Ensuring the safety and security of critical legacy FPGA (Field-Programmable Gate Array) hardware generally requires reengineering these systems in state-of-the-art technologies using the latest design-for-trust methods. Often HDL models of the legacy systems need to be reverse engineered due to the lack of ready availability of the original HDL models. Reverse engineering of FPGA designs can be divided into two major phases: (1) Extraction of an LUT (Look-Up Table) level netlist from the configuration bit-stream data. This phase is named netlist reverse engineering. (2) Extraction of an RTL (Register-Transfer Level) model from the LUT-level netlist. This phase is termed functional reverse engineering or specification discovery and poses significant challenges due to the granularity of the LUTs which absorb large Boolean functions, and the unstructured nature of the LUT netlists. This phase, i.e. specification discovery, is the focus of the proposed project.

More specifically, this project will (1) enhance and integrate multiple methods to identify word-level data path modules in LUT netlists, (2) develop new methods to eliminate false positives and overlaps to increase accuracy, (3) develop specialized functional reverse engineering methods for DSP slices and multi-port BlockRAM memory units, (4) develop an RTL model extraction methodology and tool flow based on these point algorithms, and (5) evaluate and demonstrate the tool flow on practical FPGA designs.