Reverse Engineering Word-Level Models from Look-Up Table Netlists

TL;DR

This paper introduces a method for reverse engineering FPGA and ASIC designs by analyzing carry-chains in LUT netlists to identify word-level structures, aiding understanding and validation of legacy designs.

Contribution

It presents a novel technique to detect word-level structures from LUT netlists and integrates existing methods into a comprehensive tool-chain for reverse engineering.

Findings

Successfully infers 34-100% of netlist elements as known operations or modules.

Enhances understanding of FPGA and ASIC designs through automated analysis.

Provides a practical tool for reverse engineering legacy hardware designs.

Abstract

Reverse engineering of FPGA designs from bitstreams to RTL models aids in understanding the high level functionality of the design and for validating and reconstructing legacy designs. Fast carry-chains are commonly used in synthesis of operators in FPGA designs. We propose a method to detect word-level structures by analyzing these carry-chains in LUT (Look-Up Table) level netlists. We also present methods to adapt existing techniques to identify combinational operations and sequential modules in ASIC netlists to LUT netlists. All developed and adapted techniques are consolidated into an integrated tool-chain to aid in reverse engineering of word-level designs from LUT-level netlists. When evaluated on a set of real-world designs, the tool-chain infers 34\% to 100\% of the elements in the netlist to be part of a known word-level operation or a known sequential module.