Physically auditing the layout of transistors inside a processor made at 22mm process die

Question

What is necessary to check that the layout of all the 35000 transistors on a given physical processor was not tampered with, assuming the normal layout and its dispositions on the die are extensively documented?

Microscope ? Specialized imaging software ? Chemical reagents, and others that are to buy for each check ? How much man-hours of work ? What else ?

If it is easier to provide an answer for a particular case, you can assume that it is a K-machine but made on a die at modern 22nm process.

If you prefer a processor you are more familiar with, you can assume an armv6 processor but made on a die at modern 22nm process.

You can assume that I will have access to all details of the fab to produce the processor, but that the particular physical processor I want to audit was made on the same fab line by the NSA.

Answer 1

This video on YouTube can be a good start.

Reverse Engineering the MOS 6502 CPU [27C3 (Chaos Computer Congress)].

Watching the video from minute 25 to 30 you can see how CPU dice was exposed and how the data were processed. Basically hi-res photos were stitched together and traced to create a vector image. This in turned was used to create a netlist used by simulation software.

Contribution suggested by https://reverseengineering.stackexchange.com/users/3259/user2987828

According to the video linked on @ruby_object's answer, if you need to check the 8-bit RISC processor MOS-6502-D made on a 4µm process fab with RAM capped to 64ko: hot sulfuric acid (200º F). microscope nikon Optiphot 200 with 10x objective. the layout with three layers of 3510 transistors and 20,000 metal plates. less than a few man months for matching microscope images to layout.

That does not answer correctly for 22nm process though.

Content of the video

0:00 intro

2:00 uses

3:30 talk outline

Part I - Top Down

4:10 code, registers, conventions

Part II - Bottom Up

20:30 benefits of using available documentation and lack of it in general

25:00 dice photographs

25:15 early results

25:21 2001 hi-res photos, and creation of schematic diagram

26:20 other efforts by Visual 6502 project

26:40 slides showing removing plastic using hot acid

27:04 results of acid work

27:11 nice results

27:38 microscopes

27:45 lots and lots of tiny photographs stiched together

27:52 taking photographs of the surface not enough, several layers

28:10 removal of other layers using chemicals

28:13 and hires photo

26:20 200 megapixel hi-res photo of the dice

28:35 custom software to trace photos

28:55 vector drawing

29:05 final results

29:25 netlist

29:50 simulating processor using netlist

30:53 speed

32:00 simulation in web browser

32:45 C simulator

34:00 other emulators

Part III - What We Have Learned

40:00 example what was found

44:45 illegal opcodes

48:10 present reverse engineering efforts

48:50 licenced cpu in other product

49:50 vectorising Z80, other chips

50:30 x-ray of motherboard

Answer 2

Dmitry Nedospasov gave an epic presentation at Toorcon about backside IC analysis. The above video is also awesome but doesn't take into account the trouble IC and chip makers trying to protect their chips from this type of invasion. Here is a link to Dmitry and other's white paper which thoroughly discusses the best process in my opinion.

http://nedos.net/ccs2013.pdf

Answer 3

According to the video linked on @ruby_object's answer, if you need to check the 8-bit RISC processor MOS-6502-D made on a 4µm process fab, you need:

• hot sulfuric acid (200º F).
• microscope nikon Optiphot 200 with 10x objective.
• the layout with three layers of 3510 transistors and 20,000 metal plates.
• less than four man months for matching microscope images to layout (four months was the duration without the layout).
• computer graphics techniques

That does not answer correctly for 22nm process though.