Laser Frequency Mapping and Laser Voltage Tracing for analysis of embedded memory circuit
2025-03-18 , Lecture Hall

Embedded flash memory is a standard component of any modern microcontroller units (MCU) that may store critical data such as application firmware, configuration or user’s and application data. Content recovery may be required in some forensics analysis or physical assurance testing and evaluation. Previous work has demonstrated that it is possible to recover data through chemical engraving. If this approach enables the recovery of a large amount of data in short period of time, it necessitates an intensive learning process for each newly analyzed device. This includes a phase of understanding the physical layout of the data in the memory array. Objective of physical data mapping is to find the matching between logical addresses and the physical location of a bitcells in the memory array. As this may require the preparation of several samples programmed with different datasets, any additional information shortening the process is welcome. Various semi-invasive approaches to understand physical data mapping have been reported, including photon emission during write operations or a combination of laser fault injection and laser frequency mapping during read operations. However, as device scaling progresses, these are challenged by different factors that include voltage reduction, cells integration against optical resolution or limited control over the device test loop. In this talk, we will discuss how laser-probing techniques such as laser frequency mapping (LFM) and laser voltage tracing (LVT) applied to circuits connected to the memory array (e.g., sense amplifier and column decoder) can enable the understanding of physical data layout by recovering different data-related patterns. Examples of application will be discussed on Cortex M33 and M7 microcontrollers.


Topics: Non-invasive and Semi-invasive Techniques for HRE, Hardware Reverse Engineering Case Studies