[GH-ISSUE #3646] [Feature] FPGA bitstream reverse engineering: configuration packets, device resources and structural recovery #1368

New issue

Open

opened 2026-10-16 21:04:43 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:04:43 +00:00

Owner

Originally created by @matbrgz on GitHub (Oct 14, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/3646

Summary

Field Programmable Gate Arrays (FPGAs) from vendors such as AMD/Xilinx (7-Series, UltraScale, UltraScale+), Intel/Altera (Cyclone, Stratix, Arria, Agilex), and Lattice (iCE40, ECP5, CrossLink) represent the physical foundation of aerospace hardware, telecommunications base stations, hardware security modules (HSMs), radar signal processors, and high-frequency trading engines.

In hardware security audits, supply chain verification, and IP theft investigations, analysts only have access to raw compiled FPGA Bitstreams dumped from SPI NOR flash chips or captured over JTAG buses. Currently, REA analyzes flash dumps (#3615) and firmware binaries, but treats FPGA bitstreams as completely opaque binary blobs.

This feature proposal introduces dedicated FPGA Bitstream Reverse Engineering to REA, enabling automated bitstream packet parsing, target device identification, Block RAM (BRAM) initialization extraction (recovering embedded firmware and microcode), configuration frame mapping, and structural netlist recovery.

Technical Capabilities & Architecture

                                    +-----------------------------------------+
                                    | Input: FPGA Bitstream (.bit, .bin, .mcs)|
                                    +--------------------+--------------------+
                                                         |
                         +-------------------------------+-------------------------------+
                         |                                                               |
                         v                                                               v
           +---------------------------+                                   +---------------------------+
           | Bitstream Header & Sync   |                                   | Device Identification     |
           | Word Parser (AA995566,etc)|                                   | (IDCODE, Part Number, Ver)|
           +-------------+-------------+                                   +-------------+-------------+
                         |                                                               |
                         +-------------------------------+-------------------------------+
                                                         |
                                                         v
                                     +---------------------------------------+
                                     | Configuration Packet Engine           |
                                     | (Type 1 / Type 2 Register Packets)    |
                                     +-------------------+-------------------+
                                                         |
                         +-------------------------------+-------------------------------+
                         |                               |                               |
                         v                               v                               v
           +---------------------------+   +---------------------------+   +---------------------------+
           | Block RAM (BRAM) Content  |   | Security & Encryption     |   | Configuration Frame       |
           | Extraction (Embedded CPU) |   | Auditing (AES, HMAC, BBRAM|   | Mapping (LUTs, Intercon)  |
           +-------------+-------------+   +-------------+-------------+   +-------------+-------------+
                                                         |
                                                         v
                                     +---------------------------------------+
                                     | Structural Netlist Synthesis & Logic  |
                                     | Recovery (Verilog / Gate-Level Graph) |
                                     +---------------------------------------+

1. Bitstream Format & Header Ingestion

Vendor Format Support:
- AMD / Xilinx (.bit, .bin, .mcs): Parse Xilinx .bit container headers (fields a design name, b part number, c date, d time, e data length) and detect Synchronization Words (0xAA995566).
- Lattice (.bin / Project Trellis/IceStorm): Parse preamble, metadata comments, and frame records.
- Intel / Altera (.rbf, .sof, .pof): Parse Raw Binary Files and POF headers.

2. Device Identification & Configuration Packet Decoding

Device ID (IDCODE): Extract the target device identifier from configuration packets (e.g. matching Xilinx 7-Series XC7A35T, XC7Z020, UltraScale XCVU9P), verifying family, array size, and stepping.
Register Packet Stream: Invert Type 1 and Type 2 configuration packets:
- Command Register (CMD): WCFG (Write Configuration), RCRC (Reset CRC), LFRM (Last Frame).
- Frame Address Register (FAR): block type (CLB/IO/CLK, BRAM), row address, column address, minor address.
- Configuration Options (COR0, COR1): startup clock source, shutdown sequences.
- Mask and Control Registers (CTL0, CTL1): security bits, ICAP access.

3. Block RAM (BRAM) Initialization Extraction

Embedded Soft-Core Firmware Recovery: FPGAs frequently embed soft-core processors (RISC-V, MicroBlaze, Nios II, PicoBlaze) whose initial firmware and stack reside in initialized Block RAMs (INIT_xx / INITP_xx configuration frames).
Memory Carving: Automatically carve and assemble non-contiguous BRAM frames into contiguous binary firmware images, directly feeding them into REA's existing Ghidra/Rizin native analysis engines!

4. Security Feature & Cryptographic Auditing

Bitstream Encryption & Authentication: Detect enabled hardware security settings:
- AES-256 bitstream encryption flag (DEC bit in CTL0).
- HMAC / RSA-2048 / ECDSA-P384 authentication blocks.
- Battery-backed RAM (BBRAM) vs. eFuse key select.
- Readback disable flags (Security bits preventing JTAG bitstream dumping).

5. Structural Frame Mapping & Netlist Reconstruction

CLB / LUT Tile Mapping: Map configuration bits within logic tiles (e.g. SliceL / SliceM in Xilinx, PFU in Lattice):
- Invert Look-Up Table (LUT) bit configurations into boolean truth tables and logic expressions.
- Recover Flip-Flop / Latch configurations (set/reset, clock enable, async vs sync).
Interconnect & Routing Analysis: Extract routing pass-transistors and PIPs (Programmable Interconnect Points).
Verilog Netlist Synthesis: Export recovered logic blocks into synthesizable gate-level Verilog (.v) or structural JSON schematics.

Acceptance Criteria

Introduce analyze_fpga_bitstream in REA CLI and MCP contracts, accepting .bit, .bin, and .mcs files.
Ingest synthetic Xilinx 7-Series and Lattice iCE40 bitstreams without format errors.
Correctly parse IDCODE to identify target FPGA part numbers and family parameters.
Extract initialized BRAM memory contents from synthetic bitstreams into binary firmware files with verified digests.
Audit bitstream security registers, documenting encryption and readback protection flags.

#3615 [Feature] Hardware and Embedded Reverse Engineering: ESP32 firmware
#3621 [Feature] Unknown binary file-format inference: structure hypotheses
#3620 [Feature] Shader and GPU Bytecode Reverse Engineering

Originally created by @matbrgz on GitHub (Oct 14, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/3646 [![Type: Feature](https://img.shields.io/badge/type-feature-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Domain: Reverse Engineering](https://img.shields.io/badge/domain-reverse_engineering-blueviolet.svg?style=flat-square)](https://github.com/morluto/rea) [![Status: Proposed](https://img.shields.io/badge/status-proposed-blue.svg?style=flat-square)](https://github.com/morluto/rea) [![Ecosystem: REA](https://img.shields.io/badge/ecosystem-morluto%2Frea-8A2BE2.svg?style=flat-square)](https://github.com/morluto/rea) ## Summary Field Programmable Gate Arrays (FPGAs) from vendors such as AMD/Xilinx (7-Series, UltraScale, UltraScale+), Intel/Altera (Cyclone, Stratix, Arria, Agilex), and Lattice (iCE40, ECP5, CrossLink) represent the physical foundation of aerospace hardware, telecommunications base stations, hardware security modules (HSMs), radar signal processors, and high-frequency trading engines. In hardware security audits, supply chain verification, and IP theft investigations, analysts only have access to raw compiled **FPGA Bitstreams** dumped from SPI NOR flash chips or captured over JTAG buses. Currently, REA analyzes flash dumps (#3615) and firmware binaries, but treats FPGA bitstreams as completely opaque binary blobs. This feature proposal introduces dedicated **FPGA Bitstream Reverse Engineering** to REA, enabling automated bitstream packet parsing, target device identification, Block RAM (BRAM) initialization extraction (recovering embedded firmware and microcode), configuration frame mapping, and structural netlist recovery. --- ## Technical Capabilities & Architecture ``` +-----------------------------------------+ | Input: FPGA Bitstream (.bit, .bin, .mcs)| +--------------------+--------------------+ | +-------------------------------+-------------------------------+ | | v v +---------------------------+ +---------------------------+ | Bitstream Header & Sync | | Device Identification | | Word Parser (AA995566,etc)| | (IDCODE, Part Number, Ver)| +-------------+-------------+ +-------------+-------------+ | | +-------------------------------+-------------------------------+ | v +---------------------------------------+ | Configuration Packet Engine | | (Type 1 / Type 2 Register Packets) | +-------------------+-------------------+ | +-------------------------------+-------------------------------+ | | | v v v +---------------------------+ +---------------------------+ +---------------------------+ | Block RAM (BRAM) Content | | Security & Encryption | | Configuration Frame | | Extraction (Embedded CPU) | | Auditing (AES, HMAC, BBRAM| | Mapping (LUTs, Intercon) | +-------------+-------------+ +-------------+-------------+ +-------------+-------------+ | v +---------------------------------------+ | Structural Netlist Synthesis & Logic | | Recovery (Verilog / Gate-Level Graph) | +---------------------------------------+ ``` ### 1. Bitstream Format & Header Ingestion - **Vendor Format Support:** - **AMD / Xilinx (`.bit`, `.bin`, `.mcs`):** Parse Xilinx `.bit` container headers (fields `a` design name, `b` part number, `c` date, `d` time, `e` data length) and detect Synchronization Words (`0xAA995566`). - **Lattice (`.bin` / Project Trellis/IceStorm):** Parse preamble, metadata comments, and frame records. - **Intel / Altera (`.rbf`, `.sof`, `.pof`):** Parse Raw Binary Files and POF headers. ### 2. Device Identification & Configuration Packet Decoding - **Device ID (`IDCODE`):** Extract the target device identifier from configuration packets (e.g. matching Xilinx 7-Series `XC7A35T`, `XC7Z020`, UltraScale `XCVU9P`), verifying family, array size, and stepping. - **Register Packet Stream:** Invert Type 1 and Type 2 configuration packets: - Command Register (`CMD`): `WCFG` (Write Configuration), `RCRC` (Reset CRC), `LFRM` (Last Frame). - Frame Address Register (`FAR`): block type (CLB/IO/CLK, BRAM), row address, column address, minor address. - Configuration Options (`COR0`, `COR1`): startup clock source, shutdown sequences. - Mask and Control Registers (`CTL0`, `CTL1`): security bits, ICAP access. ### 3. Block RAM (BRAM) Initialization Extraction - **Embedded Soft-Core Firmware Recovery:** FPGAs frequently embed soft-core processors (RISC-V, MicroBlaze, Nios II, PicoBlaze) whose initial firmware and stack reside in initialized Block RAMs (`INIT_xx` / `INITP_xx` configuration frames). - **Memory Carving:** Automatically carve and assemble non-contiguous BRAM frames into contiguous binary firmware images, directly feeding them into REA's existing Ghidra/Rizin native analysis engines! ### 4. Security Feature & Cryptographic Auditing - **Bitstream Encryption & Authentication:** Detect enabled hardware security settings: - AES-256 bitstream encryption flag (`DEC` bit in CTL0). - HMAC / RSA-2048 / ECDSA-P384 authentication blocks. - Battery-backed RAM (BBRAM) vs. eFuse key select. - Readback disable flags (`Security` bits preventing JTAG bitstream dumping). ### 5. Structural Frame Mapping & Netlist Reconstruction - **CLB / LUT Tile Mapping:** Map configuration bits within logic tiles (e.g. SliceL / SliceM in Xilinx, PFU in Lattice): - Invert Look-Up Table (LUT) bit configurations into boolean truth tables and logic expressions. - Recover Flip-Flop / Latch configurations (set/reset, clock enable, async vs sync). - **Interconnect & Routing Analysis:** Extract routing pass-transistors and PIPs (Programmable Interconnect Points). - **Verilog Netlist Synthesis:** Export recovered logic blocks into synthesizable gate-level Verilog (`.v`) or structural JSON schematics. --- ## Acceptance Criteria 1. Introduce `analyze_fpga_bitstream` in REA CLI and MCP contracts, accepting `.bit`, `.bin`, and `.mcs` files. 2. Ingest synthetic Xilinx 7-Series and Lattice iCE40 bitstreams without format errors. 3. Correctly parse `IDCODE` to identify target FPGA part numbers and family parameters. 4. Extract initialized BRAM memory contents from synthetic bitstreams into binary firmware files with verified digests. 5. Audit bitstream security registers, documenting encryption and readback protection flags. --- ## Related - #3615 [Feature] Hardware and Embedded Reverse Engineering: ESP32 firmware - #3621 [Feature] Unknown binary file-format inference: structure hypotheses - #3620 [Feature] Shader and GPU Bytecode Reverse Engineering

bsakaguchi referenced this issue

2026-10-17 21:01:32 +00:00

[GH-ISSUE #2383] [Tracker] Audit analysis and debugging coverage for the TIOBE top 100 languages (October 2026) #794

bsakaguchi referenced this issue

2026-10-17 21:10:47 +00:00

[PR #1368] [MERGED] fix(javascript): scan direct returns without recursive stack growth #2831