At my uni, 15 years ago, one postdoc reverse engineered NVIDIA chip and wrote more performant compiler. He did that by connecting oscyloscops to all chip's outputs and started with applying random current on inputs. Using ML and his genius he rediscoverd all opcodes including a few hidden ones. Eventually he got hired by some company that was doing a lot of GPU on supercomputers.
Detailed write-up please, or it didn't happen. At least not as described.
Really simple ICs with a few counters etc in there might be possible to RE this way. Complex ICs with lots of internal state, memory blocks etc like a modern-ish GPU? Not a chance.
Some hybrid approach? Software fiddling with the chip's internals, with say. a big FPGA attached to physically probe outputs? Architecture docs, and maybe some IC die shots at hand? Perhaps (hence my ask for "detailed").
Sounds like requiring the kind of hardware setup that would not be available to uni students.
Getting a logic-gate-level netlist from a GDS is trivial with industry standard chip design tools. Circuit designers do this every day. The hardest part will be reverse engineering the functionality.
I wish I had more time and I'd throw Calibre at it.
I've looked at Visual 6502 and it's way beyond me. I've even looked at the scans where it shows how they severed the connection to disable 6502 decimal mode on the NES.
I reverse engineered the Game Boy from pictures of the die - https://github.com/aappleby/metroboy - so yes, it's totally doable. It is also incredibly tedious and frustrating.
Not sure if that gives me an advantage in this challenge, but I have too many things to do already. :D
Earlier this year I watched a video from a conference where a researcher took a die shot (one of Ken's I think) and then did guided learning by identifying on the image which were the different layers, metals, and layout of the gates on the die. The machine learning algorithm could go off and identify other gates and provide a netlist(?).
I've tried searching REverse, and some of the hacker conferences from January, but haven't found it yet.
That paragraph + illustration is one of the simplest, concise, easy-to-grasp descriptions of IC design process I've come across. Nice!
Now the reverse: what I'd really love is a free (libre) automated toolset to go from IC die shot(s) -> transistors+interconnects -> gate-level schematic (logic gates & flipflops). Person interested in RE a chip's function can take it from there.
To me, the whole "here's a section of the die photo" to "that's an n-bit adder" etc step is like black magic. Not to mention extremely tedious.
Get that to a higher-level view easy, and it would be much more doable to work out function of each element.
Solved it. Took me ~6 human hours, over a total of 24 hours. But it was NOT easy!
I've been making chips for amost 30 years, and I run the https://github.com/smprather/engineering-loadout project, so I had all the tools sitting at my fingertips (KLayout, Surfer, Icarus Verilog, etc).
25 comments
[ 0.27 ms ] story [ 35.7 ms ] threadI was waiting for some writeup about permutation decyphering
but reminds me how we're going to find out on an industrial level when the Saudis give China some nvidia chips they were grifted
they've cloned lots of chips before but nothing that advanced
Really simple ICs with a few counters etc in there might be possible to RE this way. Complex ICs with lots of internal state, memory blocks etc like a modern-ish GPU? Not a chance.
Some hybrid approach? Software fiddling with the chip's internals, with say. a big FPGA attached to physically probe outputs? Architecture docs, and maybe some IC die shots at hand? Perhaps (hence my ask for "detailed").
Sounds like requiring the kind of hardware setup that would not be available to uni students.
https://blog.dragonsector.pl/2017/10/?m=1
Rapid Chip Reverse Engineering Using Laser, Focused ion beams, and Scanning electron microscope https://academic.oup.com/mam/article/30/Supplement_1/ozae044...
FIBs are also used to test modifications before doing a respin. I'm still in awe that matter can be manipulated so precisely
I wish I had more time and I'd throw Calibre at it.
https://siliconzoo.org/tutorial.html
Not sure if that gives me an advantage in this challenge, but I have too many things to do already. :D
I've tried searching REverse, and some of the hacker conferences from January, but haven't found it yet.
That paragraph + illustration is one of the simplest, concise, easy-to-grasp descriptions of IC design process I've come across. Nice!
Now the reverse: what I'd really love is a free (libre) automated toolset to go from IC die shot(s) -> transistors+interconnects -> gate-level schematic (logic gates & flipflops). Person interested in RE a chip's function can take it from there.
To me, the whole "here's a section of the die photo" to "that's an n-bit adder" etc step is like black magic. Not to mention extremely tedious.
Get that to a higher-level view easy, and it would be much more doable to work out function of each element.
I've been making chips for amost 30 years, and I run the https://github.com/smprather/engineering-loadout project, so I had all the tools sitting at my fingertips (KLayout, Surfer, Icarus Verilog, etc).