A Comprehensive FPGA Reverse Engineering Tool-Chain: From Bitstream to RTL Code
As recently studied, field-programmable gate arrays (FPGAs) suffer from growing Hardware Trojan (HT) attacks, and many techniques, e.g., register-transfer level (RTL) code-based analyzing, have been presented to detect HTs on FPGAs. However, for most of the FPGA end users, they can only obtain bitst...
| Main Authors: | , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
IEEE
2019-01-01
|
| Series: | IEEE Access |
| Subjects: | |
| Online Access: | https://ieeexplore.ieee.org/document/8653869/ |
| _version_ | 1818603450519257088 |
|---|---|
| author | Tao Zhang Jian Wang Shize Guo Zhe Chen |
| author_facet | Tao Zhang Jian Wang Shize Guo Zhe Chen |
| author_sort | Tao Zhang |
| collection | DOAJ |
| description | As recently studied, field-programmable gate arrays (FPGAs) suffer from growing Hardware Trojan (HT) attacks, and many techniques, e.g., register-transfer level (RTL) code-based analyzing, have been presented to detect HTs on FPGAs. However, for most of the FPGA end users, they can only obtain bitstream, rather than the RTL code. Therefore, we present a new FPGA reverse engineering tool-chain. It can precisely transform the FPGA bitstream to an RTL code and therefore assists in HT detection. In detail, we first construct an integrated database involving the FPGA architecture information and the bitstream mapping information. Then, we build two tools, namely, bitstream reversal tool (BRT) and netlist reversal tool (NRT). They can be combined together to retrieve the RTL code from the FPGA bitstream in moderate time. To demonstrate the effectiveness of our tool-chain, we evaluate it qualitatively and quantitatively by using two benchmarks (ISCAS'85 and ISCAS'89) and three real applications (8051 core, 68HC08, and AES). Our tool-chain is comprehensive since it covers all the reverse engineering stages, from bitstream to netlist and from netlist to code, without any support from other tools. Moreover, it rebuilds the netlist with a 100% correct rate and retrieves RTL code, which is exactly, functionally equivalent to the original one for all our benchmarks. To the best of our knowledge, it is the first tool that can perform integrated, precise reverse engineering for FPGAs, paving the way for the netlist-/code-based HT detection. |
| first_indexed | 2024-12-16T13:23:22Z |
| format | Article |
| id | doaj.art-3a973842b5dc45d3a30184cd502e4c32 |
| institution | Directory Open Access Journal |
| issn | 2169-3536 |
| language | English |
| last_indexed | 2024-12-16T13:23:22Z |
| publishDate | 2019-01-01 |
| publisher | IEEE |
| record_format | Article |
| series | IEEE Access |
| spelling | doaj.art-3a973842b5dc45d3a30184cd502e4c322022-12-21T22:30:17ZengIEEEIEEE Access2169-35362019-01-017383793838910.1109/ACCESS.2019.29019498653869A Comprehensive FPGA Reverse Engineering Tool-Chain: From Bitstream to RTL CodeTao Zhang0Jian Wang1https://orcid.org/0000-0001-5416-0649Shize Guo2Zhe Chen3School of Information and Communication Engineering, University of Electronic Science and Technology of China, Chengdu, ChinaSchool of Information and Communication Engineering, University of Electronic Science and Technology of China, Chengdu, ChinaSchool of Information and Communication Engineering, University of Electronic Science and Technology of China, Chengdu, ChinaSchool of Information and Communication Engineering, University of Electronic Science and Technology of China, Chengdu, ChinaAs recently studied, field-programmable gate arrays (FPGAs) suffer from growing Hardware Trojan (HT) attacks, and many techniques, e.g., register-transfer level (RTL) code-based analyzing, have been presented to detect HTs on FPGAs. However, for most of the FPGA end users, they can only obtain bitstream, rather than the RTL code. Therefore, we present a new FPGA reverse engineering tool-chain. It can precisely transform the FPGA bitstream to an RTL code and therefore assists in HT detection. In detail, we first construct an integrated database involving the FPGA architecture information and the bitstream mapping information. Then, we build two tools, namely, bitstream reversal tool (BRT) and netlist reversal tool (NRT). They can be combined together to retrieve the RTL code from the FPGA bitstream in moderate time. To demonstrate the effectiveness of our tool-chain, we evaluate it qualitatively and quantitatively by using two benchmarks (ISCAS'85 and ISCAS'89) and three real applications (8051 core, 68HC08, and AES). Our tool-chain is comprehensive since it covers all the reverse engineering stages, from bitstream to netlist and from netlist to code, without any support from other tools. Moreover, it rebuilds the netlist with a 100% correct rate and retrieves RTL code, which is exactly, functionally equivalent to the original one for all our benchmarks. To the best of our knowledge, it is the first tool that can perform integrated, precise reverse engineering for FPGAs, paving the way for the netlist-/code-based HT detection.https://ieeexplore.ieee.org/document/8653869/FPGAreverse engineeringbitstreamhardware trojan |
| spellingShingle | Tao Zhang Jian Wang Shize Guo Zhe Chen A Comprehensive FPGA Reverse Engineering Tool-Chain: From Bitstream to RTL Code IEEE Access FPGA reverse engineering bitstream hardware trojan |
| title | A Comprehensive FPGA Reverse Engineering Tool-Chain: From Bitstream to RTL Code |
| title_full | A Comprehensive FPGA Reverse Engineering Tool-Chain: From Bitstream to RTL Code |
| title_fullStr | A Comprehensive FPGA Reverse Engineering Tool-Chain: From Bitstream to RTL Code |
| title_full_unstemmed | A Comprehensive FPGA Reverse Engineering Tool-Chain: From Bitstream to RTL Code |
| title_short | A Comprehensive FPGA Reverse Engineering Tool-Chain: From Bitstream to RTL Code |
| title_sort | comprehensive fpga reverse engineering tool chain from bitstream to rtl code |
| topic | FPGA reverse engineering bitstream hardware trojan |
| url | https://ieeexplore.ieee.org/document/8653869/ |
| work_keys_str_mv | AT taozhang acomprehensivefpgareverseengineeringtoolchainfrombitstreamtortlcode AT jianwang acomprehensivefpgareverseengineeringtoolchainfrombitstreamtortlcode AT shizeguo acomprehensivefpgareverseengineeringtoolchainfrombitstreamtortlcode AT zhechen acomprehensivefpgareverseengineeringtoolchainfrombitstreamtortlcode AT taozhang comprehensivefpgareverseengineeringtoolchainfrombitstreamtortlcode AT jianwang comprehensivefpgareverseengineeringtoolchainfrombitstreamtortlcode AT shizeguo comprehensivefpgareverseengineeringtoolchainfrombitstreamtortlcode AT zhechen comprehensivefpgareverseengineeringtoolchainfrombitstreamtortlcode |