Learn about the process of initial reverse engineering the pinout of unknown ASICs by using moderate methods. The two described ICs are good examples out of many industry-solutions and have been chosen to demonstrate how design decisions from vendors are made. The exploited potential leak of the supply-chain can be leveraged by a hardware reverse engineer to extract internal information about such systems.

Many industry specific solutions in the field of SCADA consist of unknown custom chips without public documentation. These Application Specific Integrated Circuits (ASICs) are often simple System on Chip (SoC) solutions with standardized modules and few custom functionalities like additional CAN-Bus interfaces etc.

During this talk we will present hardware reverse engineering of custom chips and how to find vulnerabilities by using the Siemens S7-1200 (v1 and v4) series as exemplary targets.

After opening the PLC, it was clear that all parts, except the main SoC, were off-the-shelf components. This was the case for both versions of the Siemens PLCs. Leaked boards for both chips, MB87M2230 and SIEMENS-A5E30235063 were found and bought on a Chinese online shop.

With these boards, more than 60 percent of the pins from both chips were reverse-engineered. With the help of an oscilloscope, the protocols and the different voltage levels were identified. Simple resistance measurements were also done to find all connections…