Extraction of ROM Data from Bitstream in Xilinx FPGA

Abstract

Recently, many researches have investigated efficient reverse engineering methods to restore Programmable Logic Points (PLPs) and Programmable Interconnect Points (PIPs) in SRAM-based Field Programmable Gate Arrays (FPGAs). However, the research on the restoration of Programmable Content Points (PCPs) such as memory data are rarely studied. In this paper, we propose an efficient reverse engineering method to recover Read Only Memory (ROM) data, which is essential for the implementation of modern digital circuits. First, we analyze the FPGA hardware resources mapped to Xilinx primitive library of ROM, and next the proposed reverse engineering process is explained using mapping relation between ROM data and hardware resources. As an example, XC3S50 FPGA of Xilinx Sparatan-3 family is utilized, and the process of restoring the SBOX of AES (Advanced Encryption Standard) is provided as a practical application.