3 ms·

The bitstream that's loaded into the FPGA is very, very far from anything that would look like normal code. Additionally, all major commercial FPGAs have comple

The bitstream that's loaded into the FPGA is very, very far from anything that would look like normal code. Additionally, all major commercial FPGAs have complex facilities for encrypting the bitstream that completely hides it's contents. So it may be possible, but the architecture of the FPGA is not documented, so you'd have to completely reverse engineer the bitstream format, and if the protection is enabled, that'd still get you nowhere.

moyix 6y ago
That's true, but there have been attempts to mount attacks on the encryption used in older Stratix: Stratix II: https://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.589.6798&rep=rep1&type=pdf https://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.58... There's been a little work on vulnerabilities in the Stratix V, though AFAICT no break on the encryption: http://www.ecs.umass.edu/ece/tessier/ramesh-fccm18.pdf http://www.ecs.umass.edu/ece/tessier/ramesh-fccm18.pdf And aside from the encryption there's been a lot of work on FPGA bitstream reverse engineering tools, so the output wouldn't be meaningless—it would just take some effort to figure out what it's doing.
- edgineer 6y ago
  In fact there is a very nice tool for visualizing and analyzing a netlist taken from an FPGA called HAL[0]. In school we used this tool to e.g. modify S-Box output to retrieve an AES key when encryption was implemented within the netlist. [0] https://github.com/emsec/hal https://github.com/emsec/hal