Repository logo
 

Reverse engineering Flash EEPROM memories using Scanning Electron Microscopy

Accepted version
Peer-reviewed

Type

Conference Object

Change log

Authors

Skorobogatov, Sergei  ORCID logo  https://orcid.org/0000-0001-9414-6489
Woods, C 

Abstract

In this article, a methodology to extract Flash EEPROM memory contents is presented. Samples are first backside prepared to expose the tunnel oxide of floating gate transistors. Then, a Scanning Electron Microscope (SEM) in the so called Passive Voltage Contrast (PVC) mode allows distinguishing ‘0’ and ‘1’ bit values stored in individual memory cell. Using SEM operator-free acquisition and standard image processing technique we demonstrate the possible automating of such technique over a full memory. The presented fast, efficient and low cost technique is successfully implemented on 0.35μm technology node microcontrollers and on a 0.21μm smart card type integrated circuit. The technique is at least two orders of magnitude faster than state-of-the-art Scanning Probe Microscopy (SPM) methods. Without adequate protection an adversary could obtain the full memory array content within minutes. The technique is a first step for reverse engineering secure embedded systems.

Description

Keywords

reverse engineering, Flash EEPROM, Scanning Electron Microscope (SEM), Passive Voltage Contrast (PVC)

Journal Title

CARDIS 2016: Smart Card Research and Advanced Applications

Conference Name

CARDIS 2016: 15th Smart Card Research and Advanced Application Conference

Journal ISSN

0302-9743
1611-3349

Volume Title

Publisher

Springer