Posted by bschne 1 day ago
Not sure if that gives me an advantage in this challenge, but I have too many things to do already. :D
I've tried searching REverse, and some of the hacker conferences from January, but haven't found it yet.
giulioz: MMO-CHIP: From Microscope to Verilog in an hour[1]
source code is on github[2]
[1] https://www.youtube.com/watch?v=5211iYEqnzo [2] https://github.com/giulioz/mmo-chip
Rapid Chip Reverse Engineering Using Laser, Focused ion beams, and Scanning electron microscope https://academic.oup.com/mam/article/30/Supplement_1/ozae044...
FIBs are also used to test modifications before doing a respin. I'm still in awe that matter can be manipulated so precisely
That paragraph + illustration is one of the simplest, concise, easy-to-grasp descriptions of IC design process I've come across. Nice!
Now the reverse: what I'd really love is a free (libre) automated toolset to go from IC die shot(s) -> transistors+interconnects -> gate-level schematic (logic gates & flipflops). Person interested in RE a chip's function can take it from there.
To me, the whole "here's a section of the die photo" to "that's an n-bit adder" etc step is like black magic. Not to mention extremely tedious.
Get that to a higher-level view easy, and it would be much more doable to work out function of each element.
This is absolutely not how reverse engineering a digital logic ASIC works.
Either the story got embellished through retellings, or this person was a fantasist.
There are people who hack on GPUs but it’s done at the software level.
I did get a kick out of imagining a scene where someone is trying to connect an oscilloscope to a circuit board to reverse engineer the CPU opcodes. That’s like the CSI: Miami version of what this would look like.
You absolutely can reverse chips with logic analysis. It is big business in some parts of the world.
You are not going to reverse engineer a GPU with a logic analyzer and by applying currents to pins.
You could replace oscilloscope with logic analyzer in the comment above and nothing changes. It’s a fantasy story. The GPU I/O is high speed PCIe and memory buses.
If you want to explore the chip you connect it to a PCIe host and use the host. Connecting logic analyzers and applying current to pins does not make sense on any level.
Also, if you think probing high speed signals like PCIe or memory buses with logic analyzers is easy, you’ve probably never tried it. The equipment needed to do that properly is incredibly expensive because even probing those buses slightly incorrectly or with cheap probes will make them fail to work at the speeds they use.
You might be thinking that the hobby-level logic analyzers you're used to, are what folks who are serious about doing this kind of work would be using. Just, no.
>Connecting logic analyzers and applying current to pins does not make sense on any level.
Tell me you've never fuzzed a chip without telling me you never fuzzed a chip.
Nobody said it would be easy or cheap, or that fuzzing is the only way to do it. The OP may not have had all the details correct.
But, you certainly can reverse engineer high-density digital electronics this way.
No I'm not. I'm referring to the logic analyzers and probes, and fixturing that would be necessary to probe something like this.
It's not as simple as saying "wouldn't be cheap". I'm saying it's virtually impossible for a university student to do for fun with the resources available to them.
> Tell me you've never fuzzed a chip without telling me you never fuzzed a chip.
Please don't be snarky. Also please don't take my quotes out of context to try to attack a strawman.
I'm talking about the comment thread we're responding to about someone reverse engineering the opcodes by applying current to the pins.
Nobody is going to be fixturing up an nVidia GPU chip, acquiring enough probes and logic analyzer inputs to measure it, then applying currents to pins, just to reverse engineer the opcodes. You're off trying to argue something else to show off your knowledge on the internet, but you've missed the point of the thread.
If someone wants to reverse engineer a GPU, the first thing you do is plug it into a system and access it through software. Nobody is going to connect logic analyzers to a million pins and re-invent PCIe signaling just because it's technically possible to do.
Yes, people do this. Yes, it is a lot of tedious work. PCIe signaling is not a panacea - there are reasons to fuzz like this.
I've also seen folks break out a tunneling electron microscope to dig deeper on de-laminated cores.
>I'm saying it's virtually impossible for a university student to do for fun with the resources available to them.
Now who's inventing straw man claims? "For fun"? Yes, for fun. "For profit"? Yes, for profit too. At universities? Yes, at universities.
Just give it up. The world is big.
You can’t simply get an expensive logic analyzer and probe PCIe or memory buses at these speeds. There are expensive custom fixtures that need to be made to even begin to be able to probe at these speeds without disturbing the circuit so much that it fails to work. This isn’t like probing the I2C bus on a raspberry pi. It would be like connecting to the pins under the chip. It’s fantasy.
It’s also illogical. If you have a PCIe device, you plug it in to a PCIe host and use the host to interact with it. You don’t start probing pins and trying to apply signals to it.
Harnesses for such things are not cheap, nor are they something you can just order from Reichelt. But, I assure you, there are reverse engineering labs in the world that can do this. There are technicians who think nothing whatsoever of de-soldering a BGA and using microscopes to rig things up. They do it before lunch, even.
The OP may have some details wrong - they're clearly laymen describing an anecdote - but that doesn't mean for an instance that this "isn't possible".
There is always a higher-speed logic analyzer, capable of operating faster than the consumer device under test. That's how the consumer DUT's get tested at the ATE, in the first place ..
You keep missing the point and trying to insult my experience in the process.
We're talking about a university student and CPU opcodes. The whole side story about probing the chip is completely irrelevant. This is a software task.
> But, I assure you, there are reverse engineering labs in the world that can do this.
We're talking about a university student.
> There are technicians who think nothing whatsoever of de-soldering a BGA and using microscopes to rig things up. They do it before lunch, even.
I'm talking about the fixturing required to actually probe those pins. Replacing the BGA is the easy part. You can't probe a large BGA by having a tech remove and replace it. The contrast between you trying to insult my experience while not understanding the task at hand is truly something.
You've chosen a weird hill to die on, given how much you're arguing things that have no relevance to the story.
>I'm talking about the fixturing required to actually probe those pins.
This just isn't as impossible as you claim. And, there are plenty of reasons to do it.
Just because you can't imagine it, doesn't mean someone else hasn't already actually done it.
You'll have more luck reverse engineering the software driver first. They're not hidden, you can just open the driver files in Ghidra, the almost-universal tool for open-sourcing proprietary code. Hidden opcodes can be discovered first by just trying all the opcodes you couldn't discover any other way. You only need to go to the physical level if they're really hidden.
You can't tease out the right information by applying random inputs. Which input would you even use? The PCIe interface? You'd first "randomly" need to get past its complex training sequences...
Your postdoc probably wrote micro-benchmarks of some sort. That is a common technique.
So...agreed...far more likely there was a software solution of some kind if this happened.
And of course that's assuming that a) the JTAG port is accessible on these boards and b) the raw scan chain access before scan chain compression hasn't been fused off or isn't locked behind some authentication protocol.
So, no. That didn't happen either. :-)
Really simple ICs with a few counters etc in there might be possible to RE this way. Complex ICs with lots of internal state, memory blocks etc like a modern-ish GPU? Not a chance.
Some hybrid approach? Software fiddling with the chip's internals, with say. a big FPGA attached to physically probe outputs? Architecture docs, and maybe some IC die shots at hand? Perhaps (hence my ask for "detailed").
Sounds like requiring the kind of hardware setup that would not be available to uni students.
I wish I had more time and I'd throw Calibre at it.
This is just a job posting in disguise for Jane Street: solve the puzzle, get a call from one of their recruiters.
Modern systems tend to use "standard cells" for logic which is a lot more digestible.
I was waiting for some writeup about permutation decyphering