Practical Partial Hardware Reverse Engineering Analysis

Abstract

Reverse engineering typically requires expensive equipment, skilled technicians, time, a cross section of the component to be sliced out and a dedicated reconstruction software. In this paper, we present a low-cost alternative, combining fast frontside sample preparation, electron microscopy imaging, error-free standard cell recognition and within and between-die standard cell statistical analysis (SCSA).Step-by-step, we depict the process to access the transistor's drain/source area, to acquire the full area of a single chip layer, to adapt pattern recognition for standard cells and to analyze the standard cell width, local/global location and occurrences number. The inner workings of each step are accompanied by results on 45-65-nm FCBGA devices enabling to locate specific areas (e.g. registers, hardware accelerator). We particularly point out the importance of such design information extraction for local fault injection and hardware assurance. The primary goal is to analyze how much design information of a complex integrated circuit can be retrieved with minimal costs and without outsourcing.

REFICS: Assimilating Data-Driven Paradigms Into Reverse Engineering and Hardware Assurance on Integrated Circuits

“…There are several works that perform RE on a particular IC, typically a smart card, as a case study for reporting on the challenges and resources cost incurred during the work [6], [19], [58]- [61]. The modules in the RE workflow shown in Figure 1 mostly acts as a placeholder.…”

Hardware Trust and Assurance through Reverse Engineering: A Survey and Outlook from Image Analysis and Machine Learning Perspectives

“…In [57], an algorithm has been introduced that could extract candidates from the standard cell library using the contact layer constrained by the amount of data available. Another approach using the doping layer has also been discussed in [64]. The extracted standard cell library can be used to generate the netlist of the IC.…”

“…As an example, the space complexity associated Fig. 26: Via and trace vectorized features with acquiring images of the entire doping layer of a 45nm node technology IC has been over 22 gigabytes [64]. For a full-blown RE process conducted on ICs with present-day technology nodes or a multi-layered PCB, several terabytes of data should be stored.…”

Automated Defect Inspection in Reverse Engineering of Integrated Circuits

“…Like us, they demand that the first step is to ensure that the image content is not corrupted by delayering and stitching errors. Courbon [4] is the first to propose defect control on the way to feature extraction. The rule-based algorithms deal specifically with defects at the standard cell level of the IC.…”