Reverse engineering of a VLSI device utilizing scan-chain

Prof. Ran Ginosar | Electrical and Computer Engineering


Information and Computer Science

The Technology

Reverse engineering of a VLSI device is usually a two-stage process, comprising (1) extraction of a circuit description from the physical device and (2) behavioral model extraction from the circuit description (usually algorithmic). The first stage, as a rule, involves a sequence of invasive techniques, such as packaging removal, cross-section, delayering, and nanoscale imaging. The complexity and cost of the invasive circuit extraction methods commonly used today rise with the advancement in the semiconductor manufacturing technology.

The scan approach is in extensive use by VLSI manufacturers for automatic generation of production tests for VLSI devices. The technology offers a computerized method of creating a circuit logic model of a VLSI device. The method is comprising of mapping a plurality of logic function patterns of one or more circuits of a VLSI device through a plurality of probe iterations and generating a circuit logic model of the circuit(s) by reconstructing a logical function of a combinatorial logic of the circuit(s) based on analysis of the logic function patterns. It takes advantage of this construct for performing reverse engineering of the device by reconstruction of the combinational function above. The reconstruction is done by assigning values to the internal registers and sampling the resulted values, all using the scan shift operation. In the core of the method stands an algorithm that uses limitations of digital designs for reduction of the search space.


  • Non-invasive process
  • Simple and virtually process, no special equipment required

Applications and Opportunities

  • Semiconductor companies
arrow Business Development Contacts
Ofer Shneyour
Director of Business Development, ICT