Bil: A tool-chain for bitstream reverse-engineering

This paper performs an investigation into the security of Xilinx FPGA bitstreams, introducing a tool-chain for reversing bitstreams back to their device-specific netlists. Bitstream reversal is performed by querying a database containing the mapping of bitstream bits to their related configurable FPGA resources and a secondary database describing the FPGA structure. The mapping database is created by applying an algorithm that correlates binary bitstream data with data extracted from a corresponding netlist. The resource database is derived from a textual device description which can be obtained from the Xilinx design flow. The method can successfully reverse certain sections of the bitstream, although complete bitstream reversal remains infeasible for the time being. The presented tool-chain, the Bitfile Interpretation Library (BIL), improves on previous attempts at bitstream reverse engineering. It is made available as open source for further development.