# Betrayed by Light: How Photon Emission Microscopy Empowers Register Bit-Level Laser Attacks on Microcontrollers

Hugo Perrin, Jean-Max Dutertre, Jean-Baptiste Rigaud

► To cite this version:

Hugo Perrin, Jean-Max Dutertre, Jean-Baptiste Rigaud. Betrayed by Light: How Photon Emission Microscopy Empowers Register Bit-Level Laser Attacks on Microcontrollers. 2025 IEEE International Symposium on Hardware Oriented Security and Trust (HOST), May 2025, San Jose, United States. pp.35 - 45, 10.1109/host64725.2025.11050055. hal-05534553

HAL Id: hal-05534553

https://hal.science/hal-05534553v1

Submitted on 3 Mar 2026

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons CC BY 4.0 - Attribution - International License
# Betrayed by Light: How Photon Emission Microscopy Empowers Register Bit-level Laser Attacks on Microcontrollers

Hugo Perrin, Jean-Max Dutertre, Jean-Baptiste Rigaud

Mines Saint-Etienne, CEA, Leti, Centre CMP, F-13541 Gardanne France

h.perrin@emse.fr dutertre@emse.fr rigaud@emse.fr

*Abstract*—Photons are emitted through various physical phenomena when current goes through the transistors of Integrated Circuits (IC). Etching the packaging of an IC to reveal the silicon die lets an observer measure that light for the purpose of retro-engineering or data extraction. This Photon Emission Microscopy (PEM) technique has applications in the fields of failure analysis and hardware security. The purpose of this paper is to present how time-integrated PEM can be added to a Laser Fault Injection (LFI) attack workflow for the quick retro-engineering of the position of a microcontroller's digital building blocks, such as its core registers, on a relatively low-cost laser bench. Firstly, the extraction of the position of multiple core registers is presented for three different ARM Cortex microprocessor implementations. Subsequently, the extraction of the position of their individual bits is confronted with the results of a traditional LFI on the same registers.

*Index Terms*—Photon Emission Microscopy, Laser Fault Injection, IC Reverse-Engineering, Microcontroller, Hardware Security.

## I. INTRODUCTION

Physical attacks against embedded circuits are an ever-growing threat today, as commercial and informational transactions are increasingly digitalized and networked in portable electronic devices. In this context, an attacker who gains physical access to a device can use a wide range of attack classes, often completely independent from cybersecurity countermeasures. As a consequence, manufacturers have started to design security-focused product lines that implement software and hardware security features. In order to correctly assess the level of protection of a system designed with such products, it is mandatory to balance the added cost of the countermeasures with regards to the value of the data or service being protected.

As a matter of fact, the cost of an attack scenario is greatly dependent on the tools, the prior knowledge and the time required to conduct the attack. Moreover, the cost of each attack tends to decrease with time, as techniques are refined and instruments become more accessible. In this paper, we focus on one of the most expensive classes of attacks: Laser Fault Injection (LFI). Thanks to how local and reproducible its effects are, this type of attack has proved to be very powerful on 32-bit MicroController Units (MCU) [1] or other System-on-Chip devices [2] [3] [4] [5]. On top of invasive attacks,

laser sources are and have historically been used as a means of circuit probing to identify and locate defects by measuring current or voltage variations during a laser scan [6] [7]. In the context of hardware security, laser scanning can be used to conduct early exploration of a target to find where an attack might be effective on a chip.

However, even though attacks can be conducted with a laser spot an order of magnitude wider than the digital element to fault, some research has shown that more modern MCUs can produce parasitic latch-up effects that act as an intrinsic protection against LFI [8]. In such cases, exploring the parameter space to obtain relevant fault injections can become extremely time-consuming.

The literature on PEM in the context of hardware security focuses on the identification of macro structures like SRAM buffers and Flash [9] [10]. As a matter of fact, these structures are also very targeted by LFI attacks and emit a lot of photons together with analog circuitry in comparison to other structures of integrated circuits. In this context, the contributions of this paper are the following:

* Raise awareness about how individual core register bits of a 32-bit MCU can be accurately located through PEM on a relatively low-cost LFI bench with the same sample preparation as regular LFI.

* Show how PEM can greatly reduce the cost of a LFI attack or enable more thorough exploration for the same cost, which could make register-based attacks more accessible.

* Show how InGaAs cameras can be leveraged to provide close to real-time PEM.

* Explain what microprocessor execution level and image processing considerations need to be investigated to correctly interpret photon emission images and isolate specific hardware structures.

In Section II, the basics of photon-emissive phenomena in silicon-based ICs are covered. Then, in Section III a justification for the pros of adding PEM to laser-based scans and attacks is presented. Sections IV details our experimental setup. Section V extensively explains how we processed raw photon-emission images to yield useful retro-engineering information. Lastly, our experimental results are presented and discussed in Section VI.

<footnote>This work was supported by the French National Research Agency (ANR) in the framework of the France 2030 program ANR-23-CMAS-0014.</footnote>
<figure><img src="image_2.png" /><figcaption>Fig. 1: Simplified cross-section diagram of a saturated N-MOSFET emitting light</figcaption></figure>

We would like to point out that we use the term *Photon Emission Microscopy* throughout this paper. This term was historically used in the field of failure analysis to refer to an imaging technique that relies on the light emitted by an IC. The term *Photon Emission Analysis* has occasionally been used as well [9] [11]. We do not make a distinction between the two in this paper.

## II. BACKGROUND

### A. Light Emission in Integrated Circuits

Light emitted from ICs has been extensively studied in different fields of research, such as device degradation [12], failure analysis [13] or hardware security [10] [9]. Three distinct radiation phenomena have been distinguished theoretically and experimentally that explain the light emitted by integrated circuits [13]:

* carrier recombination in forward-biased pn junction,

* oxide current because of tunnel effect at dielectric material junctions,

* field-accelerated carriers in depletion regions.

Each of these phenomena occurs at different locations in the substrate, with different intensities and at different wavelengths [13].

In the field of hardware security, the literature focuses on accelerated carrier emission at the canal pinch-off area of saturated NMOS transistors during commutation [14] [9]. As illustrated on Fig. 1, when an N-channel MOSFET is saturated ($V_{drain} > V_{gate} - V_{nmos_threshold}$), the PN junction between its drain and the substrate is more reverse-biased than its source. Thus the drain carrier depletion zone is greater and the induced ion-based electrical field is more intense. As a consequence, when a canal is created by raising the $V_{gate}$ potential at the transistor gate, it is thinner or pinched on the drain's side. The resulting drain-source electron current gets

accelerated the most in the region where the electrical field is the strongest. The *Bremsstrahlung* effect is considered to be the one responsible for the light emitted from this pinched canal area [15] : field-accelerated electrons can be considered as *hot-carriers* and get slowed down by the local Coulombic field once they exit the pinched-off area, thereby releasing energy as photons.

In integrated circuits, however, transistors are only in the saturated regime when they commute from a logical zero to a one and inversely. They form logic gates and latches that are designed to leak as little quiescent current as possible when in a stable electrical state. Thus drain-to-source current is mostly constrained to stable states transitions. This means that most light in a chip should get emitted right after each rising or falling clock edge.

### B. Time-Resolved Photon-Emission Imaging

In the field of failure analysis, time-resolved measurement techniques have been developed to gain insight into the dynamic behavior of defective circuits, such as Picosecond Imaging Circuit Analysis (PICA) [16] [17]. In this case, single-photon detectors are used to create images by scanning an area and integrating many measures for each point. Hardware security researchers have also made use of this technique to conduct side-channel attacks [14]. We do not use this type of measurement in this paper, as our camera does not enable time-resolved measurements.

### C. Spatially-Resolved Photon Emission Microscopy

With less advanced and less costly equipment, two-dimensional images can be obtained with silicon-based Charge-Coupled Device cameras (Si-CCD) or Indium-Gallium Arsenide cameras (InGaAs) [9]. Non-time-resolved images mean that the measurements are the average of a set of operations repeated a great number of times; for instance repeatedly writing a value at a given address in SRAM memory. Such an imaging technique enables circuit retro-engineering but is very limited as a standalone tool for attacks. While CCD cameras can require a very long exposure time to yield a good signal-to-noise ratio (SNR) (conclusion of [10]), we show in this paper that InGaAs cameras can yield good images in less than five minutes.

### D. Laser-Induced Photocurrent Generation

While the physical phenomenon through which ionizing particles, such as photons, get absorbed by a crystal lattice to produce electron-hole pairs is well known, its use and formalization for the purpose of introducing faults in the execution of the program of a silicon chip date back to Skorobogatov in 2002 [18]. While other ways to produce localized photocurrents, such as two-photon absorption [19] or thermoelectric effects, direct illumination with a low enough wavelength remains the most practical means of LFI. In a silicon-based substrate, the band-gap energy at room temperature is about 1.12 eV, which corresponds to a wavelength of 1.1µm.
Prior research has shown that, similarly to PEM, the drain of transistors is the target location of choice to change the state of elementary memory structures like SRAM cells or D-flip-flops [20] [21] [22]. This fault injection technique has seen a rise in popularity in recent years thanks to decreasing costs of laser sources and its extreme locality with regards to space and time; with micrometer-sized laser spots and sub-microsecond light pulses. More specifically, this class of attack enables modifying the logic state of idle memory cells or D-flip-flops. In other words it enables fault injection regardless of clock operation.

In our case, we have used 1,064µm laser photodiodes to artificially change the logical state of register files. The details of the fault injection and infrared imaging bench that we used are presented in Section IV.

### III. COMBINED ATTACK METHODOLOGY

This section explicits how PEM can be integrated into a LFI attack workflow and why. To this effect, the fault model that corresponds to the fault injection experiments presented in Section VI is examined with the same formalism as in [1].

We consider the context of an attacker that wants to conduct an attack on a target with no prior knowledge of its hardware layout. The strongest assumption that we make to be able to conduct PEM in the experimental section of this paper is the ability of the attacker to have access to a clone of the device to attack with full control of the instructions that are executed and their addresses in program memory. Once enough knowledge is gathered from the grey-box clone, the attacker then conducts attacks on the black-box target. In this context, the cost of the attack contains retro-engineering as well as the attack itself.

#### A. Parameter Space of a laser attack

To give an idea of the size of the parameter space to explore to conduct a laser attack, here are some orders of magnitude:

* The silicon die in our experiments are about 10mm².

* The laser spot diameter is about 3µm for x20 magnification and about 1.5µm for x50.

* The laser pulse width is < 100ns.

* Microcontrollers typically work with clock periods between 10ns and 100ns.

* A logic gate or a SRAM memory cell has a width of a few micrometers.

A naive exhaustive spatial exploration of such an area with a 5µm spatial step requires iteration over 2M positions. If each iteration takes 100ms, this amounts to over 55 hours to scan the entire chip. In the experimental section of [23], the authors also give an estimation of the duration of a LFI experiment that targets registers on the System-on-Chip (SoC) of a smartphone: weeks of experiment for a 9mm² CPU block. Locating the smallest area of interest for a given attack is thus paramount to conducting successful attacks. It requires a good understanding of the multiple layers of abstraction of the target system.

<figure><img src="image_3.png" /><figcaption>Fig. 2: Abstraction levels to better explain the effects of the LFI mechanism on an IC; Causality reads from bottom to top.</figcaption></figure>

#### B. LFI Fault Model

If we want to inject faults into a core register, we need to induce photo-currents in the silicon circuit so as to change the state of single D-flip-flops that contain the data. Fig. 2 shows how the effects of a LFI attack translate at different abstraction steps, from bottom to top:

* The laser beam produces a photocurrent pulse at the drain of transistors [20].

* Above one of the standard bistable D-flip-flops that makes a core register, this current might push the structure to a different stability point [24] [22].

* At the execution level, an error in a core register bit might lead to wrong input or output data in a computation or a wrong address in a memory access.

* Lastly at the algorithmic level, given the central role of core registers, a data error can lead to a wide range of errors. To name a few: changes in the flow of execution through wrong branching or stack corruption, infinite loops or abnormal statistic distribution of cryptographic data.

With this understanding of the fault mechanism, pinpointing the exact position of the transistor-based structures that store core register data would greatly reduce the size of the parameter space.

#### C. Limits of Laser-Based Scanning on Modern Technology Nodes

Usually, in order to carry out LFI experiments on a target whose layout is unknown, early laser scans need to be conducted to identify the area sensitive to faults. For instance, in order to fault SRAM memory cells, an initial grey-box laser fault experiment can provide information regarding how addresses are laid out on the chip. However, depending on laser power and shape, this invasive scanning method can produce parasitic side effects that conflict with the purpose of the scan.

LFI can prove difficult on smaller technology nodes, as latch-up effects may appear that usually put the DUT in a permanent fault state [8]; i.e. that requires a power reset. In such cases, LFI alone cannot be relied on to retro-engineer the location of core registers.

Figure 3 is the plotted result of a LFI experiment with a nanosecond 1,064nm laser source above the generic registers area of a microcontroller (target A described in Section IV). In this case, the laser scan could not provide any information
<figure><img src="image_4.png" /><figcaption>Fig. 3: LFI on target A core registers area; red dots indicate crashes caused by laser-induced latch-ups; no bit fault was observed.</figcaption></figure>

regarding the location of the registers. The width of these column patterns increases with laser power. They were also observed in [8] although contrary to us, the authors of this paper were able to produce some single bit sets or resets on the edge of the columns depending on the targeted chip.

The goal of the following sections is to show how PEM can be used to quickly pinpoint registers more quickly than a laser scan and regardless of the issues that can make laser scanning more difficult.

# IV. EXPERIMENTAL SETUP

## A. The Laser Bench

<figure><img src="image_5.png" /><figcaption>Fig. 4: Photograph of the laser fault injection and photon-emission microscopy bench; (a) pico-second laser source; (b) infrared positioning diode; (c) InGaAs SWIR photon emission camera; (d) three motors to move semi-reflective mirrors in/out of the optical path; (e) x5/x20/x50 magnification lens; (f) DUT; (g) motorized XYZ stage; (h) Laser trigger delay generator; (i) nano-second 1,064µm laser source.</figcaption></figure>

<table><caption>TABLE I: Characteristics of laser beams used for LFI experiments</caption><thead><tr><th rowspan="2">Target</th><th rowspan="2">Plot</th><th rowspan="2">Photodiode</th><th colspan="3">Approximated Pulse</th></tr><tr><th>Width<br>(ns)</th><th>Power<br>(mW)</th><th>Energy<br>(nJ)</th></tr></thead><tbody><tr><td>A</td><td>Fig. 3</td><td>nano-s 1,064nm</td><td>6</td><td>124</td><td>0.74</td></tr><tr><td>A</td><td>Fig. 12.2</td><td>pico-s 1,064nm</td><td>25</td><td>/</td><td>0.12</td></tr><tr><td>B</td><td>Fig. 13.2</td><td>nano-s 1,064nm</td><td>80</td><td>455</td><td>36.38</td></tr></tbody></table>

An annotated photograph of the inside of the laser bench used for PEM and LFI in our lab is presented in Fig. 4. It was assembled and delivered by the company Alphanov for the purpose of hardware security testing. The two laser sources used in our experiments are a nanosecond 1,064µm photodiode module (i) and a picosecond 1,064µm photodiode module (a). The laser beams are transmitted from their respective source to the microscope through optical fibers. They can be mechanically added or removed from the optical path thanks to semi-reflective mirrors mounted on linear actuators (d). A set of three magnification objectives enables x5, x20 or x50 magnification. The infrared camera sits directly atop the microscope column (c). A signal delay generator (h) was used simply to trigger single laser pulses from Python scripts.

A more detailed representation of the complete setup is presented on Fig. 5. More specifically, it shows that the camera is linked to a PCIe proprietary video acquisition card that handles frame decoding and hardware configuration. Because of proprietary software, we only managed to script the control of the camera on Windows thanks to a binary release of the open-source software MicroManager that was compiled with the drivers of the camera.

<figure><img src="image_6.png" /><figcaption>Fig. 5: Diagram of the experimental setup; light is represented with colored arrows around the microscope.</figcaption></figure>

## B. Targets

Our experiments were conducted on MCUs that implemented different ARM Cortex-M microprocessor versions from multiple manufacturers, as presented in Table II. As such our experiments would need to be conducted on other architectures to correctly assess the genericity of the results. It should be noted that some additional PEM experiments were performed on a non-commercially available target with a different core
<table><caption>TABLE II: Targets of PEM and LFI</caption><thead><tr><td>Name</td><td>Core</td><td>Frequency</td><td>Node</td></tr></thead><tbody><tr><td>Target A</td><td>Arm Cortex M3</td><td>24MHz</td><td>90nm</td></tr><tr><td>Target B</td><td>Arm Cortex M0+</td><td>48MHz</td><td>90nm</td></tr><tr><td>Target C</td><td>Arm Cortex M4</td><td>180MHz</td><td>90nm</td></tr></tbody></table>

<table><caption>TABLE III: Camera Specifications</caption><thead><tr><td>Specification</td><td>Value/Range</td></tr></thead><tbody><tr><td>Sensor Temperature <sup>1</sup></td><td>-15°C</td></tr><tr><td>Resolution</td><td>640 x 512</td></tr><tr><td>Pixel Pitch</td><td>15 µm x 15 µm</td></tr><tr><td>Gain mode <sup>2</sup></td><td>Low (LG) / High (HG)</td></tr><tr><td rowspan="2">Readout Noise (RMS)</td><td>LG</td><td>175e-</td></tr><tr><td>HG</td><td>22e-</td></tr><tr><td>Dark Current (e-/pixel/s)</td><td>&lt;3000 @ -15°C</td></tr><tr><td>Peak Quantum Eff. (QE)</td><td>&gt;90% @ 1.3 µm</td></tr><tr><td>Spectral Response</td><td>QE&gt;70% in [900; 1675] µm</td></tr><tr><td>Colling</td><td>Fan + Thermoelectric module</td></tr></tbody></table>

architecture that yielded similar results. Unfortunately, the images could not be kept nor disclosed.

### C. PEM Camera

Although we cannot disclose the reference of the camera we used, we can provide some of its specifications that are relevant for PEM. These details are available in Table III.

The camera is made up of an Indium-Gallium Arsenide 640x512 sensor array very similar to the one presented in [25]. It works in what is commonly referred to as the Short-Wave Infrared (SWIR) spectrum, which is slightly more adapted to modern integrated circuits emissions compared to Charge-Coupled Devices (CCD) sensors [26]. This sensor is coupled with a flip-chip Readout Integrated Circuit (ROIC) that enables *Low Gain* or *High Gain* modes of acquisition. The former is specifically made to reduce readout noise (as can be seen on Table III) and increase the dynamic range, which is what we want for PEM.

## V. IMAGING METHODOLOGY

As we will see in this section, because of noise and sensor efficiency, the execution of a single instruction by the microprocessor or a unit computation of peripherals produces far too few photons to be distinguished from noise on images. As such, integration of the photons received over a large number of repetitions of the same operations as well as image post-processing are mandatory to conduct PEM experiments. This means, for example, repeating the same SRAM, Flash or register read or write operations thousands of times for each PEM image.

### A. Optimizing Signal-to-Noise Ratio

A number of techniques were used to improve the quality of images all the while allowing for somewhat real-time exploration. These methods can be divided into two subcategories: experimental setup and image processing.

**Experimental Setup:** While the DUT is running, a number of external instruments or phenomena also produce infrared light in the sensibility range of the camera sensor: obvious light sources, such as the sun, lamps, screens and LEDs inside the laser bench. It is important to identify such sources of noise before running experiments. In our case, the instruments inside the laser bench were turned off or covered up during photon-emission operation. An opaque skirt was also placed around the DUT and the microscope's objective and big lids were added to the transparent parts of the laser bench.

Optical elements inside the microscope placed on the light path between the DUT and the sensor, such as semi-reflective mirrors, have an influence on the amount of light received per frame. Our setup allows mechanically removing them from the optical path.

The sensor is manufactured and set up to operate at -15°C in high-gain mode. To this effect, a Thermoelectric Cooler (TEC) as well as a fan actively regulate the temperature. This produces vibrations that are barely noticeable with x20 magnification but very noticeable with x50 magnification. For long exposure time images, this vibration blurs the image. Depending on the experiment, it can be preferable to have sharper images with more noise by temporarily disabling the fan.

**Image Processing:** Time integration and dark-frame subtraction are the two most critical image processing steps. The former requires repeated operation of the same instructions on the DUT and is the what limits frames per second. Dark-frame subtraction requires taking a reference image with a reference test loop code for every position of the camera over the target or from time to time in case of loss of focus, horizontal drift or temperature drift.

We used a mix of exposure time and software averaging to integrate photons beyond hardware constraints. In practice, a single PEM image would be the result of:

* 5 seconds of exposure while the target device repeats the same operation hundreds of thousands of times.

* The summed average of 10 to 40 of these 5-second frames.

This would add up to around 2 minutes of integration per image. This time is adjusted depending on how many photons the circuit of interest produces. Flash operation produces huge amounts of photons, since it uses high voltages to write and erase data. SRAM produces far less but could yield good results in about 30 seconds of total integration time, while register operation would require about 2 total minutes of integration. Because of temperature changes, loss of focus, lateral drift and vibrations, increasing integration time beyond 2 minutes would not improve images. The goal of long exposure time and averaging is to improve SNR since signal

<footnote n="1">¹ Dead pixel and non-uniformity correction were optimized by the manufacturer for that temperature.</footnote>

<footnote n="2">² The former is used for reflective imaging, the latter is for emissive imaging.</footnote>
<figure><img src="image_7.png" /><figcaption>Fig. 6: Example of dark-image subtraction over target C with x5 magnification: (c) is the result of subtracting (b) from (a).</figcaption></figure>

<figure><img src="image_8.png" /><figcaption>Fig. 7: Contributions to camera measurements: (a) sensor noise; (b) photons from the rest of the target circuit; (c) photons from the element we want to locate; (d) ambient light.</figcaption></figure>

adds up in select spots while noise randomly spreads all over the entire image.

Dark-image subtraction is the most important step in order to understand the photon-emission images presented in this article. It is a differential analysis approach to remove sensor and ambient noise from the end image, but also to isolate specific photonic contributions from all photons received from the target device. Equation 1 and Fig. 7 provide a more formal representation of the various contributions to each pixel value in the image output of the camera:

* (a) $M_{sensor}$ represents intrinsic sensor dark current and readout circuit noise,

* (b) $M_{other_ops}$ is the contribution of general light emitted from the circuit,

* (c) $M_{goal}$ is the contribution of a specific part of the circuit we want to locate,

* (d) $M_{ambient}$ is the light contribution from the camera environment,

* $M_{total}$ in Equation 1 is the resulting two-dimensional grayscale image.

If images are sampled sufficiently close in time, we can make the assumption that $M_{ambient}$ and $M_{sensor}$ are constant between multiple measurements and that the target device temperature is constant as well (Since $M_{goal}$ and $M_{other_ops}$ are temperature-dependent).

$$M_{total} = M_{goal} + M_{other_ops} + M_{sensor} + M_{ambient} \quad (1)$$

For early reversing of the chip to locate peripherals or memories, subtracting a reference image obtained while the device is powered off can be sufficient. If a reference image taken while the device is not powered can be represented like in Equation 2, then subtracting it from $M_{total}$ like in

Equation 3 yields an image that isolates device photonic emissions.

$$M_{DUT\_off} = M_{sensor} + M_{ambient} \quad (2)$$

$$M_{goal} + M_{other_ops} = M_{total} - M_{DUT\_off} \quad (3)$$

However, in order to isolate more subtle emissions, we need to find ways to minimize $M_{other_ops}$ as much as possible. This requires knowledge or guessing of the architecture of the microprocessor, as the execution of a single instruction involves a multitude of digital components. For example, reading from or writing to a register involves a specific multiplexing of the datapath as well as a certain configuration of the arithmetic logic unit. All these components are made out of transistors that emit photons when they commute. The best solution is thus to compare emissions from test loops that are as similar as possible. On Fig. 6, images (a) and (b) are both the average of 20 x5-magnification 5s-exposure images over the exact same area of target C. Image (a) was obtained while the target ran an empty loop after having initialized a hardware-accelerated encryption peripheral. Image (b) was obtained with the same empty loop, yet without initializing the peripheral. Image (c) is a contrast-adjusted subtraction of image (b) to image (a). A group of bright spots can be observed on the top left-hand corner of (c). Interpreting what this might correspond to at the architectural level requires careful analysis of the compiled code: in this case the encryption peripheral was likely only linked to the clock tree when initialized so as to optimize power consumption; thus the bright spot should be its approximate location.

This type of sequence can be automated thanks to scripts, yet in the context of a user that wants to pinpoint a point of interest to start a LFI attack, we have developed a Python graphical interface as is visible on Fig. 8. The user can overlay a clear image and subtract a reference image as well as change the contrast, tweak camera parameters and apply filters. All PEM images presented in this paper were taken through this software. Seeing the processed images in real time as they are rolling-averaged lets an experienced user recognize relevant information as it emerges from the noise or prematurely stop the observation otherwise.
<figure><img src="image_9.png" /><figcaption>Fig. 8: Screen capture of the Python graphical interface developed for real-time PEM.</figcaption></figure>

## B. Isolating Specific Core Register Emissions

In this subsection and the next, the method to isolate the photons emitted by transistors specific to a given MCU core register is described. More specifically, we tackle the design of the test loops to execute on the target during camera measurements.

In order to draw any conclusion from the experiments, it is required to have a good enough understanding of the context of execution of the binary by the target's architecture. This is especially true for images made up from a subtraction of two other images. Takethe pseudo source code in Listing 1. It is simply an example to illustrate multiple important photon emission factors to take into account:

* Instruction BL on line 1 is a Branch And Link instruction that jumps to a function and saves the return address on the stack. While other instructions in this example are 16-bits-encoded, this instruction is encoded on 32 bits. If it were replaced with a 16-bits-encoded instruction, all consecutive instructions would not have the same byte alignment in memory. Depending on the microprocessor architecture, the logic and timing of instruction decoding and execution would differ; thus photon emissions would differ as well.

* Instruction EORS saves in R0 a XOR operation between core registers R0 and R8. Photons are thus emitted by the transistors of the instruction decoding circuit, by read/write access transistors of R0 and R8, by the multiplexing of these values to the Arithmetic Logic Unit (ALU) as well as by the ALU itself as it computes the result of the XOR.

* Instruction B is an unconditional Branch to loop back to the XOR instruction infinitely. This lets us make long exposition time images with the camera to sense as many photons from the execution of the XOR instruction as possible. Yet this looping instruction also involves commuting transistors that emit photons measured by the camera.

```
1 0x0000: BL 0x0100          ; jump to an init func.
2 0x0004: MOVS R0, #0          ; init R0 at 0x0...0
3 0x0006: MOVS R8, #FFFFFFFF ; init R8 at 0xF...F
4 0x0008: EORS R0, R0, R8      ; R0 = R0 XOR R8
5 0x000A: B 0x0008           ; loop to prev. instr.
```

<caption>Listing 1: Pseudo C/ASM example test code.</caption>

Consequently, knowing how source code gets compiled to assembly is mandatory to interpret results. There exists a variety of tools to assist with this task, such as stepping through the code with a debug probe or disassembling the binary.

In our experiments, assembly code instructions were directly injected into the C source code to have more control over the output machine instructions. Some compiler hints can also be added to the source code to increase flexibility compared to assembly code. OpenOCD was used to automate the flashing of binaries and to reset or step through the program during runtime [27].

In order to locate the transistors specific to a given core register, we would take and subtract two images:

* one image where the DUT executes code in Listing 2, meaning all bits of this register get toggled every two clock cycle (one cycle to XOR, another to loop to the same instruction).

* another image where the DUT does the same for a different Rn register.

```
1 MOV S Rn, #0
2 MOV S R8, #FFFFFFFF
3 while (1) {
4   EORS Rn, Rn, R8
5 }
```

<caption>Listing 2: Target A pseudo C/ASM example source code to repeatedly XOR Rn with itself and a mask initialized in R8.</caption>

Using the same formalism as the previous section, equations 4 and 5 represent respectively images sampled while registers Rn and Rm emit photons. The subtraction of the second image with the first would result in an image that corresponds to Equation 6 where bright spots should match with register Rn and dark spots with register Rm. In the experimental results presented in Section VI, we present emission images where:

* for Target A: $R_n = R_3$ and $R_m = R_0$

* for Target B: $R_n = R_5$ and $R_m = R_4$

$$M_{total_{Rn}} = M_{Rn} + M_{other\_ops} + M_{sensor} + M_{ambiant} \quad (4)$$

$$M_{total_{Rm}} = M_{Rm} + M_{other\_ops} + M_{sensor} + M_{ambiant} \quad (5)$$

$$M_{Rn} - M_{Rm} = M_{total_{Rn}} - M_{total_{Rm}} \quad (6)$$

Subtracting the two images yields one where the common noise is removed as well as all common emissions. In this case, since both instructions are a XOR, XOR-specific arithmetic circuitry should cancel out of the final image.
### C. Locate Each Individual Bit of a Specific Core Register

After locating the specific circuitry of a given core register, one might want to identify each bit for subsequent LFI attacks. One practical solution for that, as presented in Listing 3, is to repeatedly apply a XOR operation on the register with another register as a mask with only one bit set. This way, that bit's corresponding D-flip-flops in the target register will get flipped every clock cycle. Moreover, only the instruction that initializes the mask changes between experiments, while the test loop instructions are exactly the same. In this case, the dark image to subtract is one where the mask is 0x0.

```c
1   MOVS R3, #0
2   MOVS R6, #02000000
3   while (1) {
4     EOR R3, R3, R6
5   }
```

<figure><img src="image_10.png" /><figcaption>Fig. 9: Recognizable macrostructures on the reflective backside image of target A; (a) analog circuitry; (b) Flash memory; (c) SRAM memory; (d) Peripherals identified with PEM; (e) core registers identified with PEM.</figcaption></figure>

## VI. EXPERIMENTAL RESULTS

Now that the methodology to create our photon emission images was hopefully made clear, we will present our results on some core registers of target A and B and confront them to laser-induced bit faults on the same registers.

### A. Early Exploration of a Target to Locate an Area of Interest

Before using high magnification lenses to locate individual register bits, early x5 magnification imaging was performed to quickly find the approximate location of the core registers. A first step is to use prior knowledge of recognizable macrostructures from reflective backside images of the target made with the same camera. For example, on Fig. 9 about four fifths of the chip can be identified and set aside for the search for core registers. Shapes (a), (b) and (c) were visually identified. Shape (d) was identified with PEM through the differential analysis of images created while the MCU ran an infinite empty loop after having initialized peripherals (timers, digital-to-analog converter, analog-to-digital converter, etc...) and an image without peripherals initialization.

Then, x5 magnification photon-emission imaging is performed while the target flips the values of multiple registers as fast as possible so as to emit as many photons as possible from the area we want to locate. This can be performed by using the differential method presented in Subsection V-B with the test code in Listing 2 or with logical rotation instructions on registers set with value 0xAAAAAAAA or 0x55555555 instead of a XOR instruction; this way all bits are flipped per instructions executed. The regions of interest identified are highlighted in Fig. 9 as the orange rectangle (e) for target A and in Fig. 10 for target B. For both targets, all generic core registers are located in these areas. Conveniently for further more accurate investigation, they fit within a single x20 magnification frame of our microscope.

Low magnification, in our case x5, means that a wider portion of the backside is in focus at a time. This tends to make the details of the circuit blurrier depending on the thickness

of the substrate. Surface packaging remains, dust or scratches can also obfuscate the view. Such packaging remains can be observed as black patches in Fig. 10. Some ways we have used to improve backside surface quality include:

* Thinning the substrate down to about 150µm or thinner.

* Mechanically polishing the backside of the substrate.

* Cleaning the surface with acetone and dry air.

<figure><img src="image_11.png" /><figcaption>Fig. 10: Area of interest of generic registers identified through initial photon-emission microscopy with x5 magnification on target B.</figcaption></figure>

### B. Locating a Specific Core Register With PEM

Using the image processing method of Subsection V-B, the position of the D-flip-flops associated with a specific core register can be highlighted through the camera. Three examples are presented in Fig. 11, Fig. 12.1 and Fig. 13.1. The observed emissions are aligned with and match the size of the power rails visible on the reflective grayscale background images.

From target A images (Fig. 11 and Fig. 12.1), some patterns of three aligned dots are clearly visible (highlighted with orange rectangles on Fig. 11). Further analysis with the method
<figure><img src="image_12.png" /><figcaption>Fig. 11: Superposition of isolated photon emissions of core registers $R_1$, $R_2$ and $R_3$ on area (e) of target A in Fig. 9.</figcaption></figure>

described in Subsection V-C leads to the interpretation that these patterns correspond to the individual flip-flops of the register. On target B however, that pattern was not observed and flip-flops seemed to only correspond to single dots. This indicates that the patterns strongly depend on the implementation and manufacturer of the target.

The layout of these patterns for a given register differs a lot. This was made visible on Fig. 11 with the superposition of three emission images over a reflective background image of the circuit. Each emission image is given a different color and was made with the technique described by Equation 6 where $R_m$ is $R_0$ and $R_n$ is $R_1$ in red, $R_2$ in green and $R_3$ in yellow.

### C. Locating Core Register Bits With PEM

The method explained in Section V-C was then used to better interpret the patterns that appeared when isolating the photon emissions of a specific core register. This was automated by compiling a binary for each bit of every core register and uploading them one after the other on the target with the *Python* library associated with *OpenOCD*. *Python* scripts were used as well to configure the camera and integrate an image per binary. Dark images regularly had to be integrated to account for loss of focus, horizontal drift or temperature variation.

As a result, most if not all individual bits could be identified for each target chip depending on the surface quality and depth of the substrate. In the case of core register $R_3$ of target A, Fig. 12.1 shows what can be interpreted as the position of each byte from photon-emission microscopy. Every 32 bits were identified, yet they were grouped in bytes in the paper to make figures clearer. This interpretation was then confronted with LFI, which is presented in the next section.

### D. Laser Fault Injection on Identified Core Registers

Fault injection experiments were conducted on the targets with two different laser sources. Initially the 1,064µm nanosecond source was used on both targets, yet it only resulted in latch-ups on target A as was shown on Fig. 3. Therefore, the picosecond laser source was used to produce more Dirac-like flashes of light. In this latter case, the registers

could be easily single-bit faulted. Increasing laser power too much would eventually trigger some latch-ups. The increased precision enabled producing either bit-level faults without latch-up, latch-up that did not prevent the core from running or latch-up that permanently set/reset a bit until a power shutdown was performed.

The results of a fault injection experiment on target A are plotted on Fig. 12.2. The position of faulted bytes matches the interpretation of photon emission presented on Fig. 12.1. On this target, we only managed to inject bit-reset errors. The results of a fault injection experiment on target B are plotted on Fig. 13.2. The position of bytes matches PEM images as well. On target B, a lot more bit-sets than bit-resets were obtained.

The latch-up sensitivity over registers area and the asymmetry between bit-set and bit-reset fault sensitivity is consistent with the results presented on similar targets in [8].

<figure><img src="image_13.png" /><figcaption>12.1: Interpretation of the position of each byte of core register $R_3$ of target A thanks to the method presented in Section V-C; bytes are considered instead of single bits for better clarity in the paper; the grayscale image was colored according to interpretation from other observations.</figcaption></figure>

<figure><img src="image_14.png" /><figcaption>12.2: Pico-second LFI experiment on target A $R_3$ 32-bit core register as identified in VI-C; for the sake of clarity, bits are grouped in their associated byte.</figcaption></figure>

<caption>Fig. 12: Comparison of PEM interpretation of the location of target A core register 3 with LFI results.</caption>

## VII. DISCUSSING LIMITS AND PERSPECTIVES

### Countermeasures to PEM

There are few ways to prevent an attacker from conducting PEM retro-engineering on a device. The target can be made more expensive to prepare for PEM by using a substrate
<figure><img src="image_15.png" /><figcaption>13.1: Cropped x20-magnification superimposed reflective and emission images of target B where register R5 was located thanks to the XOR method of Subsection V-B.</figcaption></figure>

<figure><img src="image_16.png" /><figcaption>13.2: Nano-second LFI experiment on target B R5 32-bit core register as identified in VI-C; for the sake of clarity, bits are grouped in their associated byte.</figcaption></figure>

<caption>Fig. 13: Comparison of PEM interpretation of the location of target B core register 5 with LFI results.</caption>

that is thicker or that scatters light. Non-flip-chip Ball Grid Array packaging (BGA) would likely prevent any backside depackaging without losing the ability to power up the chip.

The strongest assumption made for our experiments is the ability to execute arbitrary code on the same device as the one we would like to attack with LFI. This is usually the case for commercially available MCUs but not so much on Application Specific Integrated Circuits (ASIC) or devices with proprietary compilation toolchains. Since our method relies on subtracting two similar measurements, the position of the test loop in memory as well as its length need to be consistent between tests.

Moreover, for the retro-engineering of memory layout or the position of register bits to be of any use for an attacker, there needs to be a simple coupling between architectural and hardware levels of abstraction. For instance, if values and addresses in SRAM are encrypted after each reset, the physical position of a memory cell on the device becomes irrelevant to conduct architecture-level attacks.

## Time-Resolved Imaging

While the long-exposure results presented in this paper have a good enough SNR to clearly distinguish the position of small elements of integrated circuits, most readers might want to go beyond retro-engineering and obtain time-resolved pictures of the dynamic execution of code on a MCU target to conduct side-channel attacks or get insight of the code being executed. Although our InGaAs camera provides an external trigger mode and enables exposures as small as 450µs, we were not yet able to have sufficient SNR to isolate useful data below 3.5ms. We believe it to be possible, which would open the door to making quick time-resolved 640x512 measurements with a relatively low-cost infrared camera to emulate methods like PICA [17].

## Spectrally-Resolved Imaging

As was pointed out in the Background Section II of the paper, the wavelength of light radiated depends on the emissive phenomenon at play. Thus signal-to-noise ratio could be improved through the use of filters in front of the camera. This might also enable leveraging the other otherwise negligible sources of photons for the purpose of retro-engineering or data extraction.

# VIII. CONCLUSION

Our experimental results have shown that the simple addition of a 30k to 40k USD SWIR InGaAs camera to a typical LFI bench can enable very quick location of register files in a relatively modern 32-bit MCU with sample preparation comparable to regular LFI attacks. This leads to two significant improvements:

* the cost and time to conduct a LFI attack can be greatly reduced, which has been shown to be the main limiting factors of laser-based attacks.

* quickly shrinking spatial parameter space enables more thorough time parameters investigation, which is especially valuable for bit-accurate attack scenarios that rely on tight timing constraints.

More specifically, we have shown the capability to precisely locate all generic core registers of a 32-bit MCU when laser scan techniques can be limited by latch-up effects. On top of that, while photo current do not require illumination exactly on top of transistors to fault them, PEM yields the exact location of photon emissive transistors. We believe that there is still room for improvement regarding image processing and sample preparation to get the most out of our current camera.

# REFERENCES

[1] B. Colombier, A. Menu, J.-M. Dutertre, P.-A. Moëllic, J.-B. Rigaud, and J.-L. Danger, "Laser-induced Single-bit Faults in Flash Memory: Instructions Corruption on a 32-bit Microcontroller," in *2019 IEEE International Symposium on Hardware Oriented Security and Trust (HOST)*, pp. 1–10.

[2] A. Vasselle, H. Thiebeauld, Q. Maouhoub, A. Morisset, and S. Ermeneux, "Laser-Induced Fault Injection on Smartphone Bypassing the Secure Boot-Extended Version," vol. 69, no. 10, pp. 1449–1459.
[3] E. Trichina and R. Korkikyan, "Multi Fault Laser Attacks on Protected CRT-RSA," in *2010 Workshop on Fault Diagnosis and Tolerance in Cryptography*, pp. 75–86.

[4] M. S. Kelly, K. Mayes, and J. F. Walker, "Characterising a CPU fault attack model via run-time data analysis," in *2017 IEEE International Symposium on Hardware Oriented Security and Trust (HOST)*, pp. 79–84.

[5] O. M. Guillen, M. Gruber, and F. De Santis, "Low-Cost Setup for Localized Semi-invasive Optical Fault Injection Attacks," in *Constructive Side-Channel Analysis and Secure Design, S. Guilley, Ed.* Springer International Publishing, pp. 207–222.

[6] E. I. Cole, P. Tangyunyong, D. A. Benson, and D. L. Barton, "TIVA and SEI developments for enhanced front and backside interconnection failure analysis," vol. 39, no. 6, pp. 991–996.

[7] K. Sanchez, R. Deplats, F. Beaudoin, P. Perdu, D. Lewis, P. Vedagarbha, and G. Woods, "Delay variation mapping induced by dynamic laser stimulation," in *2005 IEEE International Reliability Physics Symposium, 2005. Proceedings. 43rd Annual.*, pp. 305–311.

[8] B. Selmke, K. Zinnecker, P. Koppermann, K. Miller, J. Heyszl, and G. Sigl, "Locked out by Latch-up? An Empirical Study on Laser Fault Injection into Arm Cortex-M Processors," in *2018 Workshop on Fault Diagnosis and Tolerance in Cryptography (FDTC)*, pp. 7–14.

[9] R. S. Lima, R. Viera, J.-M. Dutertre, W. Magrini, M. Pommies, and A. Bertrand, "When Data Shines - Leaking Data from Microcontrollers Through Photon Emission Analysis," in *Proceedings of the 2024 Workshop on Attacks and Solutions in Hardware Security*, ser. ASHES '24. Association for Computing Machinery, pp. 58–67.

[10] S. Skorobogatov, "Using Optical Emission Analysis for Estimating Contribution to Power Analysis," in *2009 Workshop on Fault Diagnosis and Tolerance in Cryptography (FDTC)*, pp. 111–119.

[11] S. Chef, S. Jacquir, K. Sanchez, P. Perdu, and S. Binczak, "Unsupervised image processing scheme for transistor photon emission analysis in order to identify defect location," vol. 24, no. 1, p. 013019.

[12] A. Toriumi, M. Yoshimi, M. Iwase, Y. Akiyama, and K. Taniguchi, "A study of photon emission from n-channel MOSFET's," vol. 34, no. 7, pp. 1501–1508.

[13] G. Deboy and J. Kolzer, "Fundamentals of light emission from silicon devices," vol. 9, no. 5, p. 1017.

[14] J. Di-Battista, J.-C. Courrege, B. Rouzeyre, L. Torres, and P. Perdu, "When Failure Analysis Meets Side-Channel Attacks," in *Cryptographic Hardware and Embedded Systems, CHES 2010*, S. Mangard and F.-X. Standaert, Eds. Springer, pp. 188–202.

[15] S. Tam and C. Hu, "Hot-electron-induced photon and photocarrier generation in Silicon MOSFET's," vol. 31, no. 9, pp. 1264–1273.

[16] J. C. Tsang and J. A. Kash, "Picosecond hot electron light emission from submicron complementary metal–oxide–semiconductor circuits," vol. 70, no. 7, pp. 889–891.

[17] J. C. Tsang, J. A. Kash, and D. P. Vallett, "Picosecond imaging circuit analysis," vol. 44, no. 4, pp. 583–603.

[18] S. P. Skorobogatov and R. J. Anderson, "Optical Fault Induction Attacks," in *Cryptographic Hardware and Embedded Systems - CHES 2002*, B. S. Kaliski, c. K. Koc, and C. Paar, Eds. Springer, pp. 2–12.

[19] B. Selmke, M. Pollanka, A. Duensing, E. Strieder, H. Wen, M. Mittermair, R. Kienberger, and G. Sigl, "On the application of Two-Photon Absorption for Laser Fault Injection attacks: Pushing the physical boundaries for Laser-based Fault Injection," pp. 862–885.

[20] C. Roscian, A. Sarafianos, J.-M. Dutertre, and A. Tria, "Fault Model Analysis of Laser-Induced Faults in SRAM Memory Cells," in *2013 Workshop on Fault Diagnosis and Tolerance in Cryptography*, pp. 89–98.

[21] J.-M. Dutertre, V. Beroulle, P. Candelier, S. De Castro, L.-B. Faber, M.-L. Flottes, P. Gendrier, D. Hély, R. Leveugle, P. Maistri, G. Di Natale, A. Papadimitriou, and B. Rouzeyre, "Laser Fault Injection at the CMOS 28 nm Technology Node: An Analysis of the Fault Model," in *2018 Workshop on Fault Diagnosis and Tolerance in Cryptography (FDTC)*, pp. 1–6.

[22] C. Champeix, N. Borrel, J.-M. Dutertre, B. Robisson, M. Lisart, and A. Sarafianos, "SEU sensitivity and modeling using pico-second pulsed laser stimulation of a D Flip-Flop in 40 nm CMOS technology," in *2015 IEEE International Symposium on Defect and Fault Tolerance in VLSI and Nanotechnology Systems (DFTS)*, pp. 177–182.

[23] A. Vasselle, H. Thiebeauld, Q. Maouhoub, A. Morisset, and S. Ermeneux, "Laser-Induced Fault Injection on Smartphone Bypassing the Secure Boot," in *2017 Workshop on Fault Diagnosis and Tolerance in Cryptography (FDTC)*, pp. 41–48.

[24] F. Courbon, P. Loubet-Moundi, J. J. A. Fournier, and A. Tria, "Adjusting Laser Injections for Fully Controlled Faults," in *Constructive Side-Channel Analysis and Secure Design, E. Prouff, Ed.* Springer International Publishing, pp. 229–242.

[25] L. Shkedy, A. Koifman, A. Giladi, A. Tuito, E. Ilan, I. Grimberg, L. Bykov, R. Elishkov, R. Fraenkel, S. Vasserman, and I. Mod, "MULTI-FUNCTION InGaAs DETECTOR FOR SWIR IMAGING."

[26] M. J. Cohen and G. H. Olsen, "Room-temperature InGaAs camera for NIR imaging," in *Infrared Detectors and Instrumentation*, vol. 1946. SPIE, pp. 436–443.

[27] D. Rath, "Open on-chip debugger," URL: http://openocd.org/ [Online, 2008].