Xilinx XC3S1200 Bitstream - Microblaze pack extraction

[Franc]

Hey all!!
I'm from MCU world and beginner in FPGA's. Its really new to me.

I'm doing analysis in one old PCB and stopped in this task - Microblaze (or Picoblaze) firmware.
In embedded WinCE 6.0 of my PCB I can see that App expects some data replies from FPGA XC3S1200 and I think there is some CPU inside the bitstream.

My question is (please), anyone knows how to extract the scripts of Microblaze from this bitstream attached?
Is it possible?

Cheers!!! 

[Bassman59]

My question is (please), anyone knows how to extract the scripts of Microblaze from this bitstream attached?
Is it possible?

It is not possible to recover the design from the bitstream.

[Foxxz]

There are people who have been working to reverse engineer bitstreams but pulling out the compiled code (I assume thats what you mean from "scripts") its running I couldn't say if thats been done. That compiled code may live on your main CPU, flash, or filesystem somewhere. Its possible the bitstream and the code that runs on the softcore are separate.

But we're assuming the FPGA is running a softcore. You don't need that to communicate to a CPU. It could be using an AXI, serial, or other interface.

[kmike]

Hi,

what is this attached file? How did you get it (dumped a flash, or...)?
It does not look like a bitstream or a binary dump from a configuration flash to me (atleast this header "FPGA" is strange).

It is possible to recover the contents of the BRAM from a bitstream, but that would require a valid dump.

Regards,
mike

[Franc]

Dear Kmike!

I found this binary in software update pack of my PCB. In the update pack, I can see this file called fpga.bin.
Also I can see one Coldfire next to it, maybe its Coldfire boots the FPGA bitstream?

BRAM, oh interesting, how I can find it? Can I share the software update to you? 

Cheers!!

[laugensalm]

My question is (please), anyone knows how to extract the scripts of Microblaze from this bitstream attached?
Is it possible?

It is not possible to recover the design from the bitstream.

Depends on what you mean by 'design', you'll never get out something readable, rather a quite unreadable huge net list when decompiled into source.  I can't comment on the tools though. Also, not sure of the status on the Spartan3 family these days, Xilinx used to be good at eliminating web sources for reverse engineering.
However, BRAM images are extracted quite easily, there might be a few sources left on the web concerning the reverse process of data2mem (the BMM file procedure) file. Figuring out the mapping can be fun, you need to know what to look for (i.e. opcodes of the architecture).

In most cases, decompiling is not worth it, unless there's some scrambling present that prevents you from doing black box analysis (i.e. just see what it does). For practising though: good luck :-)

[kmike]

After some some work with your "Fpga.bin" file, I got the BRAM blocks extracted, but they are all empty (0x00).

I do not think there is a Microblaze or a Picoblaze in this design, as both would need BRAM blocks for code.

[Franc]

Dear laugensalm...Thank so much for your help! 
I still searching what happens in FPGA that decode some data comes from one crypted dump (external memory) , its small and looks no much complex but I have no idea as I'm beginner.  BMM, let me check whats it. Thanks again.

[Franc]

Dear kmike, wow! thank so much! 
So BRAM is blank, interesting!! Is possible the BRAM be stored outside of bitstream? 
I can't see the this data decoding without one CPU (as its crypted), that was my thought for they using one Microblaze.
 
There is way to debug this bitstream? Any tool?

Cheers!!!

[kmike]

BRAM is block RAM inside the FPGA.

Picoblaze can only run from BRAM.
Microblaze could theoretically run from an external memory, although I never had to try. It is easier to just use a small bootloader in BRAM, and do everything else from there.

You do not need a CPU inside the FPGA for crypto operations. (You dont need a CPU in an FPGA for a lot of tasks :-) )

Like laugensalm already mentioned, you can only do a black box analysis, no way you can get HDL back from the bitstream.

[Franc]

I see Kmike!! It was very useful.

What is 'Black Box' in FPGA? I can only insert inputs and check the outputs? What tool I can use to do it?

Cheers!!