REVBiT 2.0: REVerse Engineering of BiTstream for LUT Extraction, Boolean Logic, and Pin Combination Identification

Field-Programmable Gate Arrays (FPGAs) are extensively utilized in various fields due to their inherent flexibility and ability to be reconfigured. The functionality of digital designs within FPGAs is stored as configuration frames within the bitstream. Previous studies introduced tools like BIL, RapidSmith, Debit, DAT and BitFREE, which reverse-engineer the bitstream to reveal the Boolean logic of Look-Up Tables (LUTs) using the Xilinx ISE design suite. This tool produces both the bitstream and a textual representation of the placed design in the form of the Xilinx Design Language (XDL) file, enabling deeper insights into the FPGA’s internal structure. However, with the introduction of the AMD Xilinx Vivado design suite, support for XDL and text-based hardware adjustments discontinued, making it more challenging to reverse-engineer modern bitstreams. Our prior study, REVBiT, utilized the AMD Xilinx Vivado Design Suite, which extracted the LUTs and identified Boolean logic but failed to identify the pin combination in its present form. The pin combination of LUTs is also essential information for determining the correct configuration of LUTs in the bitstream. To address the limitation of state-of-the-art methods, we introduce REVBiT 2.0, a methodology for extracting LUTs and their Boolean logic, along with the pins connection of the LUT. Our proposed deep-learning models have been trained and tested with 92,82,950 data samples for the pin combination and Boolean logic identification. The experiment for bitstream extraction is carried out on a real FPGA board with the help of a logic analyzer. Our proposed methodology has been experimentally validated on AMD Xilinx 7-Series, Ultrascale, and Ultrascale+ FPGA device families for 2, 3, and 4-input LUTs using the AMD Xilinx Vivado design suite and relying on bitstream without any additional information. We achieved ≈ 100% accuracy for the LUT extraction, more than 87.50% prediction accuracy for pin combination and 92.43% for Boolean logic identification from the bitstream.