5 ms·

Is it possible to "read out" whatever logic the FPGA was previously programmed with? If the speculation that it came from the Bing accelerator is correct, you m

by moyix 6y ago

Is it possible to "read out" whatever logic the FPGA was previously programmed with? If the speculation that it came from the Bing accelerator is correct, you might end up with some interesting code...

monocasa 6y ago
It's in that 256Mb config flash, but it's probably encrypted with a key inside the FPGA.
fake-name 6y ago
The bitstream that's loaded into the FPGA is very, very far from anything that would look like normal code. Additionally, all major commercial FPGAs have complex facilities for encrypting the bitstream that completely hides it's contents. So it may be possible, but the architecture of the FPGA is not documented, so you'd have to completely reverse engineer the bitstream format, and if the protection is enabled, that'd still get you nowhere.
- moyix 6y ago
  That's true, but there have been attempts to mount attacks on the encryption used in older Stratix: Stratix II: https://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.589.6798&rep=rep1&type=pdf https://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.58... There's been a little work on vulnerabilities in the Stratix V, though AFAICT no break on the encryption: http://www.ecs.umass.edu/ece/tessier/ramesh-fccm18.pdf http://www.ecs.umass.edu/ece/tessier/ramesh-fccm18.pdf And aside from the encryption there's been a lot of work on FPGA bitstream reverse engineering tools, so the output wouldn't be meaningless—it would just take some effort to figure out what it's doing.
  - edgineer 6y ago
    In fact there is a very nice tool for visualizing and analyzing a netlist taken from an FPGA called HAL[0]. In school we used this tool to e.g. modify S-Box output to retrieve an AES key when encryption was implemented within the netlist. [0] https://github.com/emsec/hal https://github.com/emsec/hal
mhh__ 6y ago
The bitstream isn't always secured, and when it is it's not the deepest security, but unless you either have a lot of time or a brilliant insight you probably aren't going to get too far with a raw bitstream.

by moyix 6y ago

monocasa 6y ago

It's in that 256Mb config flash, but it's probably encrypted with a key inside the FPGA.

fake-name 6y ago

The bitstream that's loaded into the FPGA is very, very far from anything that would look like normal code. Additionally, all major commercial FPGAs have complex facilities for encrypting the bitstream that completely hides it's contents. So it may be possible, but the architecture of the FPGA is not documented, so you'd have to completely reverse engineer the bitstream format, and if the protection is enabled, that'd still get you nowhere.

moyix 6y ago
That's true, but there have been attempts to mount attacks on the encryption used in older Stratix: Stratix II: https://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.589.6798&rep=rep1&type=pdf https://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.58... There's been a little work on vulnerabilities in the Stratix V, though AFAICT no break on the encryption: http://www.ecs.umass.edu/ece/tessier/ramesh-fccm18.pdf http://www.ecs.umass.edu/ece/tessier/ramesh-fccm18.pdf And aside from the encryption there's been a lot of work on FPGA bitstream reverse engineering tools, so the output wouldn't be meaningless—it would just take some effort to figure out what it's doing.
- edgineer 6y ago
  In fact there is a very nice tool for visualizing and analyzing a netlist taken from an FPGA called HAL[0]. In school we used this tool to e.g. modify S-Box output to retrieve an AES key when encryption was implemented within the netlist. [0] https://github.com/emsec/hal https://github.com/emsec/hal

mhh__ 6y ago

The bitstream isn't always secured, and when it is it's not the deepest security, but unless you either have a lot of time or a brilliant insight you probably aren't going to get too far with a raw bitstream.