IDEC Journal of Integrated Circuits and Systems, VOL 6, No.1, Jan. 2020 http://www.idec.or.

kr

Reverse Engineering for Xilinx FPGA Chips

using ISE Design Tools

So Yeon Choi1, Ji Woon Park and Ho Young Yooa

Department of Electronics Engineering, Chungnam National University
E-mail : [email protected]

Abstract - SRAM-based Field Programmable Gate Arrays information of the circuit outside the FPGA. When the
(FPGAs) are more widely used compared to Flash-based and FPGA is powered, the internal circuit information is
anti-fuse based FPGAs in various industries. One disadvantage transferred from the external nonvolatile memory to the
of the SRAM-based FPGA is that SRAM is natively volatile and FPGA as a bitstream, and the FPGA operates based on this
thus it requires additional nonvolatile memory to store the
netlist information of the circuit outside the FPGA. When the
transferred bitstream. The bitstream transferred from the
FPGA is powered on, the bitstream file is transferred from the external memory contains all the circuit configuration
external nonvolatile memory to the SRAM-based FPGA. The information of the FPGA. Thus, if the bitstream is corrupted,
secure issues arise if the bitstream is modified or corrupted by it will cause a fatal problem in the circuit. It is necessary to
attacker resulting in a fatal problem in the circuit. Therefore, determine whether the transmitted bitstream contains the
reverse engineering that converting a bitstream into an internal original circuit information to minimize the damage caused
netlist is necessary to find such harmful modification. In this by an impaired circuit. The process of converting a bitstream
paper, we describe the overall process of reverse engineering into a file that contains the internal netlist information of the
based on ISE design tools in details. According to the FPGA is called reverse engineering. Various studies on
experimental results, the proposed reverse engineering tool can
recover 88% internal circuit as for the example of 64-bit LFSR
reverse engineering have been conducted recently to restore
design. the programmable logic points (PLPs) and programmable
interconnect points (PIPs) of FPGAs [3]-[10]. Several
Keywords—ISE Design Tools, Programmable logic points, reverse engineering tools have been developed, including
Programmable interconnect points, Reverse Engineering, Debit [3], which was first developed, BIL [4], Bit2ncd [5],
Xilinx FPGA BRET [6], and Bit2RTL [7] to enhance the recovery range.
This paper introduces the reverse engineering process to
reconstruct PIP and PLP into a circuit using Xilinx design
I. INTRODUCTION language (XDL), Xilinx design language routing and
configurable logic block (XDLRC), and bitstream files
Application-specific integrated circuit (ASIC) must be generated using the ISE design tool. In this process, a
designed to satisfy the specifications of application systems. mapping table is created by comparing the options of PLP
Thus, ASIC requires considerable time and cost to build the and PIP containing the configurable information of the
system, and once the circuit is produced as a chip, it cannot FPGA with the bitstream. The bitstream is restored to a
be modified. To mitigate this disadvantage of ASICs, field- netlist file based on this mapping table.
programmable gate arrays (FPGAs) are used in several
industries. FPGAs have the advantage of parallel and high-
speed processing because the circuit can be added or II. BACKGROUND
changed freely even after the circuit has been configured and
the digital circuit operates directly [1]. To implement a circuit in Xilinx FPGAs, we can use the
FPGAs are classified into SRAM-based, FLASH-based, ISE design tool or Vivado developed by Xilinx. The ISE
and FUSE-based FPGAs according to the fabrication design tool is used for FPGAs before the 7 series that was
method, and the SRAM-based FPGA is most widely used recently developed by Xilinx, and Vivado is used for FPGAs
owing to advantages in area, process, and speed [2]. after the 7 series. However, Vivado does not provide the
However, the SRAM-based FPGA is volatile and requires internal netlist in a readable format for developers, making
additional nonvolatile memory to store the netlist it difficult to obtain the information required to perform
reverse engineering. Therefore, we performed reverse
a. Corresponding author; [email protected] engineering with FPGAs using the ISE design tool, which
provides an internal netlist as a form of XDLRC and XDL.
Manuscript Received Dec. 02, 2019, Revised Dec. 23, 2019, Accepted Figure 1 shows a flowchart of the Xilinx ISE design tool
Dec. 26, 2019 with files created in each step. The first native generic
This is an Open Access article distributed under the terms of the Creative Commons database (NGD) file created expresses the input register-
Attribution Non-Commercial License (http://creativecommons.org/licenses/bync/3.0) transfer-level (RTL) design as an internal netlist file. When
which permits unrestricted non-commercial use, distribution, and reproduction in any
medium, provided the original work is properly cited. an NGD file, which is a netlist file, is mapped to an FPGA
IDEC Journal of Integrated Circuits and Systems, VOL 6, No.1, Jan. 2020 http://www.idec.or.kr

ngdbuild map P&R bitgen

P&R'd
RTL file NGD file NCD file BIT file MCS file PROM
NCD file
ncd2xdl

XDL file

-report

XDLRC

Fig. 1. Xilinx ISE Design Tools flow

: CLB : I/O : GCLK : TERM : Block RAM

Fig. 3. Internal structure of the xc3s50 devices.

Tile 1 Tile 2
primitive primitive
wire pip wire pip wire conn wire pip wire
pinwire pinwire

Fig. 2. XDLRC file format.

circuit, a native circuit description (NCD) file is generated.

The NCD file expresses the RTL design as a primitive of the
circuit. When the NCD file undergoes the place & route
process, a P&Red NCD file is created. This NCD file Fig. 4. Internal circuit structure of tile.
contains information mapped to the FPGA from the RTL
input to the FPGA, but users cannot understand it because it configured in a two-dimensional array, the name and type of
is stored in binary format. An NCD file can be converted to each tile, and the number of declared primitives in this order.
a Xilinx design language (XDL) file that can be understood In addition, the types of primitive_site, wire, conn, and pip
by users. The XDL file can be created using the ncd2xdl declared according to each tile type are indicated in the tile
option of the xdl command in the ISE design tool. The XDL section.
file can provide the PLP and PIP information of the FPGA Figure 3 shows a schematic of the entire chip with each
because it has the same netlist information as the NCD file. tile type categorized using the XDLRC file of xc3s50vq100-
However, the XDL file only shows the circuit information 5. The types of tiles are configurable logic block (CLB),
used in the FPGA, and the information of the entire chip is IOB, TERM, Block RAM, and GCLK. CLB consists of
unknown. A Xilinx design language routing and logical resources such as PLP and PIP for implementing
configurable logic block (XDLRC) file is required to find sequential and combination circuits. TERM is located at the
out the information of the entire chip, and it can be generated edge of the FPGA and consists of wires and pips that take
using the -report option of the xdl command. The Xilinx charge of the signal connections between nearby tiles. Block
FPGA is an SRAM-based FPGA, which stores internal RAM is a default storage space provided by FPGA, and there
netlist information in external memory as a bitstream. The is a multiplier near each block RAM. GCLK is a set of tiles
bitstream file format converted from the FPGA is a BIT file containing primitives related to clock information such as
and the information of the NCD file is stored as a bitstream. clock buffer and digital clock manager (DCM). IOB
The BIT file can be created using the bitgen command with provides unidirectional or bidirectional interfaces between
the -b option, which creates a raw bit file in ASCII code. The the pins in package of the chips and the internal logic of
BIT file is stored in an external memory PROM as an MCS FPGA. Figure 4 shows a schematic internal structure of the
(configuration memory) file, and the stored bitstream is tiles in an FPGA chip. Tiles are the largest unit of an FPGA
transferred to the FPGA when the FPGA is powered. chip and are arranged in a grid form in the FPGA. Primitives
in a tile represent circuits for performing a specific
A. Analysis of XDLRC file operation, and the available primitives differ depending on
The XDLRC file describes the FPGA chip in a the type of tile. Table I lists the types of primitives that can
hierarchical top-down manner, and the overall configuration be used in each tile. To express the circuit configuration of
consists of a header section, tile section, primitive_defs tiles, we need not only primitives, but also wires which
section as shown in Figure 2. The header section at the top indicate the paths of signals declared in a tile, conns which
of the file shows the type and information of the FPGA chip indicate fixed connections between different tiles, and pips
currently represented in the XDLRC file. For example, if the which indicate connections between freely configurable
target device is xc3s50vq100-5, xc3 indicates the Spartan-3 wires.
device, s50 indicates the size of the chip, vq100 indicates the The primitive_defs section, which describes the
type of package applied to the s50 chip, and -5 indicates the configuration information of a primitive that is a lower layer
speed level of the chip. The tile section shows the total of the tile, is described after the tile section in the XDLRC
number of rows and columns of tiles when the FPGA is file. This section shows the internal structure of all kinds of
IDEC Journal of Integrated Circuits and Systems, VOL 6, No.1, Jan. 2020 http://www.idec.or.kr

TABLE I. TABLE Ⅱ.
Types and numbers of primitives according to the category of tiles. Number of PLPs according to the type of primitive.
Number of Type of Number Number
Tile Type of primitive Type of primitive
primitives primitive of PLPs of PLPs
BSCAN, DCIRESET, BSCAN 0 SLICEL 31
GLOBALSIG, ICAP, BUFGMUX,
GCLK 12 DCIRESET 0 SLICEM 51
CAPTURE, DCI, PMV, STARTUP,
DCM, VCC, RESERVED_LL GLOBALSIG 1 RESERVED_ANDOR 1
SLICEL, SLICEM, VCC, ICAP 3 DIFFM 54
CLB 4
RESERVED_LL
BUFGMUX 4 DIFFS 54
DIFFM, DIFFS, IOB,
IOB RESERVED_ANDOR, VCC, 6 CAPTURE 3 IOB 54
RESERVED_LL DCI 1 DCM 31
Block PMV 0 RAMB16 12
RAMB16, MULT18X18 2
RAM
STARTUP 3 MULT18X18 3
TERM - - RESERV_LL 0 VCC 0

primitive
element
pinwire conn
pin
cfg
PLP1
PLP2
PLP3

cfg
PLP1
PLP2

Fig. 6. XDL file format.

Fig. 5. Internal circuit structure of primitive. Tile 2
Tile 1
primitives configured in the primitive_site, the physical primitive
wire pip pip wire conn wire pip
primitive
cfg pinwire
location of the primitives. The primitive_defs section PLP1
wire

consists of pinwires corresponding to the input and output PLP2

wire
and elements implementing the internal circuit. Figure 5 cfg
PLP1
shows the configuration of the primitive_site based on the PLP2
PLP3
primitive_defs section and Table II shows the number of
PLPs that appear in each primitive. An element in a primitive
consists of a pin that represents the input and output of the
element, a conn that represents a fixed connection to another Fig. 7. Reconstruction of the internal circuit according to XDL.
element, and a cfg that can be used to configure freely the which are fixed connections with external tiles. Figure 7
inside of the circuit. The XDLRC file representing the shows the result of implementing a circuit by combining the
xc3s50vq100-5 chip in Figure 2 has a size of 46,143,454 PLPs and PIPs of the instance and the net sections of the
bytes and consists of 1,824,280 lines. XDL. Whether to use primitive_sites inside a tile is
determined by the circuit to be implemented. The red line in
B. Analysis of XDL file
Figure 7 indicates the currently used primitives among the
The internal structure of an XDL file is largely composed various primitives in the tile, and the currently used options
of three sections: design, instance, and net as shown in of PLP and PIP among the various options.
Figure 6. The design section, which is located at the top of
the file, shows the name of the design and the FPGA device C. Analysis of BIT file
information. The instance section describes the primitive The internal netlist information is stored in external
instance information of a primitive_site in a specific tile, memory as a bitstream. The bitgen command of the ISE
which includes the instance name, the type of the instanced design tool is used to create a BIT file in binary format. To
primitive, and the layout information in the chip, which convert a binary file into a human-readable file using ASCII
shows the primitive_sites of specific tiles. Next, there is a cfg code, a raw bit file is created using the -b option and this file
string that shows the internal element configuration is used for reverse engineering. A raw bit file consists of
according to the type of the instanced primitive. The cfg also 13,681 lines of 32 bits per line, and the entire file is divided
shows the type of PLP used in the primitive and the currently into a command section, configuration data section, and
used option of PLP. Finally, the net section at the bottom terminal section as shown in Figure 8. The configuration
shows the inpin and outpin information and PIP information. command section shows commands to inform
The inpin and outpin are determined by the pinwire of the synchronization, CRC check, and the amount of
instanced primitive. This section declares the PIPs required configuration data expressed in bitstreams. The
to connect from the first outpin to the final inpin using conns, configuration data section stores information about all the
IDEC Journal of Integrated Circuits and Systems, VOL 6, No.1, Jan. 2020 http://www.idec.or.kr

Start

Input: .xdl file, target primitive

Search target primitive in XDL

Change the option of the target

PLP or PIP

Generate revised XDL files

Fig. 8. Raw bit file format. .xdl file

XDL file XDLRC BIT file Fig. 10. Algorithm of XDL generator.

inst "dff2/Q<0>" "SLICEL",placed R1C1 SLICE_X0Y31 ,

XDL cfg " BXINV::#OFF BYINV::BY CEINV::#OFF CLKINV::CLK COUTUSED::#OFF CY0F::#OFF
CY0G::#OFF CYINIT::#OFF CYSELF::#OFF CYSELG::#OFF DXMUX::#OFF DYMUX::#OFF
generator F::#OFF F5USED::#OFF FFX::#OFF FFX_INIT_ATTR::#OFF FFX_SR_ATTR::#OFF
FFY::#OFF FFY_INIT_ATTR::#OFF FFY_SR_ATTR::#OFF FXMUX::#OFF
generate .rbt files FXUSED::#OFF G::#OFF GYMUX::#OFF REVUSED::#OFF SRINV::SR_B SYNC_ATTR::#OFF
XBUSED::#OFF XUSED::#OFF YBUSED::#OFF YUSED::#OFF "
RBT
comparator (a)
inst "dff2/Q<0>" "SLICEL",placed R1C1 SLICE_X0Y31 ,
Mapping cfg " BXINV::#OFF BYINV::BY CEINV::#OFF CLKINV::CLK COUTUSED::#OFF CY0F::#OFF
CY0G::#OFF CYINIT::#OFF CYSELF::#OFF CYSELG::#OFF DXMUX::#OFF DYMUX::#OFF
Table F::#OFF F5USED::#OFF FFX::#OFF FFX_INIT_ATTR::#OFF FFX_SR_ATTR::#OFF
FFY::#OFF FFY_INIT_ATTR::#OFF FFY_SR_ATTR::#OFF FXMUX::#OFF
FXUSED::#OFF G::#OFF GYMUX::#OFF REVUSED::#OFF SRINV::SR_B SYNC_ATTR::#OFF
XBUSED::#OFF XUSED::#OFF YBUSED::#OFF YUSED::#OFF "
Reconfiguration
inst "dff2/Q<0>" "SLICEL",placed R1C1 SLICE_X0Y31 ,
cfg " BXINV::#OFF BYINV::BY CEINV::#OFF CLKINV::CLK COUTUSED::#OFF CY0F::#OFF
Reversed CY0G::#OFF CYINIT::#OFF CYSELF::#OFF CYSELG::#OFF DXMUX::#OFF DYMUX::#OFF
XDL file F::#OFF F5USED::#OFF FFX::#FF FFX_INIT_ATTR::#OFF FFX_SR_ATTR::#OFF
FFY::#OFF FFY_INIT_ATTR::#OFF FFY_SR_ATTR::#OFF FXMUX::#OFF
xdl2ncd FXUSED::#OFF G::#OFF GYMUX::#OFF REVUSED::#OFF SRINV::SR_B SYNC_ATTR::#OFF
XBUSED::#OFF XUSED::#OFF YBUSED::#OFF YUSED::#OFF "
Reversed
NCD file inst "dff2/Q<0>" "SLICEL",placed R1C1 SLICE_X0Y31 ,
cfg " BXINV::#OFF BYINV::BY CEINV::#OFF CLKINV::CLK COUTUSED::#OFF CY0F::#OFF
CY0G::#OFF CYINIT::#OFF CYSELF::#OFF CYSELG::#OFF DXMUX::#OFF DYMUX::#OFF
Fig. 9. Algorithm of reverse engineering. F::#OFF F5USED::#OFF FFX::#LATCH FFX_INIT_ATTR::#OFF FFX_SR_ATTR::#OFF
FFY::#OFF FFY_INIT_ATTR::#OFF FFY_SR_ATTR::#OFF FXMUX::#OFF
FXUSED::#OFF G::#OFF GYMUX::#OFF REVUSED::#OFF SRINV::SR_B SYNC_ATTR::#OFF
tiles of the FPGA, and analysis of this information is XBUSED::#OFF XUSED::#OFF YBUSED::#OFF YUSED::#OFF "

(b)
essential for reverse engineering. Bitstreams are arranged
sequentially by the type of tiles in the same way as the chip Fig. 11. Operation of XDL generator; (a)original XDL file
(b)modified XDL files.
configuration. One frame consists of 37 lines, and the
number of frames represented as bitstreams is fixed for each for SLICEL. The number of XDL files to be generated
tile category. The terminal section is located at the end of the according to each primitive is hundreds for PLPs and
raw bit file, and it consists of CRC check section and desync thousands for PIPs. Thus, an XDL generator can be created
section, which terminates synchronization with the external to generate XDL files automatically by applying the options
memory. of each PLP. Figure 10 shows a flowchart of the algorithm
of the XDL generator. The inputs of the XDL generator are
the original XDL file and the target primitive type, and the
III. REVERSE ENGINEERING output is the XDL file with changed options of each PLP
belonging to the target primitive. Figure 11 illustrates the
Reverse engineering must be performed using the behavior of the XDL generator with an example of FFX
information stored in the files analyzed in section II. Figure when the PLP has three options: #OFF, #FF, and #LATCH.
9 shows the algorithm of reverse engineering. First, the Figure 11 (a) shows the cfg string representing SLICEL in
mapping table of PLP and PIP is created by using BIT, XDL, the original XDL file, and the options of FFX are determined
and XDLRC files. Then, reconfiguration is performed to by the red squared part. Figure 11 (b) shows the cfg of XDL
generate the XDL file by using the mapping table and files with FFX options changed to #OFF, #FF, and #LATCH.
bitstreams. The XDL files with the PLP or PIP options changed one
by one are first converted to NCD and then used to generate
A. Mapping table generation bitstream files. A mapping table for bitstream files is created
As the PLP and PIP have different bitstreams depending by comparing bitstream files with the #OFF option
on the configuration options, the bitstreams for all indicating that PLP is not used and with other options
configurable options must be generated and compared by indicating that PLP for each PLP and checking the bits that
modifying the XDL. Furthermore, the process of arranging have changed. To compare between bitstream files, 13,681
the comparison result of raw bit files into a mapping table is lines of bitstreams with each line consisting of 32 bits must
essential for reverse engineering. be compared for the number of times excluding the #OFF
First, an XDL file applying the configurable options of all option of the target PLP or PIP. For this task, a bitstream
PLPs must be generated for each primitive to create a comparator that performs this comparison automatically
mapping table of PLPs. For example, SLICEL has 31 PLPs must be used. Figure 12 shows the algorithm for the overall
and the 31 PLPs have 1 to 7 options excluding #OFF. Hence, operation of the bitstream (BIT) comparator. The inputs are
a total of 89 XDL files are required to create a mapping table the entire raw bit file and the target primitive. By comparing
IDEC Journal of Integrated Circuits and Systems, VOL 6, No.1, Jan. 2020 http://www.idec.or.kr

Start F[i]

g0 g1 gN-1 gN
Input: .rbt file, target primitive

S 0
S0[i]
S
1
S1[i]
S N-1
SN-1[i]
Collect .rbt files
Fig. 14. 64-bit LFSR circuit when N = 64.
Compare the bitstreams

Extract control bits and control

value

Mapping table
(a)
Fig. 12. Algorithm of BIT comparator.

(b)
Fig. 15. Part of (a) original XDL file and (b) recovered XDL file for
64-bit LFSR.

Fig. 13. Mapping table of I/O tile.

the bitstreams with the #OFF option applied for all PIPs and
PLPs and the raw bit file with the other options, mapping
table for PLPs and PIPs for each primitive can be created as
shown in Figure 13. The PLP, the position of the bit, the bit (a) (b)
value of the OFF option, and the bit value of the option Fig. 16. (a) Original circuit and (b) recovered circuit based on
appear in this order. For example, among the PLPs of the recovered XDL file
IOB tile in Figure 13, the position where the bit for
TFF2_INIT_ATTR appears is 216_16, the bit value of the IV. EXPERIMENTAL RESULTS
OFF option is 0, and the bit value of the INIT0 option is 1.
It is worthwhile to notice that the proposed reverse The bitstream of the 64-bit LFSR circuit in Figure 14
engineering is more efficient compared to Bit2ncd [5]. implemented in an xc3s50 device among the Spartan-3
Whereas Bit2ncd[5] constructs all the possible network to FPGAs was restored to an XDL file through the XDL
recover a single PIP, the proposed method construct a branch recovery process using a mapping table. The 64-bit LFSR in
of an entire network, and thus it can highly save a time to Figure 15 mapped on xc3s50 device using 16 CLB tiles, 34
build the PIP mapping table by reducing searching space. IOB tiles, and 1 BUFGMUX tile for GCLK. When the
bitstream file representing a 64-bit LFSR in Figure 14 is
B. Circuit reconstruction compared with a raw bit file with no declaration of PLP and
The aim for circuit reconstruction is to convert a raw bit PIP, the position of a bit with a different bit representation
file into an XDL file based on the created mapping table. It must first be determined. Figure 15 shows part of the XDL
is required to know which of the PLP and PIP options were file restored by performing XDL recovery based on the
used in order to perform this conversion. The bits that appear mapping table with the entire basic raw bit file. However, in
in the raw bit file to be converted are searched in the mapping the state immediately after the restoration based on the
table created earlier. In this searching process based on the mapping table, the options having the same bit
position of the bit, the position of the tile, the type of representation as the #OFF option cannot be restored. These
primitive, the used PLP or PIP, and the used options can be options must be determined by comparing them with the
observed. However, if the PLP option has the same bit options of other PLPs that appear in the bit representations.
representation as the PLP option of #OFF, the recovery Finally, after recovering the PLP options that did not appear
becomes more complicated since no bit difference appears when compared with the default raw bit file, the original and
when it is compared with the basic XDL file. In this case, the restored XDL files are 88% identical to each other. The
option of the PLP to be used must be selected by comparing recovery ratio is calculated based on whether the number of
it with the options of other PLPs that are already represented restored 1’s among all 1’s in a bitstream. Although it is
as bits. For example, if an option other than #OFF is hardly to say 88% LFSR can works as an original LFSR, the
represented by the bit FFX_INIT_ATTR, FFX can be recovered XDL definitely help to estimate the target design
declared only if an option other than the #OFF option is as a LFSR. When the generated XDL file is converted into
selected. Therefore, it must be considered that the #FF an NCD file using the xdl2ncd command of the ISE design
option having the same bit representation as the #OFF option tool, Fig. 16 shows the result of mapping the converted NCD
among the FFX options was used. file to the circuit. The recovered netlist by the proposed
IDEC Journal of Integrated Circuits and Systems, VOL 6, No.1, Jan. 2020 http://www.idec.or.kr

reverse engineering is nearly perfect recovered from a [9] Lavin, Christopher, et al. "Rapidsmith: Do-it-yourself
graphical view point. cad tools for xilinx fpgas." 2011 21st International
Conference on Field Programmable Logic and
Applications. IEEE, 2011.
V. CONCLUSIONS [10] Malhotra, Shawn, et al. "The quartus university
interface program: enabling advanced fpga research." In
A reverse engineering tool focused on PIP and PLP Proceedings of 2004 IEEE International Conference on
recovery was implemented, and the process of reverse Field-Programmable Technology (IEEE Cat. No.
engineering and the operation of the automation tools 04EX921), 2004.
required in each step were described. When a 64-bit LFSR [11] M. Jeong, J. Lee, E. Jung, Y. H. Kim and K. Cho,
was restored using reverse engineering tools and Xilinx ISE "Extract LUT Logics from a Downloaded Bitstream
design tools focused on PIP and PLP restoration, 88% of the Data in FPGA," 2018 IEEE International Symposium on
total circuits could be restored. Reverse engineering tools Circuits and Systems (ISCAS), Florence, 2018, pp. 1-5.
have been actively developed using the ISE design tool, and [12] Moradi, Amir, et al. "On the vulnerability of FPGA
their recovery rates are up to 80%. Therefore, even if the bitstream encryption against power analysis attacks:
bitstreams of the external memory are attacked, whether the extracting keys from xilinx Virtex-II FPGAs."
circuit information has been damaged can be determined. Proceedings of the 18th ACM conference on Computer
For a further study, a reverse engineering tool for 7-series and communications security. ACM, 2011.M. Young,
FPGA chips using Vivado will be developed to enlarge a The Technical Writer’s Handbook. Mill Valley, CA:
reverse engineering area. University Science, 1989.

ACKNOWLEDGMENT
So Yeon Choi received the B.S.
This work was supported by the National Research degree in electronics engineering
Foundation of Korea(NRF) grant funded by the Korea from Chungnam National
government(MSIT) (NRF-2019M3F3A1A01074448), and University, Daejeon, Korea, in
EDA tools were supported by IDEC, Korea . 2018.
Her main interests are VLSI for
error correction codes and FPGA
REFERENCES reconfiguration.
[1] H. Yu, H. Lee, S. Lee, Y. Kim, and H.-M. Lee, "Recent
Advances in FPGA Reverse Engineering," Electronics,
vol. 7, no. 10, 2018.
[2] M. Wirthlin, "High-Reliability FPGA-Based Systems: Ji Woon Park is working
Space, High-Energy Physics, and Beyond," toward the B.S. degree in
in Proceedings of the IEEE, vol. 103, no. 3, pp. 379-389, electrical engineering from
March 2015. Chungnam National University,
[3] J.-B. Note and É . Rannaud, "From the bitstream to the Daejeon, Korea, in 2020.
netlist," in Proc. 16th Int. ACM/SIGDA Symp. FPGA, vol. His main interests are VLSI for
8, pp. 264-264, 2008. error correction codes and FPGA
[4] F. Benz, A. Seffrin, and S. A. Huss, "Bil: A tool-chain reconfiguration.
for bitstream reverse-engineering," in 22th International
Conference on Field Programmable Logic and
Applications (FPL), Aug. 2012, pp. 735-738.
[5] Z. Ding, Q. Wu, Y. Zhang, and L. Zhu, "Deriving an
NCD file from an FPGA bitstream: Methodology, Ho Young Yoo received the
architecture and evaluation," Microprocessors and B.S. degree in electrical &
Microsystems, vol. 37, no. 3, pp. 299-312, 2013. electronics engineering from
[6] J. Yoon et al., "A Bitstream Reverse Engineering Tool Yonsei University, Seoul, Korea,
for FPGA Hardware Trojan Detection," in Proceedings in 2010. He received the M.S. and
of the 2018 ACM SIGSAC Conference on Computer and Ph.D. degree in electronic
Communications Security, pp. 2318-2320, 2018. engineering from KAIST in 2012
[7] T. Zhang, J. Wang, S. Guo, and Z. Chen, "A and 2016. Since 2016, he has been
Comprehensive FPGA Reverse Engineering Tool-Chain: with the department of
From Bitstream to RTL Code," IEEE Access, vol. 7, pp. Electronics Engineering,
38379-38389, 2019. Chungnam National University,
[8] Lavin, Christopher, et al. "Rapid prototyping tools for Daejeon, Korea, where he is now an Assistant Professor.
FPGA designs: RapidSmith." 2010 International His research interests are VLSI for 5G communication
Conference on Field-Programmable Technology. IEEE, systems and VLSI for Machine Learning Accelerators.
2010.