Journal of Hardware and Systems Security

, Volume 2, Issue 4, pp 322–332 | Cite as

Large-Area Automated Layout Extraction Methodology for Full-IC Reverse Engineering

  • Raul Quijada
  • Roger Dura
  • Jofre PallaresEmail author
  • Xavier Formatje
  • Salvador Hidalgo
  • Francisco Serra-Graells


A high degree of automation is required when facing full-IC reverse engineering. In this paper, we present a methodology to delayer the chip, acquire SEM images of each layer, obtain the three-dimensional layer reconstruction, and generate a vectorized file in GDSII format for further automatic netlist extraction. A custom software tool named GDS-X has been developed to perform all the required steps from image acquisition to the GDSII file generation. Applying a novel tile mosaicking strategy and using state-of-the-art machine learning techniques for image segmentation, this software reduces dramatically the time required to complete these procedures while minimizing errors compared to old manual reverse engineering techniques.


Reverse engineering Chip delayering Mosaicking Machine learning 



The authors would like to thank the IMB-CNM clean room staff and specially the RIE, SEM image acquisition and carbon deposition teams for their valuable support and advice.


  1. 1.
    Chakraborty RS, Narasimhan S, Bhunia S (2009) Hardware trojan: threats and emerging solutions. In: 2009 IEEE International high level design validation and test workshop, pp 166–171.
  2. 2.
    Chen T, Guestrin C (2016) XGBoost: a scalable tree boosting system. In: Proceedings of the 22nd ACM international conference on knowledge discovery and data mining. ACM, New York, pp 785–794.
  3. 3.
    Chen X, Han H, Xie QW, Shen LJ (2012) Correction of SEM image distortion based on non-equidistant GM(1,1) model. In: 2012 International conference on wavelet analysis and pattern recognition, pp 20–23.
  4. 4.
    Dura R, Pallares J, Quijada R, Formatje X, Hidalgo S, Serra-Graells F (2017) fast and robust Topology-Based logic gate identification for automated IC reverse engineering. In: Proceedings of the ISTFA 2017, Pasadena, USA, pp 317– 332Google Scholar
  5. 5.
    Erbagci B, Erbagci C, Akkaya NEC, Mai K (2016) A secure camouflaged threshold voltage defined logic family. In: 2016 IEEE International symposium on hardware oriented security and trust (HOST), pp 229–235.
  6. 6.
    Hu MK (1962) Visual pattern recognition by moment invariants. IRE Trans Inf Theory 8(2):179–187. CrossRefzbMATHGoogle Scholar
  7. 7.
    Lee JH, Yoo SI (2008) An effective image segmentation technique for the SEM image. In: 2008 IEEE international conference on industrial technology, pp 1–5.
  8. 8.
    Malik S, Becker GT, Paar C, Burleson WP (2015) Development of a layout-level hardware obfuscation tool. In: 2015 IEEE computer society annual symposium on VLSI, pp 204–209.
  9. 9.
    Otsu N (1979) A threshold selection method from Gray-Level histograms. IEEE Trans Syst Man Cybern 9 (1):62–66. CrossRefGoogle Scholar
  10. 10.
    Principe E, Asadizanjani N, Forte D, Tehranipoor M, Chivas R, DiBattista M, Silverman S (2017) Plasma FIB deprocessing of integrated circuits from the backside. Electronic Device Failure Analysis 19:36–44Google Scholar
  11. 11.
    Quadir SE, Chen J, Forte D, Asadizanjani N, Shahbazmohamadi S, Wang L, Chandy J, Tehranipoor M (2016) A survey on chip to system reverse engineering. J Emerg Technol Comput Syst 13 (1):6:1–6:34. CrossRefGoogle Scholar
  12. 12.
    Ronneberger O, Fischer P, Brox T (2015) U-Net: convolutional networks for biomedical image segmentation. ArXiv e-printsGoogle Scholar
  13. 13.
    Siah YW, Hong YJ, Liu Q, Kor HB, Gan CL (2013) Uniform delayering of copper metallization. In: Proceedings of the 20th IEEE international symposium on the physical and failure analysis of integrated circuits (IPFA), pp 166–169.
  14. 14.
    Torrance R, James D (2011) The state-of-the-art in semiconductor reverse engineering. In: 2011 48Th ACM/EDAC/IEEE design automation conference (DAC), pp 333–338Google Scholar
  15. 15.
    Yu-Bo X, Ping Y, Yong-Xi G (2008) On the graph-based panorama construction for 2D large-scale microscope images. Int Arch Photogramm Remote Sens Spat Inf Sci XXXVII(B5):711–718Google Scholar
  16. 16.
    Zudhistira D, Viswanathan V, Narang V, Chin J, Novotny K, Vincen Oboňa J, Sharang S (2017) Precision Xe plasma FIB delayering for physical failure analysis of sub-20 nm microprocessor devices. In: Proceedings of the ISTFA 2017, Pasadena, USA, pp 593–598Google Scholar

Copyright information

© Springer Nature Switzerland AG 2018

Authors and Affiliations

  1. 1.Reverse Engineering Group, Instituto de Microelectronica de Barcelona IMB-CNM (CSIC); Carrer Tillers s/nBarcelonaSpain
  2. 2.Department of Microelectronics and Electronic SystemsUniversitat Autonoma de Barcelona, Edifici Q, Carrer de les SitgesCerdanyola del VallesSpain

Personalised recommendations