In-House Transistors’ Layer Reverse Engineering Characterization of a 45nm SoC

Abstract

Abstract Reverse engineering typically requires expensive equipment, skilled technicians, time, a cross section of the component to be sliced out, and a dedicated reconstruction software. In this paper, we present a low-cost alternative, combining fast frontside sample preparation, electron microscopy imaging, similar standard cell recognition, as well as within and between die Standard Cell Statistical Analysis (SCSA). We develop the process to access the transistor’s drain/source area; image the full surface; develop a robust pattern recognition tool and analyze the standard cell size, local / global location and occurrences number. We present the inner workings of each step and results on 45–65nm FCBGA devices enabling to locate specific areas (core registers, hardware accelerator, and so on) within a die, and find similarities between dies. We particularly point out the importance of such design information extraction for local fault injection and hardware assurance. The primary goal is to analyze how much integrated circuit design information can be retrieved with minimal costs and without outsourcing.