- Notifications
You must be signed in to change notification settings - Fork0
Library of circuits for use with ReverSim, our open-source netlist reverse engineering simulation
License
emsec/reversim-circuits
Folders and files
| Name | Name | Last commit message | Last commit date | |
|---|---|---|---|---|
Repository files navigation
| title | date | generatorVersion | groups |
|---|---|---|---|
ReverSim - Level Library | 11.02.2025 14:18 | 895ee18 | prolific |
Welcome to the level library forReverSim!
If you don't know the environment yet, here is a brief introduction. The fulldocumentation can be found in theaccompanying Github repository.
ReverSim is an open-source environment for the browser, originally developed at theMax Planck Institute for Security and Privacy (MPI-SP)to study human aspects in hardware reverse engineering.The main objective is to reverse engineer a variety of Boolean circuits, each containing around 2 to 20 logic gates:Participants need to select the correct input values to achieve a set of predetermined output states by operating switches feeding the circuit.For a valid solution, all lamp symbols in the circuit must be lit up and all danger signs must be turned off.
Circuits in ReverSim consist of eight basic elements:
| Icon | Description |
|---|---|
 | The battery is used to represent a logical 1. |
 | Switches are placed after a battery. The participant can open and close them to enter the correct inputs to the circuit. |
 | Logic gate with theAND function. The output is high if all inputs are high. |
 | Logic gate with theOR function. The output will be high if at least one input is high. |
 | Logic gate with theInverter function. The output is low if the single input is high and vice versa. |
 | One of the two objectives. All lamps have to be ON in order to solve the level. |
 | One of the two objectives. All danger signs have to be OFF in order to solve the level. |
 | TheCamouflaged logic gate performing a function unknown to the participant (see details below). |
The icons for the logic gates are derived from the "distinctive shapes" set defined inIEEE Std 91/91a-1991.Gates are connected with wires to form the circuit. Any junctions are highlighted with a dot.
ReverSim implements two special types of logic gates for research on hardware obfuscation:Camouflagedgates visually obscure their actual gate symbol.Covert gates display a different icon that doesnot match their actual logic function, and allow for "dummy inputs" that are visually connected but have no actual effect.Circuits containing such gates are generally more challenging to reverse engineer. The following table lists the possiblecombinations for theCamouflaged andCovert gates:
| Covert Gate | Camouflaged Gate | |
|---|---|---|
| Icon shown in circuit | AND,OR | Camouflaged |
| Real function (Light blue text in this overview, not visible to the participant) | Inverter, Wire | AND,OR |
| Supports dummy inputs? | Yes | No |
Further details about task design and elements are available in thelevel documentation.
A manual for the tool that was used to generate this level library page is available in thescreenshot generator documentation.
| Name | Switches | Outputs | Gates | AND | OR | NOT | Obfuscated | timeLimit | tags |
|---|---|---|---|---|---|---|---|---|---|
| qualification/alow_00000001 | 3 | 1 | 2 | 2 | 0 | 0 | 0 | 0 | |
| qualification/blow_00001000_v2 | 3 | 1 | 3 | 1 | 1 | 1 | 0 | 0 | |
| qualification/clow_11111101_random | 3 | 1 | 4 | 0 | 2 | 2 | 0 | 0 | 🎲 |
| qualification/quali4_random | 3 | 1 | 3 | 1 | 2 | 0 | 0 | 0 | 🎲 |
| low/Level1_random | 3 | 1 | 3 | 1 | 1 | 1 | 0 | 180 | ⏰, 🎲 |
| low/Level4_random | 3 | 1 | 3 | 1 | 1 | 1 | 0 | 180 | ⏰, 🎲 |
| medium/Level3_random | 3 | 2 | 9 | 3 | 3 | 3 | 0 | 600 | ⏰, 🎲 |
| medium/Level4_random | 3 | 2 | 9 | 1 | 4 | 4 | 0 | 600 | ⏰, 🎲 |
| medium/Level5_random | 3 | 2 | 7 | 2 | 3 | 2 | 0 | 600 | ⏰, 🎲 |
| medium/Level6_random | 3 | 2 | 8 | 3 | 3 | 2 | 0 | 600 | ⏰, 🎲 |
| high/Level1_random | 3 | 3 | 12 | 3 | 5 | 4 | 0 | 720 | ⏰, 🎲 |
| high/Level5_fixed_random | 3 | 3 | 12 | 2 | 5 | 5 | 0 | 720 | ⏰, 🎲 |
| high/r2d7_fixed_improved_random | 3 | 3 | 18 | 7 | 3 | 8 | 0 | 720 | ⏰, 🎲 |
| high/F12_random | 3 | 3 | 16 | 7 | 3 | 6 | 0 | 720 | ⏰, 🎲 |
| camouflaged/Level1_camou_random | 3 | 2 | 8 | 2 | 3 | 2 | 1 | 900 | ⏰, 🎲, ❓ |
| camouflaged/Level7_camou_random | 3 | 2 | 8 | 2 | 3 | 2 | 1 | 900 | ⏰, 🎲, ❓ |
Legend:
- ⏰: Has time limit
- 🎲: some switch states are initialized randomly
- ❓: contains camouflage/covert elements
The following screenshots of the levels will contain some annotations that are not shown in ReverSim:
- The name of the level is displayed in light orange in the top left corner
- The ID of the switches are displayed in light blue, so you can better understand which switch was clicked when looking at the log files
- The switches are in the starting position as defined in the level file. If the initial switch position will be random, a dice icon 🎲 is shown on the switch.
- The actual function of covert/camouflage gates is written in blue letters on top of the visual gate icon
numSwitches: 3,numOutputs: 1,numGates: 2,numAND: 2,numOR: 0,numNOT: 0,numObfuscated: 0,timeLimit: 0,numSwitchesRand: 0
Correct solutions for Switch IDs [3, 4, 5]:111
numSwitches: 3,numOutputs: 1,numGates: 3,numAND: 1,numOR: 1,numNOT: 1,numObfuscated: 0,timeLimit: 0,numSwitchesRand: 0
Correct solutions for Switch IDs [3, 4, 5]:010
numSwitches: 3,numOutputs: 1,numGates: 4,numAND: 0,numOR: 2,numNOT: 2,numObfuscated: 0,timeLimit: 0,numSwitchesRand: 3,tags: 🎲
Correct solutions for Switch IDs [3, 4, 5]:110
numSwitches: 3,numOutputs: 1,numGates: 3,numAND: 1,numOR: 2,numNOT: 0,numObfuscated: 0,timeLimit: 0,numSwitchesRand: 3,tags: 🎲
Correct solutions for Switch IDs [6, 7, 8]:000,100
numSwitches: 3,numOutputs: 1,numGates: 3,numAND: 1,numOR: 1,numNOT: 1,numObfuscated: 0,timeLimit: 180,numSwitchesRand: 3,tags: ⏰, 🎲
Correct solutions for Switch IDs [6, 7, 8]:100,001,101
numSwitches: 3,numOutputs: 1,numGates: 3,numAND: 1,numOR: 1,numNOT: 1,numObfuscated: 0,timeLimit: 180,numSwitchesRand: 3,tags: ⏰, 🎲
Correct solutions for Switch IDs [6, 7, 8]:000,100,010
numSwitches: 3,numOutputs: 2,numGates: 9,numAND: 3,numOR: 3,numNOT: 3,numObfuscated: 0,timeLimit: 600,numSwitchesRand: 3,tags: ⏰, 🎲
Correct solutions for Switch IDs [3, 4, 5]:000
numSwitches: 3,numOutputs: 2,numGates: 9,numAND: 1,numOR: 4,numNOT: 4,numObfuscated: 0,timeLimit: 600,numSwitchesRand: 3,tags: ⏰, 🎲
Correct solutions for Switch IDs [3, 4, 5]:101
numSwitches: 3,numOutputs: 2,numGates: 7,numAND: 2,numOR: 3,numNOT: 2,numObfuscated: 0,timeLimit: 600,numSwitchesRand: 3,tags: ⏰, 🎲
Correct solutions for Switch IDs [3, 4, 5]:011
numSwitches: 3,numOutputs: 2,numGates: 8,numAND: 3,numOR: 3,numNOT: 2,numObfuscated: 0,timeLimit: 600,numSwitchesRand: 3,tags: ⏰, 🎲
Correct solutions for Switch IDs [3, 4, 5]:110
numSwitches: 3,numOutputs: 3,numGates: 12,numAND: 3,numOR: 5,numNOT: 4,numObfuscated: 0,timeLimit: 720,numSwitchesRand: 3,tags: ⏰, 🎲
Correct solutions for Switch IDs [6, 7, 8]:011
numSwitches: 3,numOutputs: 3,numGates: 12,numAND: 2,numOR: 5,numNOT: 5,numObfuscated: 0,timeLimit: 720,numSwitchesRand: 3,tags: ⏰, 🎲
Correct solutions for Switch IDs [6, 7, 8]:100
numSwitches: 3,numOutputs: 3,numGates: 18,numAND: 7,numOR: 3,numNOT: 8,numObfuscated: 0,timeLimit: 720,numSwitchesRand: 3,tags: ⏰, 🎲
Correct solutions for Switch IDs [3, 4, 5]:110
numSwitches: 3,numOutputs: 3,numGates: 16,numAND: 7,numOR: 3,numNOT: 6,numObfuscated: 0,timeLimit: 720,numSwitchesRand: 3,tags: ⏰, 🎲
Correct solutions for Switch IDs [3, 4, 5]:100
numSwitches: 3,numOutputs: 2,numGates: 8,numAND: 2,numOR: 3,numNOT: 2,numObfuscated: 1,timeLimit: 900,numSwitchesRand: 3,tags: ⏰, 🎲, ❓
Correct solutions for Switch IDs [3, 4, 5]:111
numSwitches: 3,numOutputs: 2,numGates: 8,numAND: 2,numOR: 3,numNOT: 2,numObfuscated: 1,timeLimit: 900,numSwitchesRand: 3,tags: ⏰, 🎲, ❓
Correct solutions for Switch IDs [3, 4, 5]:010