Semi-invasive logic state imaging of SRAM cells via optical analysis has been demonstrated to be a powerful attack vector on advanced ICs. Reported applications tend to focus on the recovery of small size secrets such as encryption keys. However, the emergence of new cryptographic algorithms with encryption keys or other assets of larger size makes manual approach challenging. In this manuscript, a framework for the automated estimation of bitcell data is developed. It focuses on understanding signal generation and detection processes to assess viability of well-established classification and clustering algorithms. A main advantage of such an approach is that it makes optical attacks for large scale recovery more feasible since limited to no training data is required. The approach is evaluated on a dataset generated under Thermal Laser Stimulation on a commercial SoC-FPGA manufactured in 28 nm technology.

Embedded Non-Volatile-Memory (NVM) such as Flash or EEPROM is a key component in modern microcontroller units. For instance, it can be used to store critical information such as user passwords or device firmware. Although several studies reported ways to extract binary data from embedded EEPROM bitcells, data organization has received less attention. In this paper, we present a method to identify bitcells organization in the EEPROM array. It relies on a combination of various laser-based techniques. The method was applied to an 8 bits AVR microcontroller.

A new data retrieval approach utilizing selective staining is explored to differentiate “0” from “1” cells in EEPROM and Flash memory with node sizes of 40 nm and 250 nm. A two-step staining process based on selective oxide etching and copper galvanic displacement deposition is introduced. The underlying mechanism is attributed to the difference in electric field across the tunnel oxide, which originates from the presence or absence of charges stored in the floating gates. With proper sample preparation, the selectively stained and non-stained cells can be characterized with optical microscopy and scanning electron microscopy, to facilitate direct read-out of data in a time-efficient manner. The physical layout of individual memory cells with respect to the stored data is identified. A systematic data retrieval is achieved with an accuracy of 95% at individual bit level. This selective staining technique marks the data permanently on the chip that allows for subsequent analysis and evidence retention.