for eighteen years and it has nothing to do with which licensing model a customer chooses.
The licensing models differ in one thing only: whether the report is ever supplied to anyone else. Non-exclusive costs a third of the price and may later appear in the public library; exclusive costs three times as much and is never resold.
How a commissioning party uses a report is their responsibility. What CPS supplies is technical fact.
748 completed analyses you can look at right now
You do not have to take our word for it. Look at the work.
The public library holds 748 analysed devices across 205 manufacturers and 25 device categories, searchable by part number, manufacturer, device type or analysis depth. These are commissions that have completed their commercial purpose and may be supplied to others; exclusive commissions are never resold and so never appear here.
Search the library →Start with a single sample
Send us a part number, or ship us a sample. We evaluate it first, so you know the cost and the schedule before you commit.