# CSCI 4974 / 6974 Hardware Reverse Engineering

**Important info:**

- Classes: Tuesday/Friday, 2:00 - 3:50, Low 3130
- Professor: Bulent Yener (yener@cs.rpi.edu). Office hours TBA
- TA: Andrew Zonenberg (zonena@rpi.edu). Office hours AE 119
  Tuesday/Friday 5-7 PM.
- Download the [Syllabus](syllabus.pdf)

**Timeline**\
*Draft notes for upcoming lectures are provided for advance study
purposes only and are subject to change. The version posted as of the
end of lecture is authoritative as far as material which will be covered
on quizzes etc.*

Date

Class

1/21/2014

[Lecture 1: Course overview, motivation, legal issues, switch model of
CMOS logic](Lecture1_Intro.pdf)

1/24/2014

[Lecture 2: Package construction](Lecture2_Packaging.pdf)

1/28/2014

[Quiz 1: CMOS schematics, packaging](Quiz1_CMOS_Sch.pdf)\
[Quiz 1a: Makeup exam](Quiz1a_CMOS_Sch_makeup.pdf)\
[Lecture 3: Depackaging](Lecture3_Depackaging.pdf)

1/31/2014

Lab 1: Depackaging demo (Lab group A only, no class for group B.
Location: MRC 166 EM lab)

2/4/2014

Lab 1: Depackaging demo (Lab group B only, no class for group A.
Location: MRC 166 EM lab)

2/7/2014

Lab 1a reports due\
[Quiz 2: Depackaging](Quiz2_Decapping.pdf)\
[Lecture 4: CMOS layout](Lecture4_Layout.pdf)\
[Download the example layouts](Lecture4_Examples.tar.gz)

2/11/2014

Lab 1b reports due\
[Quiz 3: CMOS layout](Quiz3_Layout.pdf)\
[Homework 1](hw1.pdf) out\
[Homework 1 images](hw1_data.tar.gz)\
[More homework 1 images](hw1_data2.tar.gz)\
[Lecture 5: Fabrication processes](Lecture5_FabProcesses.pdf)

2/14/2014

**No class**: Canceled due to heavy snow.

2/18/2014

**No class**: Follow Monday schedule.

2/21/2014

[Lecture 6: Deprocessing](Lecture6_Deprocessing.pdf)

2/25/2014

[Quiz 4: Process ID and deprocessing](Quiz4_Deprocessing.pdf)\
[Lecture 7: CPLD architecture](Lecture7_CPLDArch.pdf)

2/28/2014

[Quiz 5: CPLD architecture](Quiz5_CPLDArch.pdf)\
[Lecture 8: Microscopy and Imaging](Lecture8_Microscopy.pdf)\
[Files for in-class exercise](hugindemo.tar.gz)\

3/4/2014

Lab 2: SEM Imaging (Lab group A only, no class for group B. Location:
MRC EM lab)

3/7/2014

Lab 2: SEM Imaging (Lab group B only, no class for group A. Location:
MRC EM lab)\

3/11/2014

**No class:** Spring break

3/14/2014

**No class:** Spring break\
Happy pi day!

3/18/2014

Homework 1 due (tentative)\
Lab 2 reports due (both groups)\
[Quiz 6: Microscopy and imaging](Quiz6_Microscopy.pdf)\
[Lecture 9: Mask ROM layout](Lecture9_MaskROM.pdf)

3/21/2014

[Lecture 10: PROM/EPROM/EEPROM/efuse/Flash layout](Lecture10_EEPROM.pdf)

3/25/2014

[Lecture 11: SRAM layout](Lecture11_SRAM.pdf)

3/28/2014

[Quiz 7: Memory technology](Quiz7_Memory.pdf)\
[Lecture 12: Non-invasive attacks on
logic](Lecture12_NoninvasiveAttacks.pdf)

4/1/2014

Lecture 13: Fault attacks on crypto (joint lecture by Prof. Yener and
graduate student Brennan)\
[Prof. Yener\'s slides](Fault-Attacks-short.pdf)\
[Brennan\'s slides](DPA_Presentation.pdf)

4/4/2014

[Lecture 14: Invasive and semi-invasive
attacks](Lecture14_InvasiveAttacks.pdf)\
Lab 3: UV light attacks on PIC12F683 (both groups, during normal class
period)

4/8/2014

Lab 4: Invasive attacks (Lab group A only, no class for group B.
Location: Cleanroom test area)

4/11/2014

Lab 4: Invasive attacks (Lab group B only, no class for group A.
Location: Cleanroom test area)

4/15/2014

[Quiz 8: Attacks](Quiz8_Attacks.pdf)\
Homework 2 out: PCB RE (see slides)\
[Lecture 15: PCB RE: Component ID, block diagram
extraction](Lecture16_PCB_Analysis.pdf)

4/18/2014

Lecture 16: Guest lecture by Danny Walters (MITRE) on electromagnetic
side-channel attacks

4/22/2014

[Lecture 17: Anti-tamper / anti-analysis
techniques](Lecture15_Antitamper.pdf)

4/25/2014

[Lecture 18: PCB RE: Fab, deprocessing, netlist
extraction](Lecture18_PCB_Analysis2.pdf)

4/29/2014

[Quiz 9: PCB RE](Quiz9_PCBRE.pdf)\
[Lecture 19: Programmable logic: FPGAs](Lecture19_FPGA.pdf)

5/2/2014

[Lecture 20: Machine vision, automated RE
tools](Lecture20_MachineVision.pdf)

5/6/2014

Homework 2 presentations. No final exam.

**Announcements**

- 1/25/2014: Syllabus updated for new lab schedule and office hour
  times/locations
- 1/28/2014: Check out the [list of interesting
  chips](https://web.archive.org/web/20150201085737/https://docs.google.com/spreadsheet/ccc?key=0AkqT3htW1sFydFBaU0lfX2k5TjVudzhHR2tOQmhQRXc#gid=0)
  we might decap in lab #1. If anyone has votes, send them to the TA.
  (Large CPU packages are off limits for the lab because they tend to
  take a while to process.)
- 2/2/2014: Lab 1a data is available:
  - [Xilinx
    XC3S50AN](https://web.archive.org/web/20150201085737/http://siliconpr0n.org/archive/doku.php?id=azonenberg:xilinx:xc3s50an)
    (70% nitric, live decap)
  - [Xilinx
    XC9572XL](https://web.archive.org/web/20150201085737/http://siliconpr0n.org/archive/doku.php?id=azonenberg:xilinx:xc9572xl)
    (70% nitric, bare die)
  - [Xilinx
    XC2C128](https://web.archive.org/web/20150201085737/http://siliconpr0n.org/archive/doku.php?id=azonenberg:xilinx:xc2c128)
    (98% sulfuric, bare die)
  - [Photos from lab
    session](https://web.archive.org/web/20150201085737/http://imgur.com/a/ihTzB)
- 2/4/2014: You may find [this blog post on UMC\'s 180nm
  process](https://web.archive.org/web/20150201085737/http://siliconexposed.blogspot.com/2014/02/process-overview-umc-180nm-envm.html)
  an interesting read.
- 2/4/2014: Lab 1b data is being uploaded. Stay tuned for more!
  - [Silicon Image
    SII1364](https://web.archive.org/web/20150201085737/http://siliconpr0n.org/archive/doku.php?id=azonenberg:siliconimage:sii1364)
    (70% nitric, bare die)
  - [Xilinx
    XC95144XL](https://web.archive.org/web/20150201085737/http://siliconpr0n.org/archive/doku.php?id=azonenberg:xilinx:xc95144xl)
    (98% sulfuric, bare die
  - [Winbond
    W9751G6KB](https://web.archive.org/web/20150201085737/http://siliconpr0n.org/archive/doku.php?id=azonenberg:winbond:w9751g6kb)
    (98% sulfuric, bare die, started prior to lab)
  - [Xilinx
    XC3S50A](https://web.archive.org/web/20150201085737/http://siliconpr0n.org/archive/doku.php?id=azonenberg:xilinx:xc3s50a)
    (98% sulfuric, bare die, started prior to lab)
  - [Atmel ATmega3216 (70% nitric, live
    decap)](https://web.archive.org/web/20150201085737/http://siliconpr0n.org/archive/doku.php?id=azonenberg:atmel:atmega3216)
  - [Photos from lab
    session](https://web.archive.org/web/20150201085737/http://imgur.com/a/LfKGr)
- 2/23/2014: Office hours moved one hour later, new time is 5-7 PM. Same
  location and days.
- 3/4/2014: [Lab 2a data](lab2a.tar.gz) is now available
- 3/13/2014: [Lab 2b data](lab2b.tar.gz) is now available
- 3/31/2014:
  - Some scheduling changes for the later part of the semester have been
    made, please pay attention to the calendar above.
  - [This blog
    post](https://web.archive.org/web/20150201085737/http://siliconexposed.blogspot.com/2014/03/getting-my-feet-wet-with-invasive.html)
    is a sneak peek at what to expect from lab 4.
  - The final project has been removed and final course grades will be
    computed from HW1/2, lab grades, and quiz grades only. HW2 is now a
    group assignment and presentations are due the last day of class.
- 4/13/2014: Lab 4 data is now available
  - [FIB photos](xc2c32a_fib.tar.gz)
  - [Cleanroom photos](lab4.tar.gz)

------------------------------------------------------------------------

[![Creative Commons
License](https://web.archive.org/web/20150201085737im_/http://i.creativecommons.org/l/by/4.0/88x31.png){style="border-width:0"}](https://web.archive.org/web/20150201085737/http://creativecommons.org/licenses/by/4.0/){rel="license"}\
This work is licensed under a [Creative Commons Attribution 4.0
International
License](https://web.archive.org/web/20150201085737/http://creativecommons.org/licenses/by/4.0/){rel="license"}.