How to “Excel” at ROM Data Extraction

I have isolated what Freescale called the MICROROM, though I don't know why it is called that. We had earlier found a test article that talked about it, but I haven't read it yet.  This ROM is organized as 80 rows by 280 columns. Externally it is 640 x 35, or 22.4K bits.

For a background, this is how a ROM works. Seven address bits are decoded to activate one of the 80 word lines. The programming consists of an optional transistor that will allow a word line to pull down the precharged bit lines. Three more address bits run an analog mux that selects 1 of each group of 8 bit lines. This decoded bit line then passes through a sense amp and is stored in a latch. And there is usually some sort of timing that determines when things happen.

For reverse engineering, the ROM is a very regular structure, and it is easier for me to extract each piece, and then assemble them into the larger ROM. I can look at a word line decode, and then repeat it 80 times.

The program data is another matter, since it is random. I need to come up with a table that says that this address has this data. What I have is 8364 cells placed at various physical locations.

My CAD editor has the ability to convert polygons into a text file. It looks like this:

ADD CELL "LEFT" ID=8364 AT (-4866.0, 4097.5)

ADD CELL "LEFT" ID=8363 AT (-4659.0, 4097.5)

ADD CELL "RIGHT" ID=8362 AT (-4985.0, 4097.5)

ADD CELL "LEFT" ID=8361 AT (-5004.0, 4097.5)

ADD CELL "LEFT" ID=8360 AT (-4958.0, 4097.5)

ADD CELL "RIGHT" ID=8359 AT (-5192.0, 4097.5)

…

I took this file and pasted in into Excel. I recopied the x and y address columns into separate columns, sorted them, and removed duplicates. This left me with 80 X coordinates and 280 Y coordinates. I was relieved to see they matched up with the manual count I did.

I gave each of the X and Y coordinates an address number. Then I went back to the original list of addresses, and used the SUMIF function to look up the matching X and Y addresses and sum (copy, since there was only one match) the address back to the bit. Excel is your friend.

Currently, I don't know which address lines correspond to which location. Once I know that, I'll be able to make a Verilog data file for simulations. I will also convert the programming data into a spice transistor net list, and use that for layout verification.

But that is for later on. Other tasks are calling me this morning.

Date

2011-11-18