[HN Gopher] Can you reverse engineer an ASIC?
___________________________________________________________________
Can you reverse engineer an ASIC?
Author : bschne
Score : 95 points
Date : 2026-08-06 19:07 UTC (17 hours ago)
(HTM) web link (blog.janestreet.com)
(TXT) w3m dump (blog.janestreet.com)
| NooneAtAll3 wrote:
| looks like they didn't post any blog post about 2nd NN challenge
| (https://huggingface.co/spaces/jane-street/droppedaneuralnet)
|
| I was waiting for some writeup about permutation decyphering
| IshKebab wrote:
| That sounds like a fun challenge. Feels a lot more tractable than
| the neural net one.
| whitten wrote:
| Is there something like an Extract-SPICE tool that takes a
| circuit and gives you back a text rendering of it ?
| Joel_Mckay wrote:
| Practically No, the stack-up of metal layers often hides the
| gate structures underneath, and the billions of process cells
| may not all be the same.
|
| Theoretically Yes, as an ion-beam-mill and electron-microscope
| combination machine can slice up semiconductors layer-by-layer.
| Given these machines can often also give precise x-ray analysis
| material data, the exact makeup of the chip can be extracted by
| competitors given enough time. =3
| saltcured wrote:
| Now you're making me imagine some kind of 3D-scanning,
| confocal x-ray fluorescent spectroscope.
|
| Or maybe some kind of hybrid of x-ray microtomography and
| spectroscopic analysis all in one.
|
| But, maybe the energies involved would be about the same
| destructive power as some microtome slicing technique...
| inigyou wrote:
| We already know that X-rays don't destroy chips.
| saltcured wrote:
| I was thinking of the kind of high-energy photon sources
| that sprawl across a large laboratory campus behind rings
| of security fences.
|
| These things can definitely erode the targets. Tomography
| experiments have to think carefully to optimize the set
| exposure angles used during a session, because the target
| degrades more with each shot.
| kayson wrote:
| Yes. There is exactly that, and we call it an "extraction"
| tool. It takes a GDS (text representation of shapes in the
| physical layout), and gives you back a "netlist" (text
| representation of components and connections in a circuit
| schematic).
|
| Circuit designers use these tools basically daily for two
| reasons - the first is Layout Versus Schematic. We want to make
| sure that the physical layout matches the schematic, so the
| tool turns the layout GDS into a netlist and compares that to
| the netlist created from the schematic (basically a diff, but
| more complicated). The second is so we can run simulations that
| take into account the "parasitic" resistances and capacitances
| of the wires and metal shapes in the physical layout. It's
| basically the same procedure as LVS with an extra step that
| analyzes the metal shapes to determine said R's and C's.
| Taniwha wrote:
| yes, but at the transistor level .... it has no idea at that
| level how those transistors are arranged into gates directly
| Taniwha wrote:
| I take it back, it's a sky130 .gds the gates are explicitly
| in there
| Taniwha wrote:
| In fact if you have the sky130 libraries installed (it's
| where I'm working) you can get a spice netlist out of it in
| about 10 seconds - really they should have flattened it
| kayson wrote:
| The tools can definitely recognize static logic gates
| purely from the topology (nothing special in the GDS
| needed). I don't know that I've tested it for anything more
| complicated, but as you've pointed out, if the hierarchy is
| in the GDS it's trivial to recover
| ck2 wrote:
| people who can do this stuff are super-smartypants
|
| but reminds me how we're going to find out on an industrial level
| when the Saudis give China some nvidia chips they were grifted
|
| they've cloned lots of chips before but nothing that advanced
| inigyou wrote:
| China has no shortage of Nvidia chips. It costs nothing
| (relatively) for someone to just buy a 5090 off the shelf and
| send it there.
| inigyou wrote:
| You can do this. If you commit the whole next month to it
| you'll make quite some progress. But you won't.
| Taniwha wrote:
| I'm a chip designer, back in the early 90s I visited a small
| silicon house who were doing some work for us, their boardroom
| table had been taken over by a giant sized photomicrograph of
| IBM's VGA chip and they had a bunch of summer hire grad
| students tracing wiring and matching standard cells (easier
| back then because we only worked in 2 layers of metal).
|
| They weren't trying to steal IBM's design, they already had one
| of their own, what they wanted to know was "is there any as yet
| unannounced functionality in the IBM VGA chip?" they didn't
| want to be caught out when some unknown registers popped up. Of
| course it turned out there was as yet unannounced functionality
| - but not by IBM's design, more because of the orthogonality of
| the design - MODE-X was discovered and became the basis for
| DOOM's speed, anyone who didn't support it lost out
| jsLavaGoat wrote:
| MODE-X launched 1,000 ships too with the demoscene.
| JSR_FDED wrote:
| They did give the chips to China, but they didn't work. Turns
| out they'd first taken them to the basement where someone cut
| them into pieces before sending them to China.
| zie1ony wrote:
| At my uni, 15 years ago, one postdoc reverse engineered NVIDIA
| chip and wrote more performant compiler. He did that by
| connecting oscyloscops to all chip's outputs and started with
| applying random current on inputs. Using ML and his genius he
| rediscoverd all opcodes including a few hidden ones. Eventually
| he got hired by some company that was doing a lot of GPU on
| supercomputers.
| inigyou wrote:
| You can't do that by applying random inputs to any single-chip
| GPU - it has far too much state. I can see that perhaps it
| worked on some of the early multi-chip cards - where one chip
| was a texture sampler, and so on.
|
| You'll have more luck reverse engineering the software driver
| first. They're not hidden, you can just open the driver files
| in Ghidra, the almost-universal tool for open-sourcing
| proprietary code. Hidden opcodes can be discovered first by
| just trying all the opcodes you couldn't discover any other
| way. You only need to go to the physical level if they're
| _really_ hidden.
| sigbottle wrote:
| To be fair, Ghidra was released in 2019 and in general
| knowledge was still hard to find even back in 2010 I feel
| (well, compared to 2026 in the age of AI)
| inigyou wrote:
| Before that there was, and still is, IDA Pro. Works largely
| the same but costs a lot, on the order of $1000/seat/year.
| Useless for hobbyists unless pirated, but reasonable if
| it's your job. Probably had academic discounts.
| rzzzt wrote:
| Also a few free-but-cut-down versions like 5 (which still
| recognizes MS-DOS executables). I'm not going to
| recommend downloading it from any of the locations
| mentioned here but it's out there: https://reverseenginee
| ring.stackexchange.com/questions/19179...
| JSR_FDED wrote:
| Small pedantic nit: Open-sourcing is not the same as reverse-
| engineering.
| inigyou wrote:
| We are taking back control of our computers by force.
| tverbeure wrote:
| There is absolutely no way that happened. 15 years ago, we're
| talking Fermi class GPUs and chips with hundreds of millions of
| bits of on-chip state and much more if you include the DRAM.
|
| You can't tease out the right information by applying random
| inputs. Which input would you even use? The PCIe interface?
| You'd first "randomly" need to get past its complex training
| sequences...
|
| Your postdoc probably wrote micro-benchmarks of some sort. That
| is a common technique.
| kjs3 wrote:
| And you don't use an o-scope in anycase, since you'd
| need...what...a thousand of them to watch all the signals.
| You'd use a logic analyzer. I think I read somewhere that
| those older nvidia chips had something like 2000 BGA balls,
| and Tektronix _does_ make an LA that can scale to
| 2000-something channels (TLA7000), for a modest US$500k or
| so. Then you gotta figure how to mount the thing to attach
| the probes.
|
| So...agreed...far more likely there was a software solution
| of some kind if this happened.
| Taniwha wrote:
| You might is they included DFT (design for test, stuff to
| make sure when you make a chip all of it actually works) - a
| scan chain thru all the internal flops will provide you with
| info about the internal flops and how they are connected -
| reverse engineering this into a model of reality would
| certainly be extremely hard, but maybe not impossible
| tverbeure wrote:
| While that's theoretically possible, it's even harder than
| trying to do it over, say, PCIe, because the latter at
| least still has a higher meaning to it while scan chain FFs
| are just grouped based on spatial proximity.
|
| And of course that's assuming that a) the JTAG port is
| accessible on these boards and b) the raw scan chain access
| before scan chain compression hasn't been fused off or
| isn't locked behind some authentication protocol.
|
| So, no. That didn't happen either. :-)
| pixelatedindex wrote:
| "oscyloscops" is a way better spelling I gotta say.
| i_am_a_peasant wrote:
| sounds like a mythical creature hahaha
| Aurornis wrote:
| > He did that by connecting oscyloscops to all chip's outputs
| and started with applying random current on inputs
|
| This is absolutely not how reverse engineering a digital logic
| ASIC works.
|
| Either the story got embellished through retellings, or this
| person was a fantasist.
|
| There are people who hack on GPUs but it's done at the software
| level.
|
| I did get a kick out of imagining a scene where someone is
| trying to connect an oscilloscope to a circuit board to reverse
| engineer the CPU opcodes. That's like the CSI: Miami version of
| what this would look like.
| MomsAVoxell wrote:
| Many laymen confuse logic analyzers with oscilloscopes. Don't
| take it personally - the person you responded to is clearly
| not a native English speaker.
|
| You absolutely can reverse chips with logic analysis. It is
| big business in some parts of the world.
| i_am_a_peasant wrote:
| with very, very expensive logic analyzers... But yeah,
| nothing weird here. Plus OP was retelling a story of
| someone else doing it, while probably not being a
| specialist in this field. So I wouldn't take the "random
| inputs" part literally.
| RicoElectrico wrote:
| Thank you for taking your time to squash another potential
| "urban legend" in the making. We've got enough of them
| already in tech.
| q3k wrote:
| In a simplified scenario (not too far from this)? Yeah, we've
| done that in CTFs almost a decade ago.
|
| https://blog.dragonsector.pl/2017/10/?m=1
| inigyou wrote:
| From where do I know the name Dragon Sector and q3k? You aren't
| the ones who hacked the train DRM, are you? Or maybe active in
| the demo scene? Or maybe I'm just confusing you with TRSi?
| q3k wrote:
| Maybe. :)
| zoenolan wrote:
| I thought the article was going to be about how people scan chips
|
| Rapid Chip Reverse Engineering Using Laser, Focused ion beams,
| and Scanning electron microscope
| https://academic.oup.com/mam/article/30/Supplement_1/ozae044...
|
| FIBs are also used to test modifications before doing a respin.
| I'm still in awe that matter can be manipulated so precisely
| mentat wrote:
| 30 minutes with /goal for the solution from Sol w/ high.
| kayson wrote:
| Getting a logic-gate-level netlist from a GDS is trivial with
| industry standard chip design tools. Circuit designers do this
| every day. The hardest part will be reverse engineering the
| functionality.
|
| I wish I had more time and I'd throw Calibre at it.
| Taniwha wrote:
| It's even easier in this case because they've included the
| original verilog source ....
| mercurywells wrote:
| No, that's for the warmup. The real puzzle only has a .gds
| file available.
| roadbuster wrote:
| Indeed, this is a problem for an energetic student who has free
| access to every tool in the Cadence, Synopsys, and Mentor
| portfolios: take the GDS-II layout, run it through extraction,
| generate a netlist, convert to higher-level blocks ("netlist-
| to-gate recovery"), translate to RTL HDL, then attempt to work
| out "what it does."
|
| This is just a job posting in disguise for Jane Street: solve
| the puzzle, get a call from one of their recruiters.
| marethyu wrote:
| What prerequisites I need to solve this puzzle? I don't have much
| knowledge in electrical engineering.
| supernetworks_ wrote:
| It's hard without some basic knowledge maybe this can help
| https://siliconzoo.org/tutorial.html
| Dwedit wrote:
| I've looked at Visual 6502 and it's way beyond me. I've even
| looked at the scans where it shows how they severed the
| connection to disable 6502 decimal mode on the NES.
| monocasa wrote:
| To be fair, the 6502 is very dense, and very hand optimized.
|
| Modern systems tend to use "standard cells" for logic which is
| a lot more digestible.
| BobbyTables2 wrote:
| Hasn't Ken Shirriff been doing this for quite a while? (:->
| kens wrote:
| I'm too busy trying to reverse-engineer the Intel 8087
| floating-point chip, although it would be interesting to look
| at this puzzle chip.
| arjie wrote:
| Man, these guys always have insane puzzles. What the heck.
| supernetworks_ wrote:
| I wrote a guide for newbies to learn
|
| https://siliconzoo.org/tutorial.html
| aappleby wrote:
| I reverse engineered the Game Boy from pictures of the die -
| https://github.com/aappleby/metroboy - so yes, it's totally
| doable. It is also incredibly tedious and frustrating.
|
| Not sure if that gives me an advantage in this challenge, but I
| have too many things to do already. :D
___________________________________________________________________
(page generated 2026-08-07 13:01 UTC)