Integrated Circuit Offensive Security | Olivier Thomas from Texplained | hardwear.io USA 2019

### Overview In this talk presented at hardwear.io USA 2019, Olivier Thomas, founder and CTO of Texplained and co-founder of IC's Inside, discusses offensive security and physical reverse engineering of integrated circuits (ICs). Rather than relying solely on black-box attacks or traditional cross-sectional signal tracing, Thomas explains the methodology of deprocessing a silicon die down layer-by-layer to reconstruct a digital netlist and HDL/VHDL model directly from microscopic imagery. He demonstrates how this structural modeling empowers targeted fault injection, code extraction, and security evaluations.

### Key Topics - **Integrated Circuit Deprocessing:** Combining wet chemicals, plasma etching (dry etching), and mechanical polishing (chemical mechanical polishing/CMP) to cleanly strip passivation, metal interconnect layers, vias, and contacts down to the doped silicon substrate. - **Imaging and Feature Extraction:** Utilizing Scanning Electron Microscopy (SEM) for high-resolution imaging (often generating hundreds of gigabytes per chip) to extract polygons representing metal tracks, vias, contacts, and standard cell footprints. - **HDL Netlist Reconstruction:** Mapping transistor configurations to standard cell libraries to generate a flat VHDL model that can be simulated in EDA tools. - **Offensive Analysis and Attack Simulation:** Using the extracted netlist to trace signal paths, locate registers and scan chains (JTAG/debug logic), simulate attacks, and defeat ROM encryption or scrambling. - **Hardware Trojans and Supply Chain Validation:** Comparing physical layout features against golden models to detect unauthorized modifications or backdoors. - **Flaws in Hardware Certification Schemes:** Critiquing evaluation frameworks such as Common Criteria, where invasive attacks are often treated as residual risk once high-tier ratings (e.g., AVA_VAN.5 / high rating thresholds) are scored.

### Technical Details - **Deprocessing Methodology:** Thomas highlights the limitations of using wet chemicals alone, which cause uneven surfaces and holes on modern small nodes. Plasma etching removes oxide and metal selectively based on gas chemistry, but requires combination with mechanical polishing (using diamond-coated discs on a high-precision multi-axis arm) to avoid messy line profiles. - **Feature Recognition to Netlist:** Deprocessed layers are imaged using an SEM (capable of ~0.7 nm/pixel resolution). Specialized software detects millions of contacts, lines, and standard cells (e.g., multiplexers, flip-flops, combinatorial logic) across multiple metal and poly layers, producing a simulatable VHDL representation in 10–20 minutes once annotated. - **Interactive Signal Tracing:** In a live demonstration on an 8-bit microcontroller core, Thomas demonstrates tracing memory output lines forward through standard cells to identify 8 flip-flops comprising an 8-bit register. Further tracing reveals scan-chain connections and allows pinpointing the control logic needed to unlock debug interfaces like JTAG. - **Defeating Complex Memory Protections:** For ROM structures protected by word-line/bit-line scrambling and core-level encryption, Thomas models the address decoders, memory array, and downstream decryption logic in VHDL. By writing a test bench simulating addresses, the model outputs decrypted values without requiring direct microprobing or FIB circuit edits. - **Precision Fault Injection ("Smart Gun"):** Correlating netlists with physical coordinates enables surgical fault injection. Distinguishing combinatorial cells (where glitches are transient) from sequential cells (registers/flip-flops where fault states latch) allows attackers to construct targeted laser or clock glitching maps rather than blindly testing locations across the die.

### Takeaways Physical IC reverse engineering to the netlist level shifts the security paradigm from black-box physical testing to structured, simulated attacks. Certification schemes like Common Criteria frequently undervalue these invasive modeling approaches by scoring out earlier in evaluations. Beyond offensive vulnerability assessment, netlist extraction serves critical defensive and engineering use cases, including supply chain Trojan detection, intellectual property (IP) infringement verification, obsolete component reproduction (FPGA replacement), and forensic law enforcement investigation.