REcon 2019 -The ROM matric revolution:Unscrambling bits by Chris Gerlinsky

### Overview In this presentation at REcon 2019, Chris Gerlinsky discusses methods for optically extracting and descrambling data from mask ROM embedded in integrated circuits. Mask ROM physically stores data within a chip's silicon structures and is commonly used for boot ROMs. While chip manufacturers often implement ROM scrambling or lightweight encryption to prevent visual readout, real-world constraints such as execution latency, silicon area, and power consumption frequently force vendors to rely on weak, homebrew scrambling techniques. Gerlinsky demonstrates how these scrambles can often be reversed simply by analyzing visual patterns, bit mirroring, and predictable structural properties in microscopy images.

### Key Topics - **Mask ROM and Physical Extraction**: Understanding mask ROM as a physical, silicon-level matrix (via transistors, implant layers, or metal links) readable under optical or scanning electron microscopes (SEM). - **Visual Bit Extraction & Tooling**: Using custom software to extract raw binary grids from microscope imagery and map bits into bytes by analyzing address buses and layout orientations. - **ROM Scrambling Constraints**: Hardware trade-offs—such as the need for single-cycle arbitrary byte decryption, ultra-low power consumption, and minimal die size—that lead chip designers to implement simple bit swaps and XOR schemes rather than strong cryptography. - **Pattern-Based Descrambling Case Studies**: Practical attacks against real-world silicon, including EM Microelectronics chips and STMicroelectronics ST19 smart card families (K5 and K7 series). - **Alternative ROM Decryption Approaches**: Hardware-level attacks including microprobing data buses, netlist recovery from SEM imagery via tools like Texplained's Chip Juice, and Focused Ion Beam (FIB) circuit modification.

### Technical Details - **Bit Extraction**: Gerlinsky photographs de-layered chips (using hydrofluoric acid and dash etching for implant ROMs). Software detects light and dark spots on a grid, outputting raw binary strings. Layout analysis accounts for column-to-column mirroring and bitline grouping (e.g., bit 0 in one column, bit 1 in another). - **EM Microelectronics Case Study**: A chip with an unusual ROM size of 4,448 bytes (hex 0x1160) revealed an encryption scheme using an 8-byte key generated by XORing all used plaintext code space. Inverting and XORing adjacent 8-byte rows unlocked sequential plaintext. An unencrypted 8-byte block of valid 8051 assembly (`80FE` infinite loop and vector jumps) served as the breakthrough clue. - **STMicroelectronics ST19 Case Study**: Examined ST19K5 (8 columns) and ST19K7 (16 columns, paired 8-bit output) chips used in pay TV, transit cards (such as the Opus smart card), and printer cartridges. In older firmware, uninitialized memory filled with zeros revealed clear checkerboard inversion patterns; newer revisions filled empty space with random data, but retained the exact same underlying logic. Using known plaintext dumps obtained via voltage/clock glitching, Gerlinsky wrote simple pattern-reversing scripts chained together in batch files to successfully descramble the ROM. - **Advanced Hardware Decryption**: Gerlinsky highlights other known attacks: Cambridge University research involving microprobing the data bus to reverse S-box mappings by injecting faults; automated netlist reconstruction from SEM images using Texplained's Chip Juice; and Chris Tarnovsky’s FIB technique of bypassing active shield layers and dropping probe needles directly onto post-decryption buses.

### Takeaways Vendors frequently market weak bit-shuffling and XOR mechanisms as "encryption," but because code contains recognizable features (like ASCII tables, jump vectors, and padding), visual patterns readily leak through. Once a single chip in a family is reversed, any other product sharing that silicon platform becomes vulnerable. Ultimately, masking secrets in ROM provides a false sense of security, as ROM is physically designed to be read.