544
6 Reverse Engineering of Microcircuits
Fig. 6.26 A fragment of a ROM programmed by metallization mask [5]
this project, in fact, the researchers annotated the entire chip twice and compared the
results to minimize possible annotation mistakes.
After that, partial structure was formed in the circuit. The scheme of the memory
part was assembled as a separate structure; main registers of the digital unit were
also grouped. Special labels were applied to some of the larger buses, and the
corresponding I/O was connected to the main blocks.
In order to launch modeling of the entire chip on the netlist, the specialists had to
perform extraction of all the contents of the chip, including both the hardware part
and the memory contents. Different memory types have their own issues related to
reading their memory. The most basic SRAMs are the embedded ones. This type of
memory is volatile; it does not save data when the power is turned off, so there is no
need to carry out extraction for it specifically. For ROM, extraction can be performed
using conventional methods of reverse engineering in the form of physical reverse
reading of mask programming. Figure 6.26 shows the ROM programmed with the
mask of metal 1. Unfortunately, EEPROMs are much more complex than any of the
two previous types of memory.
Thanks to publicly available information, the analysts [5] knew that this chip
contained an encryption block on chip, and that its keys were saved in EEPROM. As
expected, memory was well protected, and most of this memory could not be read
directly outside the chip. Moreover, the interface to this chip was encrypted, so the
6 Reverse Engineering of Microcircuits
Fig. 6.26 A fragment of a ROM programmed by metallization mask [5]
this project, in fact, the researchers annotated the entire chip twice and compared the
results to minimize possible annotation mistakes.
After that, partial structure was formed in the circuit. The scheme of the memory
part was assembled as a separate structure; main registers of the digital unit were
also grouped. Special labels were applied to some of the larger buses, and the
corresponding I/O was connected to the main blocks.
In order to launch modeling of the entire chip on the netlist, the specialists had to
perform extraction of all the contents of the chip, including both the hardware part
and the memory contents. Different memory types have their own issues related to
reading their memory. The most basic SRAMs are the embedded ones. This type of
memory is volatile; it does not save data when the power is turned off, so there is no
need to carry out extraction for it specifically. For ROM, extraction can be performed
using conventional methods of reverse engineering in the form of physical reverse
reading of mask programming. Figure 6.26 shows the ROM programmed with the
mask of metal 1. Unfortunately, EEPROMs are much more complex than any of the
two previous types of memory.
Thanks to publicly available information, the analysts [5] knew that this chip
contained an encryption block on chip, and that its keys were saved in EEPROM. As
expected, memory was well protected, and most of this memory could not be read
directly outside the chip. Moreover, the interface to this chip was encrypted, so the