Practical Partial Hardware Reverse Engineering Analysis

Reverse engineering typically requires expensive equipment, skilled technicians, time, a cross section of the component to be sliced out, and a dedicated reconstruction software. In this paper, we present a low-cost alternative, combining fast frontside sample preparation, electron microscopy imaging, error-free standard cell recognition, as well as within and between-die Standard Cell Statistical Analysis (SCSA). Step-by-step, we depict the process to access the transistor's drain/source area; to acquire the full area of a single chip layer; to adapt pattern recognition for standard cells and to analyze the standard cell width, local / global location and occurrences number. The inner workings of each step are accompagnied by results on 45-65nm FCBGA devices enabling to locate specific areas (e.g. registers, hardware accelerator). We particularly point out the importance of such design information extraction for local fault injection and hardware assurance. The primary goal is to analyse how much design information of a complex integrated circuit can be retrieved with minimal costs and without outsourcing