34C3 – Reverse engineering FPGAs

"Dissecting FPGAs from bottom up, extracting schematics and documenting bitstream formats

Event large In this talk I describe the basic makeup of FPGAs and how I reverse engineered the Xilinx 7 Series and Lattice iCE40 Series together with the implications.

FPGAs are used in many applications ranging from networking, wireless communications to high performance computing, ASIC prototyping and so forth.

They would be perfect to create true open source hardware but we would still be bound to use proprietary toolchains provided by the manufacturers.

To generate a valid configuration file this toolchain needs to know every single wire, switch, possible connection, logic block and the corresponding bits to configure each them.

In other words you are required to have the blueprints of the FPGA in your toolchain to be able to do the place&routing and generation of the bitstream file from your netlist.

Naturally manufacturers do not like to disclose this information, possibly because someone could reverse engineer valuable intellectual property cores.

I will explain each component used in FPGAs from Lattice and Xilinx, like switchboxes, the interconnect, logic blocks, memory blocks.

Furthermore I will talk about how I reverse engineered the 7 Series from Xilinx and the iCE40 from Lattice.

At the end I will demonstrate how to create your own bitstream by hand, implementing a small logic circuit and testing it live on a Zynq 7000 FPGA from Xilinx."

Source for the description: https://fahrplan.events.ccc.de/congress/2017/Fahrplan/events...

Please don't link to Youtube for CCC talks. They built their own mediasharing platform that provides downloads, has no ads and does not track you in any way:

https://media.ccc.de/v/34c3-9237-reverse_engineering_fpgas