Abstract:Finite-state machine (FSM) always works as a core control unit of a chip or a system. As a high level design, FSM has also been exploited to build multiple secure designs as it is deemed hard to discern FSM structure from the netlist or physical design. However, these secure designs can never sustain once the FSM structure is reversed. Reverse engineering FSM not only indicates the access of the control scheme of a design, but also poses a severe threat to those FSM-based secure designs. As the one-hot encoding FSM is widely adopted in various circuit designs, this paper proposes a non-invasive method to reverse engineer the one-hot encoding FSM. The data dumped from the scan chain during chip operation is first collected. The scan data is then used to identify all the candidate sets of state registers which satisfy two necessary conditions for one-hot state registers. Association relationship between the candidate registers and data registers are further evaluated to identify the unique target set of state registers. The transitions among FSM states are finally retrieved based on the scan dump data from those identified state registers. The experimental results on the benchmark circuits of different size show that this proposed method can identify all one-hot state registers exactly and the transitions can be retrieved at a high accuracy while the existing methods cannot achieve a satisfactory correct detection rate for one-hot encoding FSM.

Automated Finite State Machine Extraction

Design and Implementation of Embedded Finite State Machines in CAD Systems

Abstract State Machine Design of Internetware Model

State Machine Based Malicious Packet Attack Detection and Security Situation Assessment

Identification of State Registers of FSM Through Full Scan by Data Analytics

Non-Invasive Reverse Engineering of One-Hot Finite State Machines Using Scan Dump Data

Improving FSM State Enumeration Performance for Hardware Security with RECUT and REFSM-SAT

Extracting Protocol Format as State Machine via Controlled Static Loop Analysis

An Automatic Object State Machine Extraction Method Using Dynamic Analysis

Identification of FSM State Registers by Analytics of Scan-Dump Data

Inferring State Machine from the Protocol Implementation via Large Language Model

Finite State Machines for Semantic Scene Parsing and Segmentation

Automatic extraction of abstract-object-state machines from unit-test executions.

Verilog Design and Research of Finite State Machine

A Novel Method Of State Identification Sequences Generation For Testing Communication Protocols Modeled As Extended Finite State Machines

Research on real-time FSM modeling for microfabrication NC system

Inferring State Machine from the Protocol Implementation Via Large Langeuage Model.

Automatic Extraction of Sliced Object State Machines for Component Interfaces

Implementation of an Artificial Emotion Model and Behavior Strategies Based on Finite Automata

FSM Builder: A Tool for Writing Autograded Finite Automata Questions

Automatic extraction of abstract-object-state machines based on branch coverage