Split Manufacturing was proposed as a promising strategy to thwart reverse engineering and Trojan insertion at untrusted foundries. However, attack methods based on physical design hints have been proposed to reverse engineer a combinational circuit with Front-End-Of-line (FEOL) layers only. But none of them can guarantee 100% recovery of BEOL signals since no validation can be done during the attack process. In this paper, we introduce an attack flow that can recover 100% BEOL signals for sequential circuits effectively. Our approach shows promising results in attacking sequential circuits without access to flip-flop outputs. We demonstrate the effectiveness of the new attack method on a set of sequential benchmarks from ISCAS-89 and ITC-99 sets which have been widely used in related research. Results show logic equivalence between the original circuit and the recovered circuit for all benchmarks.