So, welcome to the 410 talk for the speaker workshops, and we're going to get started, and we're going to talk about POSHA by Michael Generakis and Keith Lee from Spider Lab, twice for you. Thank you. There we go. Okay, so just to introduce ourselves, so my name is Michael Generakis, I'm the director for Spider Labs APAC, and Keith is the Sydney Consultant in the Spider Labs APAC group, so I'm from Australia, Keith's from Singapore. So the motivation for the POSHA tool is, as pen testers, we do a number of internal network pen tests as part of our day today. There are a bunch of awesome tools and techniques for capturing and cracking credentials, for example, Responder, and we really wanted to fill the gap from, you know, once we've got a low privileged account, even perhaps, you know, the client will give you a low privileged account to start with, we really wanted to fill that gap between having a low privileged account and getting to a high privileged account in terms of the tooling. And also help with a few common issues that we came across as pen testers on our day today. So we developed a tool called POSHA to help with this. We developed POSHA because we found similar tools had a number of issues, so apart from the fact that they're all sort of disparate, you've got a number of PowerShell scripts and different tools that you use that don't really sort of sync together, and we're finding that a lot of the tools had limited support and success on more recent versions of Windows. They were not as effective against systems that have implemented common hardening techniques, so we had to sort of figure out ways to bypass that and then run what we needed to run. And we wanted a single but also modular tool to cover the techniques rather than having multiple tools. So POSHA aims to automate a number of the techniques that we commonly perform on an internal test after we've got a low privileged account. So things like privileged escalation, lateral movement, and also a bunch of convenience modules that we typically would like to use. Just as an aside on the name, so POSHA is actually a type of jumping spider that feeds on other spiders. They're known for being very intelligent and have good problem-solving capabilities, so we thought that was a, you know, being from spider labs, we thought that was a pretty cool name, so that's where it is. So this is a basic workflow for our purposes for demos. On the right, you can see a basic network that we've set up for demonstration purposes. It's got domain controller, a couple of hosts, and the hacker. So this is the basic workflow of POSHA. I'll dive into each of the individual items in more detail on how it works. But just to give you a bit of an overview, we've got our credentials, right? It checks the credentials, makes sure they're valid, and they work. It enumerates a list of users in the domain admin group. It checks if the account is part of the domain admin group because, you know, you might get lucky, you never know. It checks this file for stored credentials. It syncs the time with the domain controller and attempts to exploit MS-14068. If it's vulnerable, if not, it goes down and checks MS-08, 067, MS-1710. It checks which host the account has admin access on. It checks for impersonation tokens belonging to the domain admin group. If you don't get lucky with that, well, if you do get lucky with that, it adds the impersonation token to the domain admin group. And then you can run Mimikats on the DC. If not, it runs Mimikats locally and you get some hashes. And then if we get any new hashes or passwords, we test those credentials and we start again. So the whole idea is that it's iterative. We work through it. And then every time we get a new password, we start the process again. Every time we get access to a new host, we start the process again. And we will just continually work through this sort of basic workflow until all the passwords or hashes have been exhausted or all of the hosts have been compromised. And then we can continue with some of the post-exploitation modules we have. Another thing that we added recently is it's not just an automated sort of click and go tool. You can run any of these individual modules directly or combine them. So we want to tab that flexibility as well. So we start with the low-hanging fruit. So credentials may be sought in group policy preferences. So there are a number of locations where you might find credentials. So drive maps, local users and groups, schedule tasks, et cetera. So when you create a new group policy preference, an XML file is created in SysFile, which contains all the relevant configuration information, and you may get passwords in there as well. And any authenticated domain account can access that, so you don't need elevated privileges for that. And passwords are encrypted using a known 32-byte AES key. I say known because Microsoft published it on MSDN, presumably inadvertently, been there for years. So, yeah, we can decrypt them. But of course, once this came out, it's a pretty big fail. So Microsoft patched it in MS-14025. And so the result of that patch is you can't create new group policy preferences that rely on saved passwords. But it doesn't remove the old passwords, right? So how many clients and organizations do you know, they're just patching things, sometimes wrote a new patch where you apply it, but they're not really understanding what's going on in the patch. They don't know what it's fixing, and they don't know that they need to go back and clear out those passwords. So we still see it all the time on tests where they still have old, insecure passwords that we can decrypt using that key. Then we check for MS-14068. So basically, it's a privilege escalation, vulnerability that allows you to elevate your privileges to domain admin. So basically, you can create a fake pack claiming that your regular user that you have access to is a member of the domain administrators group, and then elevate your privileges that way. If that's not successful, we do try the classics, right? MS-08, 067, it's an old one. It's mostly patched, but you never know your luck, right? So it's easy one to do, and so we check for that. The more recent one, thanks to Shadowbrokers and the NSA, allegedly, we have MS-1710, and that's the SMB floor that can also allow for remote code execution. So if we get remote code execution on those boxes, well, then that's great, right? So assuming there's no passwords in SysFolm, and assuming those vulnerabilities have been patched and they're not exploitable, what do we do next? And that's what we get to the impersonation token. I'll hand it over to you. Okay, thanks. Impersonation token is when the user locks into a system, and then, which button is it? Okay, and then a delegation token is created, which is converted to an impersonation token even after the user locks out. So this impersonation token has exactly the same right as the delegation token. It doesn't get deleted and it remains on the system until it's rebooted. So what happens is, if a domain, I mean, locks into a box and then the attacker gets to the box, he can use that token to execute domain and receive commands that run having the same privilege as the domain manager as an example of what it looks like when we privilege escalation using the tokens. Sorry. Okay, so if there's no impersonation token, what happens for sure will run the Mimicats and actually done the local password hashes. So if there are new password hashes or new password that gets, it gets added to a database and then the process continues and it tries to use the new password to attack hosts that have not been tested before. And it repeats this again until there's, it runs out of password to test or until all hosts have been compromised. So the thing about shared local administrative password is, sometimes any T administrators are lazy or they've tried to do it the easy way out. All the systems are using the same shared look at administrative password. So when you compromise one host, you can compromise the other host in the network with having the same shared look at administrative password. So yeah, so with the shared local admin password, the idea is that typically when we talk about privilege escalation, right, we're usually only looking to go up. But one of the things that we want to do on a pen test is get a lot of coverage and it's a real sort of pain in the ass to check every sort of host in the network that you may be in scope to see if the credentials that you have could be useful. So the idea is that we can get a lot of breadth and we're looking to expand on that and I'll get to that at the end. So yeah, so the other thing, going back to the context, right, there are a number of controls that have been implemented that can stop us from doing these things. So we need to figure out ways to bypass that and Portia has support to automate some of these bypasses. So Microsoft created the anti-malware scan interface. So it's designed to detect and prevent script attacks.  So it implements a number of security checks, so it scans file and memory and stream, content source, URL, IP checks and a whole bunch of other techniques. It also has some support for breaking through of the skated scripts and identifying of the skated scripts. And Portia currently implements two techniques to automatically bypass AMSI. So the first one is like a real basic one. You might get lucky with it, most times no, but we still got it because it's pretty easy to implement. So basically if the host is running .NET version 2.0, you can see the whole string up there. It's a very specific version. You can actually force the use of PowerShell V2. So AMSI is supported in PowerShell version 3, but not currently not PowerShell version 2. So with that, you can use the dash version option. So it's dash version 2 and you can force the use of PowerShell 2, which is bypassed as AMSI, so works well. But it's reliant on that single version being available. The more robust technique was created by a guy called Matt Graber and I apologize for having ruined his name. But basically it's a simple one liner that unloads AMSI from the current process and it doesn't require elevated privileges and it works with PowerShell V3 with AMSI. So that's the robust one that usually works most of the time.  And we'll probably add some more as we continue to develop Portia. The other control that we frequently run up against is AppLocker. So Portia implements a number of AppLocker bypass techniques. So the first one is exploiting weak path rules, so inappropriate folder permission. So by default Windows allows read and write under the Windows directory, but Windows slash tasks, Windows slash temp and Windows slash tracing. So any binary that executes from these folders won't be blocked by AppLocker. And so Portia just loads PowerShell into the task directory and we're good to go. So pretty straightforward bypass. The other one that it tries is with MSBuild.exe. So injecting code into a signed Microsoft binary, if you manage to do that, it will execute code without it being picked up by DeviceGuard. So MSBuild.exe specifically allows for inline tasks which basically allows you to compile and execute code and memory on the target and can be used to effectively execute arbitrary code on the target and Portia uses that as an AppLocker bypass if necessary.  So PowerShell, Portia also has support for the invoke obfuscation script. So basically it's a script developed by a guy called Daniel Bohannon and it allows for obfuscation of your PowerShell scripts with the idea that you can bypass AV and other protections that might be looking for PowerShell scripts. So I mean, it doesn't work 100% of the time against every AV, but it works well enough most of the time. The other thing as well, again, going back to the context at the start where we sort of said, you know, a lot of these scripts and tools that we use aren't well maintained and they don't really run well against newer versions of Windows. The invokeMimicat script, which is the one that's commonly used to run Mimicats, it's running an outdated version of Mimicats and it can have issues with Windows 10. So the way that Portia does it, we use the invokeReflectivePinjection script which runs the latest version of Mimicats or it can be any kind of code, it doesn't have to be Mimicats in the memory of the target host and it's a way more reliable version, way more reliable against recent versions of Windows. So the other thing that Portia does automatically is we've got this list of passwords, right? We've got this database. We check it against any available SMB shares or folders just to see what we can access, what we can't and which passwords work with which resources.  This is just a sampling, we're adding more all the time so obviously it's available on GitHub or throw up the link at the end so if people wanna contribute, they can. So currently it dumps wireless passwords, it looks for configuration files that are known to have passwords in it like VNC configurations, party configurations, things like that. It dumps browser credentials as well and key pass credentials, config files, things like that. It also has a recent module which is automatic compromise of MS SQL databases and I'll hand over keys to go through that. Okay, so what happens in this module is, let's say if you don't have access to the SMB ports but there's an MS SQL service that's running. So what this module does is look for weak passwords whether you're using, it has to go into the weak password that is supplied by social engineering toolkit and then if it's successful, enable XP CMD shell like as a local admin account on the box and it also enables the admin share so that you can run SMB stuff. Dump hashes from the same database. Dump's clear text credentials via Mimicast. It also looks for interesting information store in the database like card information or password. Yeah, so this is just a screenshot of what it does. So as you see in this screenshot, it detects that PowerShell is blocked by a blocker so it attends one of the techniques to bypass it so it can write invoke Mimicast and then it dumps the KTex credentials from memory and then it dumps the same, the hashes from the same database and then it dumps the, sorry, the MSSQL credentials and lastly, at the bottom, you can see that it finds all the interesting data and display in a format that is easy for you to see so you don't have to look through all the tables and stuff. So PowerShell also looks for interesting files that could be like key pass, database, unattent.xml file that can contains credentials or travianc.ni that can also create credentials and documents that has the name password in them and so on and so forth. And yeah, you can use other modules like there's a key pass module or there's a true quick module or there's a beat locker module that can dump the password and the keys to decrypt it offline. You can use any of these modules individually. You don't need to use a letter from one order. And it will ultimately download them for you so you don't have to pull it down individually and you also display like the first few string of what it looks like if it's a text document. So the other thing that we do, another module that we have that's pretty common that's very useful is dumping browser creds. So it uses various PowerShell scripts. So first it checks if Firefox or Chrome is present on the system. It checks if the current logged in user, what the current logged in user is and checks whether we have that hash or password belonging to that user in our sort of Porsche database so to speak. And then we have a PowerShell script that runs within that user session and dumps the credentials to a file. The other thing we do, so this is an example of like a convenience module that we have in there that's not directly related to privileged escalation or lateral movement or anything like that. But it's a common activity that we would do on a pen test. So the most pen testing we do or generally is for PCI or we're looking for credit card information or something of value like that. So we've got a module in here that searches for pen on disk and in memory. It uses a couple of scripts that are already written. We didn't write anything new for it. Basically, obviously the credit card found on the disk it works through the same way as the other modules that find interesting files works. But the way that the memory scraper works, so Porsche will enumerate a list of all applications on the host that we have admin access on. And then once we've got that list of processors running we have producer table that shows which programs are running on which hosts and what processes are common. And then we look for interesting processes to dump. So we don't dump at all, obviously. But this is what it looks like. So you've got that table there. So let's say you're doing a retail client or something like that that got pod systems. It's likely their pod's application potentially has credit card information in memory. So you would select that process if you got access to that host. And dump the memory and see if you can find anything good in the memory. We've also got some basic support for analyzing hashes. So currently we can analyze if there's a blank hash or if there are accounts that are using the same hash. But we want to build out this functionality a little bit further. So one of the things that we unfortunately commonly see on Pentes is password reuse between low privileged accounts and high privileged accounts. So we sort of see that all the time where they use the same password for both. So if you're able to get the low privileged account, it's very easy to get access to the high privileged account. So we've got a, well, Portia, currently this is what Portia does. It has a list of the valid hashes and analyzes it for patterns. Obviously blank ones, reused passwords across different accounts and things like that. So yeah, and as I said, we're looking to expand it and it can be useful on a Pentes. So where are we looking to take Portia? So something that we're continuing to actively develop. The biggest area that we want to progress in is attacking targets and adjacent networks via proxying through trusted hosts, right? So if we're in a particular network segment and we don't have access to other hosts on another network segment, but we have a host that we have access to on our segment that's trusted into the other segment, we can proxy through that to run Portia then on those hosts that it can see. So that's something that we're working on right now that we want to really improve on and I think it's sort of the missing feature right now that will make Portia really a lot more robust. So that's what we're working on now. We're looking to add a bunch of data exfiltration modules as well, because that's a common activity that we're doing on Pentes. We would like to add support for more database modules as well. So not just MS SQL, Postgres, whatever, and there are a few dependencies as you may have been able to allude to and it's not difficult to set up, it's not like trying to set up Metasploit from scratch, but we want to create a docket image just to make it easier to set up and deploy. So this is where it's located. It's on our GitHub page. Feel free to, oh yeah, we'll just switch over. But hopefully it works, we'll see. But yeah, so check it out. It's on our GitHub page. Feel free to submit an issue if you have an idea or if you want to develop a module of your own. Yeah, I think we're good. Yeah. No, nothing. Yeah, there we go. All right. So yeah, if you have ideas for modules or you have issues or bugs, submit an issue in GitHub or submit a pull request if you want to and we'll go from there. So now we have a demo. Yeah, so I'm running this through the normal mode where you find the boxes and try to compromise and get the hashers and passwords and from compromising one box to compromising the domain controller. I'll let you run first because it takes a while, but let me explain, I'll come back to it. So what happens is you get a password that you capture or crack from Responder or some other place. So you've managed to find that it has an admin access on one of the boxes which is going to a domain and this is what you see. So firstly it dumps mini-cats followed by dumping the hashers. So something interesting is one of the administrator has locked into the same box. So you do see a domain admin account here. Can everybody see that it's a bit small, right? Zoom in? Okay, let's move back. Okay, so yeah. Sorry, this is just a really simple network. We've got a domain controller. We've got a domain controller. We've got a host that's connected to the domain controller. We've got a separate host as well and we've got the attacker machine which is what Keith has got here. So a pretty simple network. It's just because it can take a while if you've got a... So on this machine that's joined to a domain, there is a domain admin account. I mean the domain admin strator has locked in. So after it dumps the credentials by admin-cats, it dumps the same database. It analyzes that. It also tries to pick up the impersonation token. So that's an administrator impersonation token. So we can basically make use of either the clear text credential or the token. Since you have the past clear text credential, the script for sure will just use the clear text credential to compromise the domain controller. Yup, it just tests MS14068. Since the first account we used was a local user account, it doesn't have access to the domain so it will skip this part. If it has a valid user account, it will test whether is it vulnerable to MS14068. So now it has moved the lateral movement to the compromise the domain controller using the credentials that it had captured from memory. So it does the same thing, mini-cats, same database, and then tokens. And then it collects all these credentials and hashes and compromise the third box which is a host in the work group mode. But coincidentally, there's just as we spoke earlier about the shared look at administrator password. So these two machines, even the whites and the domain whites of the work group, both are using the same shared look at administrator password. So using the, as you see here, it uses the hash, anti-ln hash to compromise the third box. So in the end, it will tell you like, since it will stop when it runs out of hashes or passwords to try, or when all hosts have been compromised. So what you see here is all the hashes that I've seen and collected so far. Password first, followed by hashes. And then it does an analysis of what accounts use what password, what hash. So you can see that these two accounts use the same password hash and so on. And then it also lists down what hash and what password it used to get into the box. So, and then it ends by saying that you can rather run post-expertory module or it stops this way. So let's look at another thing, which is the MSSQL module. Just now I was explaining in scenario where there's only MSSQL port that's open, SMB ports are not open. So how do you compromise it? So in this case, it found a default account. It tried to test against the weak password. And then, so it got in and then it enabled the XP-CMD shell. It has a local admin account. And then when it's trying to run other scripts, it realized that PowerShell is blocked by AppLocker. So it had one of the techniques and then successfully run Mimicast on the machine, done the clear text credentials, done the same database, and then followed by things like the password and look for interesting data. I mean, it also enabled the admin folder so that you can access it remotely. Even though it's blocked initially. In future version, I plan to do like every version that's compromised, you return shells. So that's more fun than just getting password. Another thing that we're also developing in support where we can to, well, the purpose of that tool is to automatically attack certain two-way implementations. So we feel like it's a good fit for PowerShell as well. So we're gonna probably integrate the two. That's not how SpiderLabs get helped just yet, but it will be soon and we'll probably integrate it to PowerShell. So this is another module about scanning from Ramvity. So it scans for MS08067 or MS17010. It doesn't export at this point, but as time goes on, we plan to add in because we want to add in all the common techniques to get from zero to domain admin. As easy as possible. So let's go on to the next module. It's about files, finding interesting files. So same as usual, it checks whether PowerShell is blocked or not because it's easier to run post-acidation with PowerShell. And after that, it finds all the interesting files that could contain passwords or other sensitive data because previously, MS087 might be storing passwords using text document, then they migrated to Excel, then they upgraded to KeyPass. So, might as well download the KeyPass file. It downloads all the interesting files for you as well as the location. This one is to show that it's the same, it's just show, it'll be locked, please. Give me a second. Okay, if the administrator or the user has the KeyPass open on his computer, it's able to dump the clear text credentials. So it's just using a common script, but it detects which user is, you lock on and using the KeyPass software and it has to run it in a context so that we can dump the credentials. If not, it doesn't work at all. This is just another screenshot to show that it dumps the true creep keys so that we can decrypt it offline. There's also a module that we are working on like just now we've been speaking about finding alternative route to attack a decision network. So, if you provide it with a list of IP address and it can't access those IP address initially by ping or whatever, but it found a route in an alternate host, it will highlight, it doesn't show here because I don't have an example, but it will highlight here, it says that this host has an alternative route to what you might be interested in. So this is just a small step to where we are going next. Going to be next to. Okay. Last, second last, it finds clear text, I mean documents that contains credit cards and as well this is same as what we see just now but it displayed a card number, not my card number. And then this is just what we run just now but as it takes some time, now it has finished running to show that it works. Just a comment, you guys should check out ClocoFi done by Joe Gervais last year. Python 2.7, I've made, I upgraded to 3.5 and did the PowerShell version but it takes any EXE file, image file, binary file and turns it into a list, set of lists that you define. A list of Pokemon with latitude and longitude in front of it, clear text, whatever, it's pretty powerful, it's awesome. Yeah, thanks man, we'll check it out. You had a question there? So, in talking about sensitive data, you mentioned credit cards. How about PII and PHI, which is a little more complicated? Yeah, so at the moment it's relatively limited in terms of what it looks for but that said we are expending that and that's on the list to do. We're trying to get the routing stuff in first but expending our searches for broader categories of sensitive information is definitely on the radar and obviously if anybody wants to contribute then feel free, yeah. No, you can define the limits of the scope or you can just let it run, it depends. You just, we tried to make it as modular and as progressive as possible so you can have it run as much as possible against whatever it can do or you can either run individual modules or you can limit certain modules to have certain options to limit what gets run. Yeah, another question? Yeah. It's now on screen but that's a good idea. You should probably be able to add an option to dump it to a file, yeah, for sure. Cool, any other questions? I think we're out of time.


So the big deal of my program, and I'll show you the fundamental part about my program, and that's going to be the rate and the stop, and that gets put on as a two-year-old, and then just kind of keeps, that's kind of the fallback school and method as they get older and stuff like that. It's kind of like the, it's the easiest thing to put on them as a two-year-old, and it's the hardest thing to put on them on a, you know, on a late older horse if they don't have it. There's a lot of what I'm going to do, and then I'll kind of just talk as I go through it, but it's like I want to get him behind a cow, and then whenever the cow's, or when the horse's shoulder gets up towards the cow's shoulder, I want that horse to be thinking check, and if that cow keeps running, I'm going to go ahead and pull up and make them go ahead and stop, but I'm going to get him behind this cow a little bit and drive this cow around if I can, and let this cow go, and then I'm going to go over here. Now if this horse gets there, that was good. She finally slowed down and thought about it. So in this process, and I'll show you on this two-year-old that I get on next, in this process, see how she just rated back down to me? She got to that cow's shoulder, she didn't just stab her feet in the ground, but she went ahead and slowed down and broke to a trot. She would have stopped right there if I had a letter. That is what I'm after. So I want to do the right, I'm going to walk to this cow's head, I'm not going to let her break with this cow, I'm just going to get him behind.


Our next talk, so Yohai Yasukawa is a Ruby developer. Oh yeah. Yes, as far as I see. And he will be talking about dojo, kiss dojo, or training kids in Japan. Thank you. I'm glad to be here now. Actually, I'd like to share what happens in Japan. In Japan, we co-founded Koda Dojo, which is a free volunteer-led open source programming club for young people. And then it's a gradually increase and it's now a big movement in Japan. So now I'd like to share our knowledge and experiences with you as an Asian and international people. Koda Dojo is originally started in late 2012, sorry, late 2011 in Iran.  And in that time, in 2012, in Japan, we started the Koda Dojo open source community. We started building a Koda Dojo community from a very small cafe which is called the open source cafe. This is just a first time of Koda Dojo, just a second time of Koda Dojo. So the Koda Dojo is, in three words, is a technology, kids, and in an open source way. We share our knowledge and the kids, for example, teaching each other. And we actually, yeah, it's often misunderstood that Koda Dojo is a kind of classroom. For example, I teach kids how to program, but this is not encouraged. Actually, we encourage kids to teach each other or run from each other. So it's often called peer learning. Also, we encourage kids and adults sometimes to show what you created or what you're doing and tell it to the communities in your region. We also call it the show on tape. So the kids, he's now showing that his games that he's creating now. And then he get a feedback and get motivated. And then he continue to create a program, make a program. Also, we have met many lesson learned things when we learned Koda Dojo. So we, as the same meaning, same way as the open source community, we share the lesson learned things, the documents or information and knowledge. And also, as we do now, we actually encourage everyone, enjoy the Dojo to run. Now the Koda Dojo in Japan is really becoming big. And for example, this is just a screenshot of the timeline in Japan, the Koda Dojo. So in a week, every week the Dojo has happened in many areas in Japan. And actually, for example, in the number, the last year, we had 25 Dojos in Japan. But now, this 2017, the March, we had 75 plus Dojos. And so almost half of the Japanese prefectures have a Koda Dojo from the top, from the bottom. And as I said before, the Koda Dojo is not a Japanese open source community. Not only the Japanese one, but also the worldwide one. So outside Japan, there are 70 countries and 1,200 Dojos in the world. And actually, Japan is one of the big communities in the world in Asia. But there are many bigger communities in USA or Europe. But in Asia, I think Japan is one of the big groups. So we actually established the Koda Dojo Japan as an official regional body. And then now, from the foundation, we actually registered the Koda Dojo Japan as one of the regional bodies. And then there are six, sorry, five regional bodies in now. And one of them is Japan. So Japan, I actually co-founded Koda Dojo Japan and now running the 100 organizing and encouraging them. So I'd like to share what we are doing now. Well, there isn't what we are talking to here this session. Actually, these are the lines. The first Koda Dojo, actually I explained so far. So let's skip this one. You know what the Koda Dojo is. So actually, let's go into the details. How we grow from zero to 75 plus Dojos. And also, why we continue. Well, if there is no Dojos in Japan, when there is no Dojo in Japan, we actually met the Koda Dojo co-founded James. He actually often traveled around. And he actually, a friend he traveling in Asia, we called him. And then he actually, I talked to him about what you think about Koda Dojo. Why you run the Koda Dojo? And then we actually exchanged the details and share our feelings about the Koda Dojo. And then we actually get inspired by him. And then we actually started running the Koda Dojo Tokyo. This is the first picture of the first small Dojo in Japan in Tokyo. This is, we have James as a guest. And then I actually translated what he said into Japanese. And then share what's happening in the Koda Dojo community in the world. But as you might guess, this is a very, very small start. And it's really difficult to become big immediately. So actually the first Dojo, Open Source Cafe, Koda Dojo Tokyo is like this. There is a cafe which is called Open Source Cafe. And there is a Dojo in a very small group. And then in those days, we have the session for Scratch, which is a visual program in languages. And so actually when the kids start on programming, then the mentors next to kids tell them how to solve or how to start debugging the program. And also there are many tables other than Scratch, like HTML or JavaScript or the Ruby Python or things like that. Well, the point is, okay, let me skip the video. The point is that we did is that every weekend we have a session. So for example, every Sunday we have a session. So this is Sunday. So this afternoon there is a Koda Dojo Tokyo in Open Source Cafe as we saw in the video. So for now in total, Koda Dojo Tokyo has had session this time, many, many times every weekend. And because of that, if you are interested in the Koda Dojo Tokyo or Koda Dojo itself, you can easily drop by and see what happens in the Koda Dojo Tokyo like this. And you see this case, who are getting familiar with programming, that's now focusing on, for example, programming in the Minecraft or programming in the Raspberry Pi or things like that. So because we have a session every Sunday, so people who are interested in Koda Dojo stop by the Koda Dojo in Tokyo or the other Koda Dojo near to them and get inspired. And then like Open Source repository, they are forking the Dojo to their regional area. So this is kind of the visualized of how Koda Dojo is expanding the video provided by Koda Dojo Foundation. So for example, this is the Koda Dojo Kashiwa happens. This is a folk from the Koda Dojo Tokyo. And there is in other countries, Mezoran, for example, the Koda Dojo. And Tokyo, yeah, this is kind of the presentation I did in Tokyo in Japan, speaking about Koda Dojo like today. So like this network, we often share exchanging information on how to be continuously runnable the Koda Dojo in their each region. So that's now, in that background, the Koda Dojo is becoming bigger and bigger in Japan. And right now, almost 70 plus Dojos. So the point is forking the Dojo, the customizing it like we do in the Open Source repository and share like a prerequisite in the Open Source software. The next try we did is the conference, which we call the DojoCon Japan 2016. And this is a picture of the DojoCon actually. Why we did it? Because becoming the getting bigger and bigger in the Koda Dojo, there are many people who don't know, who you don't know. So that's the opportunity for mentors or organizers or kids is really helpful for them to meeting each other and exchanging the information. What do you think? Why do you start the Dojo? Why do you have running the Koda Dojo? This is the big conference, but actually I think this was a very successful one to make the Koda Dojo bigger in Japan. So for example, as I said before, the one of the sessions, for example, I actually asked the reasons why you start. And these two are actually not the adults. They are still students. He started the Koda Dojo when he was a high school student, and he is now a graduate student, but he started the Koda Dojo when he was a university student. So we asked the question and share why they started the Koda Dojo in their region. That's kind of a helpful for the attendees to get inspired and to get motivation for them to start or to help. Also, I think the network itself is really important even in us and also even for kids. So the DojoCon is really a good opportunity for even kids to network over there. So for example, there is a show on tell in each Koda Dojo, but they are less opportunity for share what they created with other Dojo. So that's this kind of conference or meet-up can help for them to network or to share their passions for the programming. So this is kind of the why we DojoCon, and I think that was successful to make a bigger community in Japan. The last slide actually to share here in this presentation is that we actually wrote a book to expand more to let them know about the Koda Dojo, how Koda Dojo works by books, by learning the programming languages for kids. So the book itself is technically not so surprising. It's the typical Scratch book for learning visual programming languages for kids. But the point different from the usual books is that this is composed by the story-based learning. So this Scratch book tells you how to make a programming by using Scratch, visual programming languages, by attending each Dojo virtually in the book. So for example, these are the opportunities, but this one is the organizer of Dojo. So this case, going to Dojo to Dojo to learn Scratch programming from the organizer or mentors in the Koda Dojo. So this means the virtually. And then the first chapter, the second chapter, the kids going to Dojo to Dojo to learn more, to learn shooting game, to learn the complex game, things like that. For example, music game in this chapter. And then finally, we revealed the Koda Dojo itself is not virtually virtual. And there is a Koda Dojo that organizers or mentors in this book, appearing in this book, is actual person in there. So under the rest of the book, we tell that there are many Koda Dojo that we cannot introduce in the book, and then we visit them. That is the kind of, this kind of the tries about doing the conference on the publishing of books and inspiring them by using the same method as the open source community is the way to get bigger in Japan from 25 to 75 plus Dojo is in Japan. Well, the last thing I'd like to share is that I think one of the big important thing is why it works. Why we continue to run? In the software, the computer's contents runs, but because this is the physical community, we need to prepare for the venue or having a session and for example, announcing the Dojo. It, yes, it's, to be honest, it's cost, but they do and they continue. One of the reasons is kind of the, for me, very curious about it. And in my point of view, there is no one simple answer, the one simple reason, but there are many, many various reasons to attend, to mentor, to help mentoring and to start a Dojo. So let me share some of the examples why they started. For example, the dojo members, the organizers and helpers is also the kind of the contributors to the Code of Dojo. For example, she is one of the contributors to Code of Dojo. She is really good at designing and the photographer. So she is now taking a photo or she is helping the web design in the DojoCon Japan website. So she would like to help kind of the, help the Code of Dojo community is runnable for her passion. And the other reasons I found is that IOT, the kind of embedded system, that this is an area of the, the Arduino or Raspberry Pi. These two guys are the professional engineers in the hardware. And for example, he is actually, he's like to his son to enjoy programming with kids in the regional area. So that's he contributed to the Code of Dojo. Also, there are many attendees and collaborators over there. Maybe it's a little bit small. And also, by the way, this is me in the MC. I'm asking the organizers to why you studied. Actually, yeah. Me, I also have a reason to start Code of Dojo and continue to help the Code of Dojo. And for me, it was, when I was a kid, it was really tough to run programming and what to do when I was stuck, when I was a kid. Because there are no such communities when I was a kid. And even these days, the kids have the same feeling but I have when I was a kid. For example, this kid, 10 years old, but he developed and published his web services by using Rubion Race. And he said in his presentation that's by answering the question to how to become like you. And then he answered this. The reason why he improved their skills is that he did these ways to learn more. That is, when you find something interesting, they Google it by web, they Google the keyword by web, search it by books, and then they ask it by Code of Dojo communities. So that's these steps becoming a loop. And then asking by Code of Dojo, he gets a new thing, new something that is interesting to him. And then Google it again and search it by books. And then asking or sharing the lesson-run things with Code of Dojo again. This is kind of the running spiral that is helpful for him to learn more about the programming and computer science. Oh yeah. And another example to me is that and that is surprising to me is the reason, because there are no dojos, he actually posted the Code of Dojo group recently. What he said is he is still a junior high school student, 30 years old, but he would like to attend a Code of Dojo, but there are no Code of Dojo around where they live. So that's why he would like to start a dojo because no dojos around their home. And so he actually calls for the collaborators to run a dojo with him. And then as you see, there are almost 20 shares for his boss. And then we actually finally found the collaborators to start a dojo for him and for kids around the area he is living. Well, there are many, many various reasons to attend, help and organize. So actually I finally would like to share the videos to interviewing the people in the Code of Dojo community. Why do you come to Code of Dojo? Why do you help running the Code of Dojo? And with the translation into English. He said he wants to improve his coding skills. He's attending and make caffeine. His girl, when she wears a hand, you can get help from the man. And as I said before, stack of coding. There are many reasons to attend and this is kind of the videos of the shooting the Code of Dojo in Kashiwa, the prefecture in Chiba. He's an organizer. Ask him why he does that. He's a mentor of the Code of Dojo Kashiwa. Here, he can find new opportunities by touching, by sharing the information, technology with kids. So really, really various reasons I found. She was an attendee, but she now becomes a mentor in the Code of Dojo. Kind of gladdening to an attendee, to the mentor, to have the next generation. He's now stuck in reading the English sentences, but the mentor's tough to read and understand. He just likes to see the smiling face of kids. So that's he started the Code of Dojo in Moria, in Japan. So that he keeps doing the Code of Dojo, running. He's not programmed, not good at coding, but he likes to do it. He's a mentor of the Code of Dojo. He's a mentor of the Code of Dojo.   He would like to have the Code of Dojo by using his design skills. He likes taking photos. So taking a photo of a picture, or movies of the Code of Dojo activities. Then show what happens. Show why they started, why they continue to help. So many programmers in the open source community, so he's like to be a great programmer. He's like to into more about the programming. So this is kind of important thing, I think. So enjoy the Code of Dojo, and then the passion to the next generation. Then it works again and again. That's the kind of one of the concepts and the reasons in the background why Code of Dojo running and continuing in Japan. So in summary, actually I actually strongly encourage them to enjoys to have, enjoys to do, instead of feeling the obligation. So that's the I'd like to share with you in this session. I think there is no time left, so just quickly wrap up. The Code of Dojo is a tech kids open source community for free, for open source, and then strongly encouraging teaching each other, not like classroom from adults to kids in one way, but communicating each other. And then the last thing, but not least is everyone enjoys the Dojo running. If you have a question that just asked me or Google the Code of Dojo, then there are many, many information in English in Japanese as well. So I hope the experiences and knowledges are helpful for building the open source community with kids in your countries, in your regions. Thank you very much. Okay, so there will be, and I think there will be other people running courses that the parents have to pay. Are you competing with them? Actually, we are not allowed to charge kids to attend the Code of Dojo. This is one of the rules to be a Code of Dojo. Yeah, but will they complain or say that all you are taking are business or something like that? We actually are open to the, so Code of Dojo has a very, very few rules. For example, charging a kid, but you can use your lesson round things to, for example, writing a book or doing the business by not using the Code of Dojo. So it's also fine. It's kind of inclusiveness is one of the important things in Code of Dojo. Good, thank you. Okay.


Munch it, I will say the same thing. Turn my, uh, the camera. Go for it. It's so beautiful. And I'll look it up in the open. Amen. I'll have it in the open. Hi.  I just went in for a speech there. Yeah. Yeah. His voice is still kind of weak. He's so little brassy, but... Yeah. All of that, man. I think your colleague yesterday mentioned that he's on a flight of course. There's a little tent still in the open. Have you been listening to yourselves? A little bit. Thank you. Thank you.


Let us start with a brief recap of last class. Last class we looked at extrinsic semiconductors. Another name for these are doped semiconductors. Now the reason why we wanted to doped was because we found out that if you had an intrinsic or a pure semiconductor, the carrier concentration at room temperature was very small. Correspondingly the conductivity was also small. For example in the case of silicon, we found that the room temperature carrier concentration in an intrinsic semiconductor was only 10 to the 10 per centimeter cube and the corresponding conductivity very low was around 3 times 10 to the minus 6 ohm inverse centimeters. So we wanted to increase the conductivity. So we selectively added impurities or dopants to the silicon in order to make it an extrinsic semiconductor. We also saw that in any semiconductor the law of mass action must always be satisfied. So that Np is equal to Ni square which is a constant at a given temperature. This meant that we can either increase the concentration of electrons or increase the concentrations of holes. We cannot do both. So we also saw that there were two types of dopants. One was your N type, the other was the P type. We saw that an N type dopant was found in the caves of silicon by adding group 5 elements. The typical elements that we add are phosphorus, arsenic, antimony. All of these have one extra electron compared to the silicon atom which means you have one extra electron in the conduction band. So these are N type. Similarly we saw that we could form P type by doping with group 3, boron, aluminum, gallium and indium. These form energy states that are close to the conduction band in the case of N type or close to the valence band in the case of P type. So that these are ionized at room temperature. So let us look some more today on the properties of extrinsic semiconductors. So far you only talked about silicon. So what about other semiconductor materials and doping in them? If you look at germanium, germanium lies in the same group as silicon which means all the elements that we used as dopants for silicon could also be used for germanium. So we can use your group 5 elements like phosphorus or arsenic as an N type dopant could also use your group 3 elements like boron as a P type dopant. Once again in the case of germanium we can calculate the ionization energies for these dopants. We could use the hydrogenic model. The only difference is the effective mass Me star for germanium will be different from that of silicon and similarly your relative permittivity for germanium the value is around 16 while for silicon epsilon R is around 11.9. But we can use the same hydrogenic model in order to calculate the ionization energies. So let us look at some actual values and just to compare silicon and germanium. Let us look at N type, phosphorus, arsenic and antimony IO3 dopants silicon and germanium. If you fill in the numbers in the case of silicon we found out that the ionization energy in milli electron volts. So energy is in milli electron volts was around 45, 54, 39. Similarly in the case of germanium we will find that the ionization energies are very small. So this is around 12, 12.7, 9.6. If you remember the band gap of germanium is also smaller. So at room temperature E g for silicon is around 1.10 electron volts. E g for germanium is around 0.67 electron volts. You can do the same thing with P type impurities or P type dopants boron, aluminum, gallium and indium. So once again let me write silicon and germanium 45, 57, 65, 157. Again we are writing E g in milli, we are writing E energy in milli electron volts. Germanium is around 10.4, 0.2, 10.8 and 11.2. So what this means is whether you have silicon or you have germanium both lie in the same group. So you can dope both of them in a similar fashion. If you want an n type dopant you are going to add group 5 elements. If you want to add P type dopants you are going to add group 3 elements. Usually the dopant concentration is very small. We saw earlier the case of silicon that your typical dopant concentration was around parts per million or parts per billion. So parts per million is 10 to the minus 6, parts per billion was 10 to the minus 9 and even the small amount was enough to increase the conductivity by orders of magnitude. So we saw for silicon we had an n type dopant with 10 to the 15 atoms per centimeter cube which was approximately 20 parts per billion. Your conductivity sigma went up to around 0.2 ohm inverse centimeter inverse. One thing we have not looked much is how we actually do the doping. So later when we look at the fabrication part we will spend some more time on how we actually dope. But if you think of a parallel to metallurgy one way we can think of is in the case of stainless steel or in the case of steel we do something called carburizing where we increase the carbon content. So typically what we do is we have your sample at high temperature you have a carbon source so that the carbon then just diffuses into the surface and into the bulk of your steel. So we can do something similar in the case of doping in semiconductors as well. So if you want to dope n type you have a source of your n type material. This could be in the gas phase. These could be ion implanted onto the surface. You will see what ion implantation is later so that these can then diffuse into the surface and from the surface into the bulk. If you want to do compensation doping we saw compensation doping last class where you start with an n type semiconductor and then you make it p type by adding excess dopants of the other type. Similarly in the case of compensation doping could take a small portion of your sample that is typically n type and add excess of p type. So you could add excess of boron and then make it a p type semiconductor. These dopants are usually very stable at room temperature just to give you some numbers. Let us take the case of silicon. I have two dopants one is boron, one is phosphorus. Boron is a p type, phosphorus is n type. We will write down the values for the activation energy and the diffusion coefficients for these dopants. So if I write D0, EA is the activation energy for diffusion and D0 is a diffusion constant. So in the case of boron D0 has a value for on 0.76 activation energy is around 3.5 electron volts, phosphorus 3.85 EA is around 3.6 electron volts. What this means is in order to have boron or phosphorus diffusing into your material you essentially need a high temperature process. The corollary of this is that at room temperature your doping concentrations are inherently very stable in the case of silicon. So far we have seen two semiconductors silicon and germanium. We have looked at some examples of dopants calculated the ionization energies. Since both silicon and germanium belong to the same group we essentially use the same elements. Things become a little more complicated when we look at other semiconductors. So let us look first at gallium arsenide. We saw earlier that gallium arsenide is an example of a 3 phi compound semiconductor. So gallium is from group 3, arsenic is from group 5. The bonding in gallium arsenide is mainly covalent but you also have some ionic character to the bond. Instead of gallium arsenide if you have something like zinc oxide which is a 2 6 semiconductor there will be higher ionic character as compared to 3 phi. So it is also possible to dope gallium arsenide but there are now more possibilities in this case. To understand this let us go back to the periodic table especially the portion around gallium arsenide. So let me write the periodic table. We have done this earlier when we looked at elemental and compound semiconductors. So group 2, 3, 4, 5 and 6 boron, carbon, nitrogen, oxygen, aluminum, silicon, phosphorus, sulphur, zinc, gallium, germanium, arsenic, selenium, we have cadmium, indium, tin, antimony, tellurium, mercury, thallium, lead, vismuth and polonium. So this is just the portion of the periodic table around groups 3 and 5. So the semiconductor we have is gallium arsenide and we want to know what sort of elements could be added as dopants to gallium arsenide to make it P or N type. So when we think of dopants these are usually substitutional which means they are going to replace either the gallium or the arsenic atom. So let us say I want to make an N type gallium arsenide. So I would typically choose elements from group 6 because these elements have one more electron compared to arsenic. So if an element from group 6 replaces arsenic we will have one extra electron and if this extra electron is in a shallow state if it is easily ionizable it can get ionized to the conduction band and be available for conduction. So we are going to go to form N type, we are going to replace arsenic by group 6. We can use the same argument if you want to make a P type semiconductor. So we replace gallium by any of the group 2's which has one less electron or you have one hole. So that will make it a P type. If you want to make something P type you can replace gallium by group 2. Question is what happens if you have a group 4 impurity? Let us say I have silicon. Now silicon is an impurity in gallium arsenide. So there are essentially two possibilities the silicon can replace the gallium the silicon can replace the arsenic and depending on that you can either get an N type or a P type. So if the silicon replaces the gallium then silicon has one more electron because this is group 4, this is group 3. So the extra electron is available for conduction it will make it N type. On the other hand if silicon replaces arsenic it has one less electron and it will make it P type. So silicon added to gallium arsenide can be either N or P type and this type of doping is called amperage. Amphoteric doping. This term ampho essentially means both means you have the same element can act both as an N type or as an P type doping. The only issue here it is really hard to control the position of silicon. It is very hard to get silicon selectively doped into gallium or to selectively doped into arsenic. So if you have silicon as a doping it is very hard to control the type of doping and the concentration of doping. So we saw that these are all the possible elements that can be used to dope gallium arsenide. The only other question is where are the energy levels located. So let me just do that by drawing the band gap of gallium arsenide. So this is my conduction band that is my valence band. The difference between the conduction band and the valence band is your band gap. The case of gallium arsenide the band gap is 1.42 electron volts. Also mark the center of the gap. So if you look at the various elements the group 2 and the group 6 elements these will essentially form impurity states in the band gap of gallium arsenide and depending upon whether they are N type or P type they will be located either close to the conduction band edge or the valence band edge. So if you look at the group 6 elements these are N type. So this one is sulphur selenium is also very similar, tellurium is here again all the dopant energies are in milli electron volts. Which means the diagram is not really to scale but we will just show it semi qualitatively. So we have a rough idea. Silicon we said silicon can go either to gallium or to arsenic. So silicon as an N type is around 6 milli e V. Oxygen on the other hand is around 400. Similarly we can look at the group 2 elements. So we have beryllium is around 28, zinc is 31, cadmium is slightly higher 35. We can also have silicon as a P type that is around 35 again. Carbon is around 26. So if you have gallium arsenide depending upon the type of impurity we can either have both N type and P type. Similarly for other 3, 5 semiconductors can once again have doping by choosing the appropriate group 2 or group 6 material. If you have a 2, 6 semiconductor something like zinc oxide or cadmium sulphide or cadmium selenide. Similarly we can choose appropriate dopants to get both N type and P type. Most of what you have done here. So whether we are talking about silicon or germanium or gallium arsenide. We typically want single crystals of these materials. Whether we talk about an intrinsic semiconductor or whether we talk about an extrinsic semiconductor with dopants. We want an ideal single crystal with no defects. This is because whenever you have a polycrystalline material or if you have defects. So whenever you have polycrystals you always have grain boundaries. Grain boundaries are a source of defects. You could also have impurities. You can have vacancies, dislocations. All of these are defects in your crystal and whenever you have defects you always have defect states. There are 2 types of defect states. One is shallow. Shallow states are those that are located either close to the conduction band or close to the valence band. So they are close to the band edges. And because they are close to the band edges they can easily get ionized at room temperature. So shallow states mostly affect the conductivity. It can either increase or decrease the conductivity. The other type of defect states supposed to shallow states are deep states. So deep states are states that are located much closer to the middle of the band gap or they are located far away from the valence band and the conduction band. So in this particular case you have oxygen that is located approximately 400 milli electron volts or 0.4 electron volts below the conduction band. So deep states are located close to the center of the band gap. Deep states can essentially act as straps for electron and hole. So they could modify the conductivity especially in the case of direct band gap semiconductors where we are looking at optical properties. Deep states can also act as straps for these electrons and holes and then decrease the efficiency of any optical recombination. We will see defect states later when we also look at conductivity in an extrinsic semiconductor. The next thing we are going to do is look at how the Fermi level position changes in an extrinsic semiconductor. So we want to find out the position of E f when you have dopants whether you have P or n type dopant. In the case of an intrinsic semiconductor we have electron and hole concentration to be nearly the same. So we wrote an expression for the Fermi level position E g over 2 k T. So this is for the case for the case for the case of an intrinsic semiconductor where n equal to P equal to n i and we found out that E f i is very close to the center of the gap. So if n c and n v are exactly the same is exactly E f i will be just E g over 2 but if they are not the same will be slightly shifted from the center of the gap but for most cases it is very close to the center. In the case of an extrinsic semiconductor n is no longer equal to P. In fact if you have an n type semiconductor we see that n is much larger than P. You have a P type semiconductor P is much larger than n. So in order to compensate for this difference in n and P the Fermi level will also shift from the middle. One way to look at it or to calculate the shift is to use equation for the electron concentration. So let me start with an n type semiconductor with n d being the concentration of the donors. The donors are all completely ionized. So the electron concentration same as the donor concentration. This we can write as n c exponential minus E c minus E f n over k t. So E f n refers to the Fermi level position in the n type semiconductor. So we can take this expression and then rearrange the terms a bit and what we will get is E f n minus E f i is nothing but k t d over n i. How we get this expression is that we start with this. We can write the same equation for intrinsic as n i equal to n c exponential minus E c minus E c minus E f n minus E c minus E f i over k t. So we start with 1 and 2 and then we divide 1 and 2 and rearrange the terms to get the expression for the Fermi level position in an extrinsic n type semiconductor with respect to the Fermi level position in an intrinsic semiconductor. You can write a similar equation for a p type material as well. So you have E f p minus E f i which is minus k t ln of n a over n i. So the similar expression to this except that in an n type we have the concentration of the donors. In p type you have a concentration of acceptors and there is a negative sign here. So let us do some numbers to get a sense of where the Fermi level is located. So let us take n type silicon with n d is around 10 to the 15 per centimeter cube. We know the band gap of silicon E g at room temperature is 1.10 electron volts. For simplicity let us just say n c is equal to n v. So the intrinsic position of the Fermi level E f i will be just E g over 2. We know this to be 0.55 electron volts. Now at room temperature you have all the donor atoms are ionized. So n is equal to n d equal to 10 to the 15 per centimeter cube. We will then use the formula that we just wrote down. So that E f n minus E f i is k t of n d over n i. In the case of silicon n i is around 10 to the 10. So substituting the numbers this gives you a value of around 0.30 electron volts or in other words E f n is E f i plus 0.30 electron volts which is 0.55 plus 0.3 is 0.85. Adding an n type impurity so or adding a donor shifts the Fermi level above the intrinsic level. If you want to show this in a band gap diagram this is your valence band. This is the conduction band. This is the band gap. So this is 1.10 electron volts. E f i is equal to 10 to the 15 per centimeter cube. So this is the conduction band. So this is the conduction band. This is the conduction band. This is the conduction phi is located in the middle. So this is 0.55. So you have added an n type impurity. So this creates your donor levels E d. So these donor levels are very close to your conduction band. At room temperature all of the donors are ionized. And what we have is your Fermi level E f n located above the intrinsic level but below your donor level. In the case of a p type semiconductor. So let us do a situation where we have n a. So it is a p type. We just block it off with 10 to the 15. Instead of electrons you have holes. So your hole concentration is 10 to the 15.  So in the case of a p type semiconductor you have the Fermi level located below the intrinsic level. So depending upon the type of extrinsic semiconductor you have can either have the Fermi level shift up. If you have more electrons it shifts up towards the conduction band. If you have more holes it shifts below towards the valence band. So all these calculations that you have done so far is for an extrinsic semiconductor at room temperature where all the dopants are ionized whether they be donors or acceptors. So the next thing we are going to do is to look at how the doping or how the carrier concentration changes with temperature. So we want to look at the temperature dependence on the majority carrier concentration. So it is a temperature dependence of n if it is an n type or p if it is a p type. For simplicity we are only going to look at the n type case but whatever arguments we use for that we can use the same for the p type semiconductor. How is this different if you have an intrinsic semiconductor? In an intrinsic semiconductor we have essentially no dopants. So a carrier concentration n equal to p equal to n type n i per square root of n c n v exponential minus e g over 2 k t. So if you want to look at the temperature dependence of n it is an exponential dependence on temperature. So if you did a plot of the log of a carrier concentration over 1 over t it is approximately a square straight line as long as you assume that n c and n v are independent of temperature straight line with slope e g over 2 k. This is as far as an intrinsic semiconductor goes. In the case of an extrinsic semiconductor again that is an n type you have essentially two sources for the electrons. You can get the electrons from the donor level. Remember the donor atoms each have one more electron than the silicon that is why it is an n type. So you can get the electrons from the donor level and you can also get the electrons from the valence band. So because you have these two sources you have a different behavior for how the value of n changes with temperature. We are going to look at different regimes for that. So the first case let us look at a semiconductor at exactly 0 kelvin. So in this case you have an n type semiconductor at 0 kelvin. There are no ionized carriers. You have a valence band that is full and you have a conduction band that is empty and you also have a donor level because it is n type which is also full. So this is my conduction band. This is my valence band. So that is full. That is empty and these are my donor levels. The donor levels are located very close to the conduction band. I am just exaggerating the difference to show the fact that they are close to the conduction band. We can expand this portion of the diagram. So that now I will draw the conduction band. I will draw my donor level. At temperature equal to 0 kelvin and at temperatures very close you are going to have negligible number of electrons coming from the valence band. So we can ignore the valence band totally and think of this as an intrinsic semiconductor. So I will put intrinsic within brackets with the donor level acting as your valence band and the conduction band being the conduction band of silicon. So all I have done is just expand this portion here and take it to be an intrinsic semiconductor with the donor level being the valence band and Cb being the conduction band of silicon. At 0 kelvin you have a donor level that is completely full. You have a conduction band that is empty and then you will have your Fermi level in between the conduction band and the donor level. Now if you start to increase your temperature from 0 kelvin electrons are going to get excited from the donor level to the conduction band. Once again your temperature is low enough that you can ignore any contribution from the valence band of silicon. So we do this till some temperature which we are going to call Ts or a saturation temperature. So temperature is above 0 kelvin but it is below a certain temperature called Ts. We are going to define Ts as saturation temperature. In this particular regime you are going to have electrons from the donor level getting ionized into the conduction band and this process is going to happen till all the donor atoms are ionized. So the saturation temperature is defined as the temperature in which the donors are 90% ionized. Some books will give you a definition of 99% ionized but we will just use 90% here. Here at which donors are in order to calculate the value of Ts we look at the expression for the electron concentration. We will treat this material as an intrinsic material with the donor level being your valence band. This case N is 1 half Nc instead of Nv you will have Nd which is your donor concentration exponential minus Ed over 2kt. The 1 half term is here because your donor levels are localized levels. So they can only take one electron of a normal band can have 2 electrons of opposite spin because your donors are localized levels. They can take only one electron which is why we have the term 1 half. We are treating this as an intrinsic with EC being your conduction band and the donor being the valence band and at the saturation temperature N is 90% of Nd. We can put this value here and try and solve this expression for Ts and if you do this we get a value of Ts to be approximately 32 kelvin. So in this assumption we will get the value of Nc to be independent of temperature. If you take in the temperature dependence of Nc you will get a Ts of around 60 kelvin but either way the number is much below room temperature which is around 300 kelvin. What this means is at a relatively low temperature in the case of silicon you have a situation where the donors are completely ionized. So we started at low temperature where we said that we will ignore all the electrons coming from the valence band. We found out that as we started going above 0 kelvin electrons are going to get ionized from the donor levels till we reach a saturation temperature when almost all the donors are ionized. So above the saturation temperature all the donor atoms are ionized so that N is nothing but Nd and P would be Ni square over Nd. Ni square over N this is nothing but Ni square over Nd. Now if we keep increasing temperature further there is going to come a point when electrons are starting to get ionized from the valence band. In this particular case the semiconductor now behaves as an intrinsic semiconductor and we define this temperature as Ti. So we define Ti as a temperature when N is equal to 1.1 Nd. So you have extra carriers that are now coming from the valence band of the silicon and this makes it an intrinsic semiconductor. So we had two temperatures Ts and Ti. So Ts was 0.9 Nd, Ti is 1.1 Nd. So we have a regime where the carrier concentration varies within 10%. So we have a regime where the carrier concentration varies within 10%. If you want to calculate the value of Ti, the intrinsic temperature we can look at the numbers. So N is 1.1 Nd and we are going to treat this as intrinsic. In any semiconductor the total charge should be balanced. So N is equal to P plus Nd. So that P is 0.1. We also know that Np is Ni square and then doing the math we get Ni to be 0.33 Nd. So N is 10% more than your donor concentration and at that temperature Ni is approximately 0.33 Nd. We can use this expression Ni equal the square root of NcNv exponential minus Eg over 2kt. But now the temperature will be Ti, which is your intrinsic temperature. You can substitute in the values. Once again we will assume that Nc and Nv are independent of temperature. That gives you a Ti of approximately 584 Kelvin. If you try to convert that into degrees, this is approximately 584 Kelvin. 310 degrees. Above this temperature the semiconductor essentially behaves as an intrinsic temperature. So in the case of silicon, we have a regime starting from the saturation temperature which is around 50 Kelvin or 60 Kelvin to an intrinsic temperature that is around 584 Kelvin, where the carrier concentration is essentially a constant and it is equal to the donor concentration. The difference is only within 10%. This means the conductivity will also be very stable because the conductivity depends upon the carrier concentration. If we put these numbers together and did a plot of the log of the carrier concentration versus 1 over T, we can compare that to your intrinsic semiconductor. In the case of an intrinsic, you have already done this before, log of N versus 1 over T is just a straight line with one slope. So this is intrinsic. You can do the same for extrinsic. So now instead of one slope, we will have two slopes and we have three regimes. In this particular case, since this is 1 over T, this is low temperature and this is high temperature. So at low temperature, you have electrons coming from your donor level. So you have a straight line with a slope that is given by your donor ionization. Then we have a situation where the donors are all ionized and your carrier concentration is almost a constant. At some high temperature, we are going to get new carriers from the valence band. The material behaves like intrinsic. So this is minus e g over 2 k. So we have three regimes, an ionization regime, a saturation regime where the carrier concentration is almost a constant and then finally, an intrinsic regime where the material starts to behave like an intrinsic semiconductor. So we will stop here for today. In the next class, we will look at how the conductivity changes. It is a function of temperature and we also look at the effect of doping on the mobilities of electrons and holes.