Is it possible to reverse engineer and characterize standard cell libraries from semiconductor devices?

[cirosantilli]

I'm guessing yes since Chipworks seems to be able to extract even higher level features.

Also would be cool to characterize the cell directly on the device through experiments if that were possible.

Has any one published such reversed cell? If not, is it because it costs a lot to do, or is it because of legal reasons?

I'm guessing that doing this requires similar instruments to those present in the fabs themselves, since the fabs will want to investigate why some batch went wrong.

https://www.blackhat.com/docs/us-15/materials/us-15-Thomas-Advanced-IC-Reverse-Engineering-Techniques-In-Depth-Analysis-Of-A-Modern-Smart-Card.pdf

The lack of open cell libraries could be the limiting factor towards having good open source EDA tools: https://www.quora.com/Are-there-good-open-source-standard-cell-libraries-to-learn-IC-synthesis-with-EDA-tools

Of course, reverse engineering just the cell library is just a subset of the information required for full place and route, but it would at least allow for pre-PnR PPA estimates? I'm guessing reversing the full design rules is not possible.