Pure silicon is a mediocre conductor but when its doped (either positive “p” or negative “n”) it becomes much more conductive. One simple application of this is to make a diode by placing n doped silicon next to p doped silicon. These charges cancel out and leave a poorly conducting charge neutral area in the middle. By applying positive voltage to the positive p side and negative voltage to the negative n side, the like charges repel and push the charge neutral area closer. As voltage is increased the neutral area shrinks and allows current to flow freely. Note that iss also possible to get current to flow in the other direction by applying a high voltage (avalanche effect) but this is not used in digital logic.

MOSFETs build on diodes by adding a control terminal to adjust charge between two similarly doped areas. For example, when positive voltage is applied to the gate of a N MOSFET it conducts. Similarly, when a negative voltage is applied to the gate of a P MOSFET it conducts. While real devices have many other critical details, this is generally sufficient detail to reverse engineer digital logic: while a logic designer has to make the system work reliably, a reverse engineer generally assumes the system works reliably.

This (Wiki) image shows schematic symbols for different types of MOSFETs. When analyzing basic CMOS circuits only N MOSFETs (NFETs) and P MOSFETs (PFETs) are relevant. However, NMOS and PMOS also use depletion mode transistors. For most practical purposes, they can be inferred as resistors and the device physics can be ignored.

A note of caution: chip designers know this is how people think when they try to copy chips. They occasionally exploit real device physics even in digital logic to confuse reverse engineers (“traps”). For the meantime assume that circuits work as described above but be mindful that there are exceptions.

With some high level theory, lets now look at how real world MOSFETs are built. Above shows a typical cross section (derivative work). This is basically the theoretical discussion with the addition of a body terminal to isolate transistors from their neighbors.

That transistor is represented by this schematic symbol (source). Recall that a diode is formed when a P and N region meet. And that's why the schematic symbol has a diode triangle: it represents the body diode. For most reverse engineering purposes this can be ignored.

There are many ways to make a real device. To illustrate, here is a gallery of different real transistor constructions.

In general, there are three types of FET technology (in chronological order):

• Early aluminum metal gate
• Polysilicon gate
• Metal gate w/ high-k dielectric

Within each of these, especially polysilicon gates, there are many variations.

Above top: top metal. Bottom: Al and some SiO2 removed

Typical metal gate CMOS transistor as used in non-trivial chips (ie CPU). The control signal

Above textbook style metal gate transistors

Typical poly gate transistor from a typical standard cell based IC. Some of the contact metal can be seen on the bottom but the gate itself is poly.

See quiz for analysis

Wiki has a more Comprehensive list