[Karsten Nohl] has recently joined the team on Flylogic’s blog. You may remember him as part of the team that reverse engineered the crypto in MiFare RFID chips. In his first post, he starts out with the basics of identifying logic cells. By studying the specific layout of the transistors you can reproduce the actual logic functions of the chip. The end of post holds a challenge for next week (pictured above). It has 34 transistors, 3 inputs, 2 outputs, and time variant behavior. Also, check out the Silicon Zoo which catalogs individual logic cells for identification.
4 thoughts on “Reverse Engineering Silicon Logic”
Leave a Reply
Please be kind and respectful to help make the comments section excellent. (Comment Policy)
Not only is Flylogic a fascinating read, but their scans make excellent dekstop backgrounds.
… and in Firefox 2.0.0.1, this text box is no longer bounded by the vertical line to its right. I keep typing, and I can see the cursor blinking way off toward the recent comments.
Hi. Is there a site that has a better diagram of these
transistors that labeled? I’m having some trouble
understanding the one in that post. I think I see the
source,gate, and drain, but they don’t match up with the
transistor symbol. If there is a site that explains them
better, that would be awesome. Thanks.
I completed the challange an I thought the photos were great. Look for diffusion cuts running horizontal and poly gates running mostly vertical. Keep in mind that source and drains can be shared between transistors.
-jer
I know next to nothing about this stuff but wonder
if a library of functions could be used to construct,
in effect, an OCR system that would take these images
of the whole circuit and output the program that it
implements.