249 lines
7.7 KiB
Markdown
249 lines
7.7 KiB
Markdown
# CSCI 4974 / 6974 Hardware Reverse Engineering
|
|
|
|
**Important info:**
|
|
|
|
- Classes: Tuesday/Friday, 2:00 - 3:50, Low 3130
|
|
- Professor: Bulent Yener (yener@cs.rpi.edu). Office hours TBA
|
|
- TA: Andrew Zonenberg (zonena@rpi.edu). Office hours AE 119
|
|
Tuesday/Friday 5-7 PM.
|
|
- Download the [Syllabus](syllabus.pdf)
|
|
|
|
**Timeline**\
|
|
*Draft notes for upcoming lectures are provided for advance study
|
|
purposes only and are subject to change. The version posted as of the
|
|
end of lecture is authoritative as far as material which will be covered
|
|
on quizzes etc.*
|
|
|
|
Date
|
|
|
|
Class
|
|
|
|
1/21/2014
|
|
|
|
[Lecture 1: Course overview, motivation, legal issues, switch model of
|
|
CMOS logic](Lecture1_Intro.pdf)
|
|
|
|
1/24/2014
|
|
|
|
[Lecture 2: Package construction](Lecture2_Packaging.pdf)
|
|
|
|
1/28/2014
|
|
|
|
[Quiz 1: CMOS schematics, packaging](Quiz1_CMOS_Sch.pdf)\
|
|
[Quiz 1a: Makeup exam](Quiz1a_CMOS_Sch_makeup.pdf)\
|
|
[Lecture 3: Depackaging](Lecture3_Depackaging.pdf)
|
|
|
|
1/31/2014
|
|
|
|
Lab 1: Depackaging demo (Lab group A only, no class for group B.
|
|
Location: MRC 166 EM lab)
|
|
|
|
2/4/2014
|
|
|
|
Lab 1: Depackaging demo (Lab group B only, no class for group A.
|
|
Location: MRC 166 EM lab)
|
|
|
|
2/7/2014
|
|
|
|
Lab 1a reports due\
|
|
[Quiz 2: Depackaging](Quiz2_Decapping.pdf)\
|
|
[Lecture 4: CMOS layout](Lecture4_Layout.pdf)\
|
|
[Download the example layouts](Lecture4_Examples.tar.gz)
|
|
|
|
2/11/2014
|
|
|
|
Lab 1b reports due\
|
|
[Quiz 3: CMOS layout](Quiz3_Layout.pdf)\
|
|
[Homework 1](hw1.pdf) out\
|
|
[Homework 1 images](hw1_data.tar.gz)\
|
|
[More homework 1 images](hw1_data2.tar.gz)\
|
|
[Lecture 5: Fabrication processes](Lecture5_FabProcesses.pdf)
|
|
|
|
2/14/2014
|
|
|
|
**No class**: Canceled due to heavy snow.
|
|
|
|
2/18/2014
|
|
|
|
**No class**: Follow Monday schedule.
|
|
|
|
2/21/2014
|
|
|
|
[Lecture 6: Deprocessing](Lecture6_Deprocessing.pdf)
|
|
|
|
2/25/2014
|
|
|
|
[Quiz 4: Process ID and deprocessing](Quiz4_Deprocessing.pdf)\
|
|
[Lecture 7: CPLD architecture](Lecture7_CPLDArch.pdf)
|
|
|
|
2/28/2014
|
|
|
|
[Quiz 5: CPLD architecture](Quiz5_CPLDArch.pdf)\
|
|
[Lecture 8: Microscopy and Imaging](Lecture8_Microscopy.pdf)\
|
|
[Files for in-class exercise](hugindemo.tar.gz)\
|
|
|
|
3/4/2014
|
|
|
|
Lab 2: SEM Imaging (Lab group A only, no class for group B. Location:
|
|
MRC EM lab)
|
|
|
|
3/7/2014
|
|
|
|
Lab 2: SEM Imaging (Lab group B only, no class for group A. Location:
|
|
MRC EM lab)\
|
|
|
|
3/11/2014
|
|
|
|
**No class:** Spring break
|
|
|
|
3/14/2014
|
|
|
|
**No class:** Spring break\
|
|
Happy pi day!
|
|
|
|
3/18/2014
|
|
|
|
Homework 1 due (tentative)\
|
|
Lab 2 reports due (both groups)\
|
|
[Quiz 6: Microscopy and imaging](Quiz6_Microscopy.pdf)\
|
|
[Lecture 9: Mask ROM layout](Lecture9_MaskROM.pdf)
|
|
|
|
3/21/2014
|
|
|
|
[Lecture 10: PROM/EPROM/EEPROM/efuse/Flash layout](Lecture10_EEPROM.pdf)
|
|
|
|
3/25/2014
|
|
|
|
[Lecture 11: SRAM layout](Lecture11_SRAM.pdf)
|
|
|
|
3/28/2014
|
|
|
|
[Quiz 7: Memory technology](Quiz7_Memory.pdf)\
|
|
[Lecture 12: Non-invasive attacks on
|
|
logic](Lecture12_NoninvasiveAttacks.pdf)
|
|
|
|
4/1/2014
|
|
|
|
Lecture 13: Fault attacks on crypto (joint lecture by Prof. Yener and
|
|
graduate student Brennan)\
|
|
[Prof. Yener\'s slides](Fault-Attacks-short.pdf)\
|
|
[Brennan\'s slides](DPA_Presentation.pdf)
|
|
|
|
4/4/2014
|
|
|
|
[Lecture 14: Invasive and semi-invasive
|
|
attacks](Lecture14_InvasiveAttacks.pdf)\
|
|
Lab 3: UV light attacks on PIC12F683 (both groups, during normal class
|
|
period)
|
|
|
|
4/8/2014
|
|
|
|
Lab 4: Invasive attacks (Lab group A only, no class for group B.
|
|
Location: Cleanroom test area)
|
|
|
|
4/11/2014
|
|
|
|
Lab 4: Invasive attacks (Lab group B only, no class for group A.
|
|
Location: Cleanroom test area)
|
|
|
|
4/15/2014
|
|
|
|
[Quiz 8: Attacks](Quiz8_Attacks.pdf)\
|
|
Homework 2 out: PCB RE (see slides)\
|
|
[Lecture 15: PCB RE: Component ID, block diagram
|
|
extraction](Lecture16_PCB_Analysis.pdf)
|
|
|
|
4/18/2014
|
|
|
|
Lecture 16: Guest lecture by Danny Walters (MITRE) on electromagnetic
|
|
side-channel attacks
|
|
|
|
4/22/2014
|
|
|
|
[Lecture 17: Anti-tamper / anti-analysis
|
|
techniques](Lecture15_Antitamper.pdf)
|
|
|
|
4/25/2014
|
|
|
|
[Lecture 18: PCB RE: Fab, deprocessing, netlist
|
|
extraction](Lecture18_PCB_Analysis2.pdf)
|
|
|
|
4/29/2014
|
|
|
|
[Quiz 9: PCB RE](Quiz9_PCBRE.pdf)\
|
|
[Lecture 19: Programmable logic: FPGAs](Lecture19_FPGA.pdf)
|
|
|
|
5/2/2014
|
|
|
|
[Lecture 20: Machine vision, automated RE
|
|
tools](Lecture20_MachineVision.pdf)
|
|
|
|
5/6/2014
|
|
|
|
Homework 2 presentations. No final exam.
|
|
|
|
**Announcements**
|
|
|
|
- 1/25/2014: Syllabus updated for new lab schedule and office hour
|
|
times/locations
|
|
- 1/28/2014: Check out the [list of interesting
|
|
chips](https://web.archive.org/web/20150201085737/https://docs.google.com/spreadsheet/ccc?key=0AkqT3htW1sFydFBaU0lfX2k5TjVudzhHR2tOQmhQRXc#gid=0)
|
|
we might decap in lab #1. If anyone has votes, send them to the TA.
|
|
(Large CPU packages are off limits for the lab because they tend to
|
|
take a while to process.)
|
|
- 2/2/2014: Lab 1a data is available:
|
|
- [Xilinx
|
|
XC3S50AN](https://web.archive.org/web/20150201085737/http://siliconpr0n.org/archive/doku.php?id=azonenberg:xilinx:xc3s50an)
|
|
(70% nitric, live decap)
|
|
- [Xilinx
|
|
XC9572XL](https://web.archive.org/web/20150201085737/http://siliconpr0n.org/archive/doku.php?id=azonenberg:xilinx:xc9572xl)
|
|
(70% nitric, bare die)
|
|
- [Xilinx
|
|
XC2C128](https://web.archive.org/web/20150201085737/http://siliconpr0n.org/archive/doku.php?id=azonenberg:xilinx:xc2c128)
|
|
(98% sulfuric, bare die)
|
|
- [Photos from lab
|
|
session](https://web.archive.org/web/20150201085737/http://imgur.com/a/ihTzB)
|
|
- 2/4/2014: You may find [this blog post on UMC\'s 180nm
|
|
process](https://web.archive.org/web/20150201085737/http://siliconexposed.blogspot.com/2014/02/process-overview-umc-180nm-envm.html)
|
|
an interesting read.
|
|
- 2/4/2014: Lab 1b data is being uploaded. Stay tuned for more!
|
|
- [Silicon Image
|
|
SII1364](https://web.archive.org/web/20150201085737/http://siliconpr0n.org/archive/doku.php?id=azonenberg:siliconimage:sii1364)
|
|
(70% nitric, bare die)
|
|
- [Xilinx
|
|
XC95144XL](https://web.archive.org/web/20150201085737/http://siliconpr0n.org/archive/doku.php?id=azonenberg:xilinx:xc95144xl)
|
|
(98% sulfuric, bare die
|
|
- [Winbond
|
|
W9751G6KB](https://web.archive.org/web/20150201085737/http://siliconpr0n.org/archive/doku.php?id=azonenberg:winbond:w9751g6kb)
|
|
(98% sulfuric, bare die, started prior to lab)
|
|
- [Xilinx
|
|
XC3S50A](https://web.archive.org/web/20150201085737/http://siliconpr0n.org/archive/doku.php?id=azonenberg:xilinx:xc3s50a)
|
|
(98% sulfuric, bare die, started prior to lab)
|
|
- [Atmel ATmega3216 (70% nitric, live
|
|
decap)](https://web.archive.org/web/20150201085737/http://siliconpr0n.org/archive/doku.php?id=azonenberg:atmel:atmega3216)
|
|
- [Photos from lab
|
|
session](https://web.archive.org/web/20150201085737/http://imgur.com/a/LfKGr)
|
|
- 2/23/2014: Office hours moved one hour later, new time is 5-7 PM. Same
|
|
location and days.
|
|
- 3/4/2014: [Lab 2a data](lab2a.tar.gz) is now available
|
|
- 3/13/2014: [Lab 2b data](lab2b.tar.gz) is now available
|
|
- 3/31/2014:
|
|
- Some scheduling changes for the later part of the semester have been
|
|
made, please pay attention to the calendar above.
|
|
- [This blog
|
|
post](https://web.archive.org/web/20150201085737/http://siliconexposed.blogspot.com/2014/03/getting-my-feet-wet-with-invasive.html)
|
|
is a sneak peek at what to expect from lab 4.
|
|
- The final project has been removed and final course grades will be
|
|
computed from HW1/2, lab grades, and quiz grades only. HW2 is now a
|
|
group assignment and presentations are due the last day of class.
|
|
- 4/13/2014: Lab 4 data is now available
|
|
- [FIB photos](xc2c32a_fib.tar.gz)
|
|
- [Cleanroom photos](lab4.tar.gz)
|
|
|
|
------------------------------------------------------------------------
|
|
|
|
[{style="border-width:0"}](https://web.archive.org/web/20150201085737/http://creativecommons.org/licenses/by/4.0/){rel="license"}\
|
|
This work is licensed under a [Creative Commons Attribution 4.0
|
|
International
|
|
License](https://web.archive.org/web/20150201085737/http://creativecommons.org/licenses/by/4.0/){rel="license"}.
|