5 ms·
Can you reverse engineer an ASIC?
- NooneAtAll3 2mo agolooks like they didn't post any blog post about 2nd NN challenge (https://huggingface.co/spaces/jane-street/droppedaneuralnet https://huggingface.co/spaces/jane-street/droppedaneuralnet) I was waiting for some writeup about permutation decyphering
- IshKebab 2mo agoThat sounds like a fun challenge. Feels a lot more tractable than the neural net one.
- whitten 2mo agoIs there something like an Extract-SPICE tool that takes a circuit and gives you back a text rendering of it ?
- Joel_Mckay 2mo agoPractically No, the stack-up of metal layers often hides the gate structures underneath, and the billions of process cells may not all be the same. Theoretically Yes, as an ion-beam-mill and electron-microscope combination machine can slice up semiconductors layer-by-layer. Given these machines can often also give precise x-ray analysis material data, the exact makeup of the chip can be extracted by competitors given enough time. =3
- saltcured 2mo agoNow you're making me imagine some kind of 3D-scanning, confocal x-ray fluorescent spectroscope. Or maybe some kind of hybrid of x-ray microtomography and spectroscopic analysis all in one. But, maybe the energies involved would be about the same destructive power as some microtome slicing technique...
- inigyou 2mo agoWe already know that X-rays don't destroy chips.
- bofadeez 2mo ago[flagged]
- Joel_Mckay 2mo agoI’d recommend the Chenming-Hu books on solar cells and semis available as pdfs on his site. https://www.chu.berkeley.edu/modern-semiconductor-devices-for-integrated-circuits-chenming-calvin-hu-2010/ https://www.chu.berkeley.edu/modern-semiconductor-devices-fo... LLMs have already been shown to cause cognitive/skill performance losses in some users. =3 https://www.youtube.com/watch?v=axOcn--n_lM https://www.youtube.com/watch?v=axOcn--n_lM
- inigyou 2mo agoYou're replying to a probably now shadowbanned LLM bot that advertises Fable all day
- bofadeez 2mo agoAre these "shadow bans" in the room with you right now? What a nut. Fable needs no advertising. It was more important than the printing press. Code singularity. But it's old news, Fable is no longer my favorite LLM. I mostly use Kimi k3 now. It's also more competent than you are in general. The primary point you're avoiding is that programming is not a job for professional humans anymore. At least not humans with any dignity or self respect or economic value. I'm sure you at least agree with this point, like every other reasonable person does now too.
- perching_aix 2mo ago> LLMs have already been shown to cause cognitive/skill performance losses in some users. =3 Sorry to interrupt your smugness, but have you actually read that study? It's basically tautological: people remained mostly unfamiliar with code they did not write, and remained mostly unfamiliar with a library they did not use. That's kind of the whole point to begin with! https://homepages.inf.ed.ac.uk/rni/papers/realprg.html https://homepages.inf.ed.ac.uk/rni/papers/realprg.html Unless you want to argue that anyone who cannot code is brain damaged, I'd say it's a bit difficult to suggest that this would amount to any kind of clinically relevant cognitive impairment, much to the contrary of the masses desperately hoping and asserting so. Losing a skill you don't use / want / need is very normal cognitive function.
- duskwuff 2mo ago> Theoretically Yes, as an ion-beam-mill and electron-microscope combination machine can slice up semiconductors layer-by-layer. You may not even need anything as fancy as that - many microchips can be delayered by a skilled operator using mechanical polishing processes.
- kayson 2mo agoYes. There is exactly that, and we call it an "extraction" tool. It takes a GDS (text representation of shapes in the physical layout), and gives you back a "netlist" (text representation of components and connections in a circuit schematic). Circuit designers use these tools basically daily for two reasons - the first is Layout Versus Schematic. We want to make sure that the physical layout matches the schematic, so the tool turns the layout GDS into a netlist and compares that to the netlist created from the schematic (basically a diff, but more complicated). The second is so we can run simulations that take into account the "parasitic" resistances and capacitances of the wires and metal shapes in the physical layout. It's basically the same procedure as LVS with an extra step that analyzes the metal shapes to determine said R's and C's.
- Taniwha 2mo agoyes, but at the transistor level .... it has no idea at that level how those transistors are arranged into gates directly
- Taniwha 2mo agoI take it back, it's a sky130 .gds the gates are explicitly in there
- Taniwha 2mo agoIn fact if you have the sky130 libraries installed (it's where I'm working) you can get a spice netlist out of it in about 10 seconds - really they should have flattened it
- smprather 1mo agoThat would have added a definite layer of complexity, but really just a token/cpu drain on the puzzle solver. Had they done that, I would have had Claude write a "gds matcher" that took the gds files of the sky std-cell lib, and located matches in the full gds, and produced a hierarchical def. It would have taken me 5 minutes to describe it to Claude/GPT (which they ok'd for "tool creation"). So it adds a lot of cost to solve the puzzle, but no real complexity. I'm glad they didn't flatten it.
- ck2 2mo agopeople who can do this stuff are super-smartypants but reminds me how we're going to find out on an industrial level when the Saudis give China some nvidia chips they were grifted they've cloned lots of chips before but nothing that advanced
- inigyou 2mo agoChina has no shortage of Nvidia chips. It costs nothing (relatively) for someone to just buy a 5090 off the shelf and send it there.
- inigyou 2mo agoYou can do this. If you commit the whole next month to it you'll make quite some progress. But you won't.
- bofadeez 2mo ago[flagged]
- Taniwha 2mo agoI'm a chip designer, back in the early 90s I visited a small silicon house who were doing some work for us, their boardroom table had been taken over by a giant sized photomicrograph of IBM's VGA chip and they had a bunch of summer hire grad students tracing wiring and matching standard cells (easier back then because we only worked in 2 layers of metal). They weren't trying to steal IBM's design, they already had one of their own, what they wanted to know was "is there any as yet unannounced functionality in the IBM VGA chip?" they didn't want to be caught out when some unknown registers popped up. Of course it turned out there was as yet unannounced functionality - but not by IBM's design, more because of the orthogonality of the design - MODE-X was discovered and became the basis for DOOM's speed, anyone who didn't support it lost out
- jsLavaGoat 2mo agoMODE-X launched 1,000 ships too with the demoscene.
- zie1ony 2mo agoAt my uni, 15 years ago, one postdoc reverse engineered NVIDIA chip and wrote more performant compiler. He did that by connecting oscyloscops to all chip's outputs and started with applying random current on inputs. Using ML and his genius he rediscoverd all opcodes including a few hidden ones. Eventually he got hired by some company that was doing a lot of GPU on supercomputers.
- inigyou 2mo agoYou can't do that by applying random inputs to any single-chip GPU - it has far too much state. I can see that perhaps it worked on some of the early multi-chip cards - where one chip was a texture sampler, and so on. You'll have more luck reverse engineering the software driver first. They're not hidden, you can just open the driver files in Ghidra, the almost-universal tool for open-sourcing proprietary code. Hidden opcodes can be discovered first by just trying all the opcodes you couldn't discover any other way. You only need to go to the physical level if they're really hidden.
- sigbottle 2mo agoTo be fair, Ghidra was released in 2019 and in general knowledge was still hard to find even back in 2010 I feel (well, compared to 2026 in the age of AI)
- inigyou 2mo agoBefore that there was, and still is, IDA Pro. Works largely the same but costs a lot, on the order of $1000/seat/year. Useless for hobbyists unless pirated, but reasonable if it's your job. Probably had academic discounts.
- rzzzt 2mo agoAlso a few free-but-cut-down versions like 5 (which still recognizes MS-DOS executables). I'm not going to recommend downloading it from any of the locations mentioned here but it's out there: https://reverseengineering.stackexchange.com/questions/19179/older-versions-of-ida-free https://reverseengineering.stackexchange.com/questions/19179...
- q3k 2mo agoIn a simplified scenario (not too far from this)? Yeah, we've done that in CTFs almost a decade ago. https://blog.dragonsector.pl/2017/10/?m=1 https://blog.dragonsector.pl/2017/10/?m=1
- inigyou 2mo ago[flagged]
- deleted 2mo ago[deleted]
- zoenolan 2mo agoI thought the article was going to be about how people scan chips Rapid Chip Reverse Engineering Using Laser, Focused ion beams, and Scanning electron microscope https://academic.oup.com/mam/article/30/Supplement_1/ozae044.314/7720268 https://academic.oup.com/mam/article/30/Supplement_1/ozae044... FIBs are also used to test modifications before doing a respin. I'm still in awe that matter can be manipulated so precisely
- QuiEgo 2mo agoFIB is awesome but there’s nothing easy about it, and the success rates are not super great.
- mentat 2mo ago30 minutes with /goal for the solution from Sol w/ high.
- kayson 2mo agoGetting a logic-gate-level netlist from a GDS is trivial with industry standard chip design tools. Circuit designers do this every day. The hardest part will be reverse engineering the functionality. I wish I had more time and I'd throw Calibre at it.
- Taniwha 2mo agoIt's even easier in this case because they've included the original verilog source ....
- mercurywells 2mo agoNo, that's for the warmup. The real puzzle only has a .gds file available.
- roadbuster 2mo agoIndeed, this is a problem for an energetic student who has free access to every tool in the Cadence, Synopsys, and Mentor portfolios: take the GDS-II layout, run it through extraction, generate a netlist, convert to higher-level blocks ("netlist-to-gate recovery"), translate to RTL HDL, then attempt to work out "what it does." This is just a job posting in disguise for Jane Street: solve the puzzle, get a call from one of their recruiters.
- smprather 1mo agoNo need for Calibre. Me + KLayout + Claude had a verilog sim of the example vcd input and gate-level netlist 30 minutes after I cloned the repo.
- marethyu 2mo agoWhat prerequisites I need to solve this puzzle? I don't have much knowledge in electrical engineering.
- supernetworks_ 2mo agoIt’s hard without some basic knowledge maybe this can help https://siliconzoo.org/tutorial.html https://siliconzoo.org/tutorial.html
- smprather 1mo agoI encourage you to try, but honestly, with almore 30 years experience making chips, I would still classify this puzzle as "pretty damn hard".
- Dwedit 2mo agoI've looked at Visual 6502 and it's way beyond me. I've even looked at the scans where it shows how they severed the connection to disable 6502 decimal mode on the NES.
- monocasa 2mo agoTo be fair, the 6502 is very dense, and very hand optimized. Modern systems tend to use "standard cells" for logic which is a lot more digestible.
- duskwuff 2mo agoThe original NMOS 6502 also used a lot of rather weird dynamic logic which can't easily be represented as standard digital logic elements. Some details here: http://www.aholme.co.uk/6502/Main.htm http://www.aholme.co.uk/6502/Main.htm
- BobbyTables2 2mo agoHasn’t Ken Shirriff been doing this for quite a while? (:->
- kens 2mo agoI'm too busy trying to reverse-engineer the Intel 8087 floating-point chip, although it would be interesting to look at this puzzle chip.
- arjie 2mo agoMan, these guys always have insane puzzles. What the heck.
- supernetworks_ 2mo agoI wrote a guide for newbies to learn https://siliconzoo.org/tutorial.html https://siliconzoo.org/tutorial.html
- aappleby 2mo agoI reverse engineered the Game Boy from pictures of the die - https://github.com/aappleby/metroboy https://github.com/aappleby/metroboy - so yes, it's totally doable. It is also incredibly tedious and frustrating. Not sure if that gives me an advantage in this challenge, but I have too many things to do already. :D
- markedathome 2mo agoEarlier this year I watched a video from a conference where a researcher took a die shot (one of Ken's I think) and then did guided learning by identifying on the image which were the different layers, metals, and layout of the gates on the die. The machine learning algorithm could go off and identify other gates and provide a netlist(?). I've tried searching REverse, and some of the hacker conferences from January, but haven't found it yet.
- markedathome 2mo agoand of course I find it... giulioz: MMO-CHIP: From Microscope to Verilog in an hour[1] source code is on github[2] [1] https://www.youtube.com/watch?v=5211iYEqnzo https://www.youtube.com/watch?v=5211iYEqnzo [2] https://github.com/giulioz/mmo-chip https://github.com/giulioz/mmo-chip
- Marciplan 2mo agoseeing this was done 5yrs ago. Is this easily recreatable by an AI model nowadays? If so, what does it make you feel?
- RetroTechie 2mo ago(A crash course in how chips get made) That paragraph + illustration is one of the simplest, concise, easy-to-grasp descriptions of IC design process I've come across. Nice! Now the reverse: what I'd really love is a free (libre) automated toolset to go from IC die shot(s) -> transistors+interconnects -> gate-level schematic (logic gates & flipflops). Person interested in RE a chip's function can take it from there. To me, the whole "here's a section of the die photo" to "that's an n-bit adder" etc step is like black magic. Not to mention extremely tedious. Get that to a higher-level view easy, and it would be much more doable to work out function of each element.
- smprather 1mo agoSolved it. Took me ~6 human hours, over a total of 24 hours. But it was NOT easy! I've been making chips for amost 30 years, and I run the https://github.com/smprather/engineering-loadout https://github.com/smprather/engineering-loadout project, so I had all the tools sitting at my fingertips (KLayout, Surfer, Icarus Verilog, etc).
- krumcqz 1mo agoPretty same tool used to me.