// HACKER NEWS — CYBERSECURITY
Reverse Engineering an ASIC
Jane Street recently released a puzzle where the goal is to reverse engineer an ASIC chip, figure out what it does, and submit a solution. I urged my friend Leander to join me and see if we could figure it out. Along the way, it dawned on me that the road to the solution could be illustrated in particularly pretty terms, so here is my attempt at that.
This is intended as a solution, particularly for those who read the challenge and decided they couldn't quite fit it into their schedule. It's supposed to convey the central ideas you would need to arrive at a solution.
First, we have to open a file. Surely this is the easy bit.
Excluding the warmup puzzle -- which you should for sure try -- the puzzle consists of just two files: puzzle.gds and example_inputs.vcd. The puzzle centres on the Graphic Data System, or GDS file. The example inputs are there as a simple test case: one input, and the output the chip should produce for it.
Opening the GDS file in a dedicated program like KLayout, we can immediately see some of its structure. It describes a layout: polygons of different types, indicated by their layer. It also contains annotations, which make the entire file look like a mess when you first open it.
The GDS file format allows you to group polygons into cells. Such cells can be defined once and placed many times. They typically define logic gates, which in turn make up registers, computational units and so forth. Such a hierarchy makes it more manageable to design a chip. Though again, this hierarchy is typically the result of a higher-level description in Verilog, which is ultimately translated into this layout. The cell boundaries give us some of that structure to work with, even though we don't have the original Verilog.
Whilst a GDS defines a layout, on its own it says very little about what that layout actually means. Even the depiction on the right is somewhat suggestive, since we've already given the layers colours and thicknesses. Looking at the file alone, we wouldn't know which of those layers were metal, which were silicon, or how a fab would turn them into a working chip.
To make sense of them, we need to know the manufacturing process the chip was designed for. Each process has its own conventions for what the layer numbers mean. These are documented in a process design kit, or PDK, along with the rules for how the different materials can be used. So before we can read much of the circuit, we need to find out which process we're looking at.
Fortunately, the names of the logic cells give us a fairly direct clue. They start with sky130_fd_sc_hd__, which identifies a standard-cell library for the SkyWater 130 nm process. A standard-cell library is a collection of ready-made components, such as logic gates and flip-flops, that a chip designer can use without having to draw each one from transistors.
The documentation for this process and library is public, so we can look up both what the layers mean and what the cells are supposed to do. Which is quite a bit more convenient than having to work all of that out from the polygons ourselves.