I am looking to determine the plausibility of reverse engineering a design from an FPGA. Suppose a company fabricates their revolutionary design on FPGAs and I have managed to acquire one. My goal is to remove the configuration from the chip and rebuild the Netlist, preferably in EDIF. I know that FPGA design security is a major concern so that leads me to believe that the design has been successfully removed from an FPGA in the past...? I figure there is no 'standard' way to achieve this but is there a known/documented way I haven't come across yet?
What I know so far is that there are three primary types of FPGAs: SRAM, Flash and anti-fuse.
- Anti-fuse chips have their design seared into them permanently with high-voltage; the complexity of re-engineering the design seems far too large so we'll just forget about them for now.
- Flash chips have the design stored non-volatiley inside the FPGA. Though considered 'live at power-up' the design is loaded from the internal flash memory to the FPGA. If this flash can be accessed it seems that we can remove the configuration data and build the netlist from there.
- SRAM chips store the design in some external memory (such as an EEPROM or some RAM). It seems this memory is generally configured with a JTAG interface which tells me that it shouldn't be too difficult to remove the configuration.
I am aware that these days most FPGAs have their configuration data encrypted on the device. This is a separate problem and for the moment let's ignore it.
Once the plain-text configuration is acquired there seems to be the issue of format. It seems that most CAD tools have their own bit-stream formats. So far I have come across
- SVF - Serial Vector Format
- XSVF - Improved Serial Vector Format
- STAPL - Altera
- JIC - JTAG Indirect Configuration
- SOF - SRAM Object File
- POF - Program Object File
- RBF - Raw Binary File
- TTF - Tabular Text File
- BIT - Xilinx
- PDB - Actel
The goal is to end with a netlist in EDIF format, I have heard that there are translators in most common tools but I can't seem to find which, if any of the above formats are what are used to convert to EDIF. Are these configuration files what CAD tools use to represent a Netlist or must they first be converted into something else? If so do each of the respective tools provide means of doing so?