Reverse-Engineering and Data Extraction from SRAM using Photon Emission Analysis

Photonic emissions from switching transistors in Integrated Circuits (ICs) allow the observation of their activity and reverse-engineering of their components. Under certain conditions, data can also be retrieved using Photon Emission Analysis (PEA). This paper demonstrates how PEA can be employed to reverse-engineer and retrieve data from SRAM in Microcontroller Units (MCUs). It discusses the constraints and limitations of PEA and explains the mechanisms behind light emission in ICs. The optical setup and operational nuances of embedded MCU memory is described. Scenarios for reverse-engineering SRAM using Space and Time-Resolved Photon Emission Analysis are explored. Data extraction from the SRAM is demonstrated by an attack scenario, which also presents countermeasures to prevent data leakage.