Reverse Engineering Custom ASICs By Exploiting Supply-Chain Leaks
summary
Custom Siemens S7-1200 SoCs are bought as leaked boards on Chinese marketplaces, probed with an oscilloscope, simple resistance measurements and decapped with sulfuric acid to read labels; 60% of pins mapped across MB87M2230 and SIEMENS-A5E30235063. One older SoC is Fujitsu ARM-BE (chip ID 0x1406C009), the newer is ARM Cortex‑R4 r1p3 big‑endian. JTAG ports and flash/RAM interfaces are identified, a JTAG adapter enables dump/write memory, breakpoints and live debugging, and proof‑of‑concept code runs on the device.
AI-written summary · about
chapters (5)
- 0:00Start
- 2:07What Is an Asic
- 16:24Decapping the Chips
- 23:06Live Debugger
- 26:16Were You Able To Retrieve the Firmware from the Chip
related talks
21mOpen Source IC Design and Hardware Reverse Engineering Or: How I Learned to Stop...
32mSecSi Product Development
33mBreaking Into Chips By Reading The Datasheet
01h 46mTutorial: Introduction to Reverse Engineering
48mReverse-Engineering the Supra iBox: Exploitation of a Hardened MSP430-Based Device
48mDoors of Durin: The Veiled Gate to Siemens S7 Silicon
39mA Decade After Stuxnet: How Siemens S7 is Still an Attacker's Heaven
44mSilicon Under Attack Physical Exploitation Of Modern Chips