You might is they included DFT (design for test, stuff to make sure when you make a chip all of it actually works) - a scan chain thru all the internal flops will provide you with info about the internal flops and how they are connected - reverse engineering this into a model of reality would certainly be extremely hard, but maybe not impossible
While that's theoretically possible, it's even harder than trying to do it over, say, PCIe, because the latter at least still has a higher meaning to it while scan chain FFs are just grouped based on spatial proximity.
And of course that's assuming that a) the JTAG port is accessible on these boards and b) the raw scan chain access before scan chain compression hasn't been fused off or isn't locked behind some authentication protocol.
Comments
You might is they included DFT (design for test, stuff to make sure when you make a chip all of it actually works) - a scan chain thru all the internal flops will provide you with info about the internal flops and how they are connected - reverse engineering this into a model of reality would certainly be extremely hard, but maybe not impossible
While that's theoretically possible, it's even harder than trying to do it over, say, PCIe, because the latter at least still has a higher meaning to it while scan chain FFs are just grouped based on spatial proximity.
And of course that's assuming that a) the JTAG port is accessible on these boards and b) the raw scan chain access before scan chain compression hasn't been fused off or isn't locked behind some authentication protocol.
So, no. That didn't happen either. :-)