PCB Reverse Engineering: Three Layers, and the Line Between Them

A circuit board can be reverse engineered at three levels, and they are not equally accessible. The connection layer — what is joined to what — can be recovered almost completely with a photograph and patience. The geometric layer — thicknesses, registration, copper weight — needs a cross-section and an instrument. The material layer — Dk, Df, filler content, plating composition — needs a laboratory, and even then some numbers are only bounded rather than measured. Most disappointments in this work come from treating the second and third layers as if they followed from the first.

The word covers work that ranges from a photograph of a two-layer board to a laboratory programme on an eight-layer RF stack. Separating the layers is what makes a quotation, a schedule and an accuracy claim meaningful.

The accuracies in the fourth column are the useful part of a quotation. A netlist recovered at the connection layer is either right or wrong and can be verified by continuity; a Dk recovered at the material layer is a measurement with a confidence interval, and a design rebuilt on it inherits that interval.

For an outer layer the work is straightforward: the copper is visible, the components are marked, and the netlist follows. Three complications make it slower than it looks.

Solder mask and finish obscure the copper. A black or white mask over bare copper gives almost no contrast on a photograph, and a HASL finish leaves a surface that reflects unevenly. Stripping the mask is often faster than imaging through it, but stripping destroys the board, so the imaging has to be complete first.

Inner layers require destruction. The usual technique is sequential milling: remove a layer, image, repeat. Each step removes 50–100 µm and the registration has to be re-established each time, which is where a 0.05 mm error per layer starts to matter on an eight-layer board. X-ray CT avoids the destruction but resolves features down to roughly 5–20 µm voxel size, so a 0.1 mm trace is visible and a 0.05 mm one is a judgement call.

A netlist is not a schematic. What comes back is a set of connections; the function has to be inferred from the parts. That inference is where the real time goes on an analogue or RF board, because two networks that are electrically identical can have entirely different intent — a matching network and a bias decoupling network look the same in copper and behave differently under power.

Even a perfect netlist is not a manufacturable drawing, because the board is defined as much by what is between the copper as by the copper itself. The geometric layer is where most rebuilds fail, and it is recovered from a cross-section rather than from an image.

Two of these are systematically underestimated. The surface finish is a thickness measurement with an electrical consequence, and a board rebuilt with ENIG where the original had immersion silver will measure 0.1–0.15 dB/in more loss at 10 GHz; the finish is part of the electrical design, not a cosmetic detail, which is why it has its own set of windows in the surface treatment processes in PCB manufacturing. And registration is a tolerance that cannot be recovered from the finished part at all: you can measure where the layers ended up, never what the fabricator was capable of, so a rebuild that copies the result may not be reproducible at the same yield.

Once the geometric layer is known, it has to be re-expressed as a stack drawing before anything can be quoted, which is the same exercise as producing a stack-up from scratch — the considerations for that are in high frequency PCB stack-up design.

The material layer is where the original article is silent, and where most of the technical value of the exercise sits for a high-frequency board. Knowing the netlist of a 10 GHz board without knowing its Dk and Df gives a rebuild that works at 1 GHz.

The Dk measurement deserves a warning because it is the number that most rebuilds rely on and the number most often misread. A resonator gives the value at one frequency; the material’s Dk varies with frequency, and the datasheet number is usually quoted at 10 GHz for RF laminates and at 1 MHz for FR-4. Using the 1 MHz figure to design a 5 GHz trace overstates Dk and produces a line that is too narrow. And a measured Dk identifies a material family, not a part number: several 3.4–3.5 products exist across suppliers, with different Df, different CTE and different thermal conductivity, so the rebuild should be treated as a material selection rather than a substitution.

Being explicit about the limits is what separates a professional scope from a promise.

1. Firmware and configuration. A microcontroller’s contents are not in its package exterior; where the device is protected this is not an engineering question at all. 2. The original tolerances. The finished board shows what happened, not what was specified, so a rebuild copies any drift that existed. 3. Copper foil roughness. The profile that dominated conductor loss was set by the foil supplier and is buried at the resin interface; a cross-section can show that it is low-profile but not its Rz value. 4. Process history. Whether the board was baked, how many reflows it survived, and how long it was stored are gone — which matters because the plated barrels on a board with 5880-class Z-axis expansion have a finite number of excursions available. 5. The design intent behind an unusual choice. A stub, a gap or a strange pour may be a mistake that was measured and accepted, or a deliberate tuning element; the netlist cannot tell you which.

The fourth limit is worth a number. Over a 215 °C span, 1.6 mm of a PTFE laminate with a Z-axis CTE of 237 ppm/°C expands by about 82 µm, against 11 µm for a hydrocarbon material at 32 ppm/°C. A board that has been through an unknown number of thermal cycles has spent part of its barrel ductility, and the rebuild should not assume the original had the same remaining life. The metallurgical basis is in inner layer circuit fabrication.

The original article placed product replication first and discussed security analysis as a side benefit. That ordering is both commercially unrealistic and the reason reverse engineering has a reputation problem. In practice the work is commissioned for four reasons, and only one of them involves making the same product again.

What the work is not is a licence. Copying a board is a legal question before it is an engineering one: patents, registered designs, copyright in layout data and contractual restrictions can each apply, and the answer differs by jurisdiction and by purpose. Two things follow for anyone commissioning this work. First, the client’s right to the design is the first thing to establish, and it is a question for the client’s own counsel rather than for the fabricator. Second, a rebuild that reproduces a protected layout is a different act from one that re-implements the function on a newly designed board — and for a high-frequency board the second is usually better engineering anyway, because it lets the stack be chosen for currently available material rather than for whatever was on the market when the original was built.

The most common commercial use of these techniques has nothing to do with copying. A board that fails in the field is a physical object with a history, and the same cross-section, X-ray and material identification answer a different question: why.

The sequence is usually four steps. Non-destructive first: X-ray or CT for voiding, barrel cracking and component alignment, plus a check of the as-built impedance if coupons exist. Then electrical localisation — time-domain reflectometry to find the discontinuity by distance, which with a 35 ps edge resolves to about 3.1 mm. Then destructive cross-section at the located site, which is where the mechanism becomes visible: pad cratering, barrel separation, intermetallic thickness, or a resin void under a via. Then material and surface analysis if the mechanism implicates the finish, which is where phosphorus content and nickel thickness decide whether the answer is black pad.

The reason this belongs in an article about reverse engineering is that the deliverable is the same shape: a measured stack, a recovered netlist and an identified material. Only the conclusion differs, and it is a conclusion about a failure rather than about a design to be rebuilt.

Effort scales faster than layer count, because each layer adds a milling or imaging step and a registration re-establishment. The figures below are engineering effort only, and they assume the board can be sacrificed; a board that must survive the work costs more because the imaging has to be non-destructive.

The pattern in the last column is that the risk is never the copper; it is the vertical structure. A board with a simple stack and a complex netlist is easy; a board with a simple netlist and a blind-buried stack is not, because every imaging step assumes the layers are where the drawing says and the drawing is what is missing.

The original text was accurate about the sequence of the work and misleading about its results.

Six items make the output usable rather than impressive:

1. A per-layer cross-section photograph with magnification calibrated, not a summary table. 2. Dielectric thickness and copper weight per layer, with the measurement uncertainty stated — ±2 µm is a different claim from ±10 µm. 3. The netlist delivered in a neutral format plus the imaging set, so the recovery can be audited rather than trusted. 4. For any RF board, a measured Dk and Df with the frequency and method named. 5. Surface finish identified by thickness and composition, since this is both a solderability and a loss parameter. 6. An explicit list of what was not recovered, because a scope with no exclusions has not been thought through.

The sixth item is the one that protects both parties, and it is the one most often missing from a proposal. It is also what allows the rebuild to be designed properly: knowing that the foil roughness is unknown means the loss budget must be verified on a coupon rather than asserted, which is the same discipline that any new design should follow and that is described in testing in high-frequency PCB production.

Reverse engineering a circuit board is three problems, not one. The connection layer can be recovered almost completely — outer layers by imaging, inner layers by sequential milling or CT at 5–20 µm resolution — and it is the layer that is easiest to verify and least likely to decide whether the rebuild works. The geometric layer needs a cross-section: thickness to ±2–5 µm, copper weight to ±3 µm, holes to ±0.01 mm, and a surface finish whose thickness is an electrical parameter worth 0.1–0.15 dB/in at 10 GHz. The material layer needs instruments: Dk to about ±0.02 and Df to about ±10 %, with the caveat that the value belongs to the frequency it was measured at and identifies a family rather than a part number.

What cannot be recovered is as important as what can: firmware, the original tolerances, foil roughness, the process history that has already spent part of the barrel ductility, and the intent behind any unusual geometry. And the ordering in the original article deserves reversing — the dominant use of the technique is legacy support and failure analysis, with replication a legal question before an engineering one.

XCE PCB works on the manufacturing end of that chain: rebuilding a stack from a measured cross-section, choosing currently available material to match a measured Dk, producing 2 to 72 layers to 600×1200 mm with impedance ±10 %, samples in as fast as 24 hours, inspected to IPC-A-600G and IPC-6015. Where the deliverable is a re-implementation rather than a copy, the drawing set that a fabricator needs in order to quote it is described in outputting high-frequency multilayer mixed-pressure PCB design files, and the panel-level cutting tolerances that the rebuilt stack inherits are in substrate cutting in high-frequency PCB manufacturing.