Silicon Reverse Engineering | Cost and Feasibility

What Is Silicon Reverse Engineering?

Silicon reverse engineering is the systematic process of recovering circuit topology, gate-level netlists, or stored firmware from a fabricated integrated circuit. Engineers decapsulate the package, image each metal and diffusion layer of the die, and reconstruct the design—either as a schematic, a functional netlist, or a binary firmware dump. The technique serves authorized purposes: legacy device recovery, failure analysis, IP verification, and second-source qualification.

Unlike board-level PCB reverse engineering, which deals with copper traces on FR-4, silicon reverse engineering operates at the transistor level—feature sizes from 180 nm down to 28 nm or smaller. The tools, costs, and timelines differ by orders of magnitude, and feasibility depends heavily on the target process node, number of metal layers, and the specific protections the IC vendor has implemented.

How Does Silicon Reverse Engineering Work?

1. Decapsulation

The IC package is opened chemically (fuming nitric acid or sulfuric acid at 200–250 °C) or mechanically (CNC milling, laser ablation) to expose the bare die. Chemical decap is standard for plastic packages; ceramic and BGA packages sometimes require a combination approach. A poorly executed decap can destroy bond wires or crack the die, so this step alone demands experienced hands.

2. Die Imaging

Once exposed, the die surface is imaged with an optical microscope (for features ≥ 250 nm) or a scanning electron microscope (SEM) for sub-250 nm nodes. Each metal layer is photographed after selective etching or focused ion beam (FIB) milling removes the layer above it. A 6-metal-layer device in a 90 nm process may require 8–12 distinct imaging passes, each stitched into a full-die mosaic at resolutions of 50–100 nm per pixel.

3. Image Processing and Annotation

High-resolution mosaics are loaded into specialized software (Degate, Chipworks-style proprietary tools, or custom OpenCV pipelines) where engineers identify standard cells, trace interconnects, and annotate transistor types (NMOS/PMOS), vias, and contacts. On older nodes (≥ 350 nm), semi-automated recognition can identify 60–80 % of cells; on advanced nodes, manual effort rises sharply.

4. Netlist Extraction and Verification

Annotated cells are connected into a gate-level netlist. Engineers verify functional blocks against known IP cores (UART, SPI, ARM Cortex-M, 8051, etc.) and simulate critical paths. For firmware recovery, ROM and flash contents are read optically or via micro-probing after the passivation layer is removed.

What Does Silicon Reverse Engineering Cost?

Cost varies enormously based on die size, process node, metal layer count, and project scope. The table below gives realistic ranges our engineering team encounters:

Firmware-only extraction from a known architecture (reading out mask ROM or flash contents without full netlist reconstruction) sits at the lower end. Full gate-level netlist recovery with simulation pushes the upper end. Die size matters too: a 1 mm × 1 mm die images far faster than a 5 mm × 5 mm die at the same node.

Key Feasibility Factors

Process Node and Metal Stack

Every additional metal layer adds an etch-and-image cycle. A 2-metal 350 nm device is a straightforward project; a 9-metal 40 nm device is an entirely different class of effort. Below 28 nm, FinFET structures and double-patterning make optical disambiguation extremely difficult, often requiring transmission electron microscopy (TEM) cross-sections.

Anti-Tamper and Security Features

Many modern MCUs implement read-out protection (RDP), code-read protection (CRP), or hardware-fused security bits. Some add active shield meshes, glitch detectors, or encrypted flash. These protections don’t always prevent silicon-level analysis, but they increase cost and reduce success certainty. For example, an STC89C52 with basic lock bits is far simpler to recover than a device with a multi-layer active shield.

Die Condition and Package Type

Corrosion, ESD damage, or prior rework can degrade die integrity. Flip-chip BGAs require backside thinning before imaging, adding risk. We always recommend sending at least two samples—one for destructive analysis, one as a reference.

Scope of Recovery

Not every project needs a full transistor-level netlist. Common scopes include:

• Firmware dump only — read ROM/flash contents, output a binary or Intel HEX file.
• Block-level floorplan — identify major IP blocks, memory regions, I/O ring, without tracing every gate.
• Full gate-level netlist — complete schematic extraction, suitable for re-implementation or verification.
• Targeted analysis — reverse a specific functional block (e.g., the crypto engine, the ADC, or a proprietary protocol handler).

When Is Silicon Reverse Engineering Worth It?

The investment makes sense in several well-defined scenarios:

• Legacy firmware recovery: The original source code is lost, the vendor is defunct, and you own the design. Extracting firmware from an obsolete MCU—like an NXP LPC1768 or a TI MSP430FR5969—lets you migrate to a current platform.
• IP verification: Confirming that a contracted foundry or ASIC house implemented your design correctly, especially for safety-critical or mil-spec parts.
• Failure analysis: Identifying a systematic silicon defect, mask error, or process deviation that board-level testing cannot isolate.
• Competitive benchmarking: Understanding a competitor’s architecture at the block level for patent landscaping (legal counsel required).
• Second-source qualification: Verifying that an alternative-source part is die-identical or functionally equivalent before committing to production.

Silicon-Level vs. Non-Invasive IC Unlock

Full silicon reverse engineering is not always necessary. Many MCUs can be unlocked through non-invasive or semi-invasive techniques—voltage glitching, UV exposure, debug-port exploitation—without imaging the die at all. Devices like the Silicon Labs EFM8BB or the ESP32-C3 may yield to lower-cost methods first.

Our standard workflow starts with a feasibility assessment: we evaluate the target part number, its known protection scheme, and your recovery scope before recommending the most cost-effective path. Authorization and proof of ownership are required for all IC recovery work—see our STC8H unlock process for a typical example of how we handle protected 8-bit MCUs.

Equipment and Capabilities Required

Silicon reverse engineering demands capital-intensive lab infrastructure that most engineering firms don’t maintain in-house:

• Chemical decapsulation station — acid-resistant fume hood, temperature-controlled acid baths, DI water rinse system.
• Optical microscope with motorized stage — 5×–100× objectives, automated stitching, dark-field and DIC illumination.
• Scanning electron microscope (SEM) — 5 nm resolution minimum for sub-130 nm nodes.
• Focused ion beam (FIB) system — for precision cross-sectioning, layer-by-layer delayering, and circuit edit.
• Micro-probing station — tungsten or platinum probes on nanomanipulators for in-situ signal measurement.
• Image processing workstations — 128+ GB RAM, high-resolution displays, Degate or equivalent annotation software.

A single FIB/SEM system costs $500K–$2M. This capital requirement is exactly why outsourcing silicon analysis to a lab with existing infrastructure makes economic sense for most engineering teams.

What We Deliver

Depending on the agreed scope, deliverables from a silicon reverse engineering project include:

• Firmware binary (HEX/BIN) with memory map documentation.
• Die photographs at each metal layer (TIFF, 50–200 nm/pixel).
• Annotated floorplan identifying major IP blocks.
• Gate-level netlist (Verilog or SPICE) with cell library mapping.
• Functional verification report with simulation results for critical blocks.

Related reading

• Oct 2026STC IC Unlock | Families We Can Read & Recover
• Oct 2026NXP Kinetis KL Crack | Protection Levels Explained
• Oct 2026Sinowealth IC Unlock | Families We Can Read