For large area, high resolution SEM imaging applications, such as integrated circuit (IC) reverse engineering and connectomics [1-3], SEM instruments are limited by small, uncalibrated fields of view (FOVs) and imprecise sample positioning. These limitations affect image capture throughput, requiring more stage drive time and larger image overlaps. Furthermore, these instrument limitations introduce stitching errors in 4 dimensions of the image data, X, Y, Z and I (signal intensity). Throughput and stitching errors are cited challenges [2] and software alone cannot tenably correct stitching errors in large image datasets [3]. Furthermore, software corrections can introduce additional errors into the image data via the scaling, rotation, and twisting of the images. So software has proven insufficient for reverse engineering of modern integrated circuits. Our methodology addresses the challenges brought on by small, uncalibrated FOVs and imprecise sample positioning by combining the resolution and flexibility of the SEM instrument with the accuracy (of the order 10 nm), stability, and automation of the electron beam lithography (EBL) instrument. With its unique combination of high resolution SEM imaging (up to 50,000 pixels x 50,000 pixels for each image), laser interferometer stage positioning, and FOV mapping, the reverse engineering scanning electron microscope (RE-SEM) produces the most accurate large area, high resolution images directly acquired by an SEM instrument [4]. Since the absolute position of each pixel is known ultimately to the accuracy afforded by the laser interferometer stage, these images can be stacked (3D-stitched) with the highest possible accuracy. Thus, the RE-SEM has been used to successfully reconstruct a current PC-CPU at the 22 nm node.

Competitive circuit analysis of an Integrated Circuit (IC) is one of the most challenging types of analysis. It involves various high technology steps of IC die de-processing/de-layering; keeping precise planarity from metal layer to metal layer, Scanning Electron Microscope (SEM) imaging and images mosaicking, image recognition and Graphic Database System (GDS) segmentation processes and finally logic and architecture level analysis. One of the most complicated analysis is Power Management and Power Distribution [2] on the entire IC die when no datasheet or other IC’s information is available. Power Distribution analysis requires the highest level of architecture analysis, not feasible by conventional Reverse Engineering (RE) methods or extremely costly. The current paper discusses and demonstrates a new inventive methodology of Power Distribution analysis using known FIB Passive Voltage Contrast (PVC) effects [1]. This patented technique provides significant time and resources saving.

The need for reverse engineering (for IP verification or for reproducibility) has reached unprecedented levels requiring not only the inspection of the circuitry but also the understanding of the packaging and interconnects. Achieving the best X-ray inspection for a particular application depends on an in-depth understanding of the X-ray system configuration, the sample configuration, and the sample preparation techniques available. This paper presents various case examples on the development of advanced X-ray inspection techniques for IC reverse engineering, along with information on the limitations of X-ray imaging, issues with 3D reconstruction, models for resolution configuration improvement, and advantages and disadvantages of advanced sample preparation techniques. It is observed that the novel X-ray inspection techniques, combined with appropriate sample prep techniques, provide the necessary resolution to achieve results necessary for current reverse engineering needs.

We present a characterization methodology for fast direct measurement of the charge accumulated on Floating Gate (FG) transistors of Flash EEPROM cells. Using a Scanning Electron Microscope (SEM) in Passive Voltage Contrast (PVC) mode we were able to distinguish between '0' and '1' bit values stored in each memory cell. Moreover, it was possible to characterize the remaining charge on the FG; thus making this technique valuable for Failure Analysis applications for data retention measurements in Flash EEPROM. The technique is at least two orders of magnitude faster than state-of-the-art Scanning Probe Microscopy (SPM) methods. Only a relatively simple backside sample preparation is necessary for accessing the FG of memory transistors. The technique presented was successfully implemented on a 0.35 μm technology node microcontroller and a 0.21 μm smart card integrated circuit. We also show the ease of such technique to cover all cells of a memory (using intrinsic features of SEM) and to automate memory cells characterization using standard image processing technique.

Programmable logics, such as complex programmable logic devices (CPLDs) and field programmable gate arrays (FPGAs), are widely used in security applications. In these applications cryptographic ciphers, physically unclonable functions (PUFs) and other security primitives are implemented on such platforms. These security primitives can be the target of fault injection attacks. One of the most powerful examples of fault injection techniques is laser fault injection (LFI), which can induce permanent or transient faults into the configuration memories of programmable logic. However, localization of fault sensitive locations on the chip requires reverse-engineering of the utilized building blocks, and therefore, is a tedious task. In this work, we propose an automated technique using readily available IC debug tools to map and profile the fault sensitive locations of programmable logic devices in a short period.

Reliance on third-party resources, including thirdparty IP cores and fabrication foundries, as well as wide usage of commercial-off-the-shelf (COTS) components has raised concerns that backdoors and/or hardware Trojans may be inserted into fabricated chips. Defending against hardware backdoors and/or Trojans has primarily focused on detection at various stages in the supply chain. Netlist reverse engineering tools have been investigated as an alternative to existing chip-level reverse engineering methods which can help recover functional netlists from fabricated chips, but fall short of detecting malicious logic or recovering high-level functionality. In this work, we develop a netlist reverse engineering tool-set which recovers high-level functionality from the netlist, thereby aiding malicious logic detection. The tool-set performs state register identification, control logic recovery and datapath tracking, which facilitates validation of encrypted/obfuscated hardware IP cores. Relying on 3-SAT algorithms and topology-based computational methods, we demonstrate that the developed tool-set can handle netlists of various complexities.

Reverse engineering of electronic hardware has been performed for decades for two broad purposes: (1) honest and legal means for failure analysis and trust verification; and (2) dishonest and illegal means of cloning, counterfeiting, and development of attacks on hardware to gain competitive edge in a market. Destructive methods have been typically considered most effective to reverse engineer Printed Circuit Boards (PCBs) – a platform used in nearly all electronic systems to mechanically support and electrically connect all hardware components. However, the advent of advanced characterization and imaging tools such as X-ray tomography has shifted the reverse engineering of electronics toward non-destructive methods. These methods considerably lower the associated time and cost to reverse engineer a complex multi-layer PCB. In this paper, we introduce a new anti–reverse engineering method to protect PCBs from non-destructive reverse engineering. We add high-Z materials inside PCBs and develop advanced layout algorithms, which create inevitable imaging artifacts during tomography, thereby making it practically infeasible for an adversary to extract correct design information with X-ray tomography.