Hardware

That Time I Was Reincarnated as an Unemployed CS Student and Jane Street Gave Me An ASIC To Reverse Engineer

Reverse engineering an ASIC with geometry, graph theory, and more graph theory.

19 min read
←Return toAll writing

Rendering article…

The challenge
01
RECOVER CIRCUIT
FROM GDS
02
SOMEHOW FIND
THE RIGHT INPUT
03
EXTRACT THE
FINAL OUTPUT

Rendering article…

Rendering article…

ASIC anatomy
Legends
  • MET5
  • MET4
  • MET3
  • MET2
  • MET1
  • LI1
  • VIA CUTS
ASIC anatomy
Legends
  • MET5
  • MET4
  • MET3
  • MET2
  • MET1
  • LI1
  • VIA CUTS

Rendering article…

Logical Schematic of an AND Gate
INPUT PINSHIGH = 1LOW = 0ABANDYBOTH INPUTS MUST BE HIGHFOR Y TO BE HIGHINPUT PINSHIGH = 1LOW = 0ABANDYBOTH INPUTS MUST BE HIGHFOR Y TO BE HIGH

Rendering article…

R-tree construction
LI1 RECTANGLES0 / 22 INDEXEDLIVE TREEROOT · LEAF0 ENTRIESNEXT · A SOURCE0 / 22 INDEXEDINSERT 01A SOURCEROOT · LEAF0 ENTRIES
R-tree construction
LI1 RECTANGLES0 / 22 INDEXEDLIVE TREEROOT · LEAF0 ENTRIESNEXT · A SOURCE0 / 22 INDEXEDINSERT 01A SOURCEROOT · LEAF0 ENTRIES

Rendering article…

Rendering article…

Decomping A Weird Manhattan PolygonTrace the I-shaped outline
I-SHAPED POLYGONR0R1R2R-TREE · I-SHAPE RECTANGLES ONLYROOT · LEAF3 RECTANGLE ENTRIESR0BOUND = RECTR1BOUND = RECTR2BOUND = RECTR0 · R1 · R2 · ONE ROOT LEAFI-SHAPED POLYGONR0R1R2R-TREE · I-SHAPE RECTANGLES ONLYROOT · LEAF3 RECTANGLE ENTRIESR0BOUND = RECTR1BOUND = RECTR2BOUND = RECT
Decomping A Weird Manhattan PolygonTrace the I-shaped outline
I-SHAPED POLYGONR0R1R2R-TREE · I-SHAPE RECTANGLES ONLYROOT · LEAF3 RECTANGLE ENTRIESR0BOUND = RECTR1BOUND = RECTR2BOUND = RECTR0 · R1 · R2 · ONE ROOT LEAFI-SHAPED POLYGONR0R1R2R-TREE · I-SHAPE RECTANGLES ONLYROOT · LEAF3 RECTANGLE ENTRIESR0BOUND = RECTR1BOUND = RECTR2BOUND = RECT

Rendering article…

Caching mechanismContent-addressed extraction
FINGERPRINT THESE INPUTS
puzzle.gdsextractor.pytechnology + viascache version
SHA-256 CONTENT KEY7f31…a9c2
CACHE LOOKUP
HITload connectivity state
MISSrebuild + save

Rendering article…

Rendering article…

From layout to electrical nets
U0U1U2U3U4U5U6U7AA_SINKBB_SINKY_SOURCEYLEGENDU0–U7placed demo cellsA / Binput pinsYoutput pinA_SINKinternal destinationB_SINKinternal destinationY_SOURCEinternal sourcevia / contact cutCONNECTED RECTANGLES BECOME ELECTRICAL NETSsig_aU0 · AU6 · A_SINKsig_bU1 · BU6 · B_SINKsig_yU3 · Y_SOURCEU7 · YU0U1U2U3U4U5U6U7AA_SINKBB_SINKY_SOURCEYLEGENDU0–U7placed demo cellsA / B / Yinput / output pins*_SINKinternal destinationY_SOURCEinternal sourcevia cutCONNECTED FOOTPRINTS → NETS + PINSsig_aU0 · AU6 · A_SINKsig_bU1 · BU6 · B_SINKsig_yU3 · Y_SOURCEU7 · Y
From layout to electrical nets
U0U1U2U3U4U5U6U7AA_SINKBB_SINKY_SOURCEYLEGENDU0–U7placed demo cellsA / Binput pinsYoutput pinA_SINKinternal destinationB_SINKinternal destinationY_SOURCEinternal sourcevia / contact cutCONNECTED RECTANGLES BECOME ELECTRICAL NETSsig_aU0 · AU6 · A_SINKsig_bU1 · BU6 · B_SINKsig_yU3 · Y_SOURCEU7 · YU0U1U2U3U4U5U6U7AA_SINKBB_SINKY_SOURCEYLEGENDU0–U7placed demo cellsA / B / Yinput / output pins*_SINKinternal destinationY_SOURCEinternal sourcevia cutCONNECTED FOOTPRINTS → NETS + PINSsig_aU0 · AU6 · A_SINKsig_bU1 · BU6 · B_SINKsig_yU3 · Y_SOURCEU7 · Y

Rendering article…

Rendering article…

State dependency
1 · REAL REGISTER DEPENDENCY GRAPHnodes = recovered registers · arrows = next-state influence4 REGISTERS → ONE DEPENDENCY GROUPq34DFXTPq35DFXTPq36DFXTPq37DFXTPS209 regsS01 regS42 regsS198 regsS11 regS21 regS34 regs2 · SCC CONDENSATION DAGeach node groups registers that depend on one anotherSCC CONDENSATION DAGregister groups · next-state influenceS209 regsS01 regS42 regsS34 regsS11 regS198 regsS21 reg
State dependency
1 · REAL REGISTER DEPENDENCY GRAPHnodes = recovered registers · arrows = next-state influence4 REGISTERS → ONE DEPENDENCY GROUPq34DFXTPq35DFXTPq36DFXTPq37DFXTPS209 regsS01 regS42 regsS198 regsS11 regS21 regS34 regs2 · SCC CONDENSATION DAGeach node groups registers that depend on one anotherSCC CONDENSATION DAGregister groups · next-state influenceS209 regsS01 regS42 regsS34 regsS11 regS198 regsS21 reg

Rendering article…

Recovered circuit I/O
TIME →I₀0I₁0I₂0······I₁₂₀0RECOVERED SEQUENTIAL CIRCUITSKY130 LOGICcompute this clockSTATE qₜregister valuesWRITE NEXTREAD NOW1-BIT DECISIONsuccess8-BIT OUTPUT BUSO[7:0]

Rendering article…

SAT intuition
CURRENT ASSIGNMENTA = 0CURRENT ASSIGNMENTB = 0
GATE OUTPUTsuccess = 0
ABsuccess
000
010
100
111
This row produces success = 0, so it cannot satisfy the required target.
SAT intuition
CURRENT ASSIGNMENTA = 0CURRENT ASSIGNMENTB = 0
GATE OUTPUTsuccess = 0
ABsuccess
000
010
100
111
This row produces success = 0, so it cannot satisfy the required target.

Rendering article…

Rendering article…

Bounded reachability
7 EARLIER BITSCYCLE 08?CYCLE 09?CYCLE 10?CYCLE 11?CYCLE 12?CYCLE 13?…108 LATER BITSUNROLL FORWARD · ONE TRANSITION PER CYCLESt + It → RECOVERED CIRCUIT → St+1reset S₀, then add each recovered transitionsuccess = 0TARGET · success₁ ∨ … ∨ success₁₂₂ = 1C08?C09?C10?C11?C12?C13?7 EARLIER BITS · 108 LATER BITSUNROLL FORWARD · ONE TRANSITIONSt + It → CIRCUIT → St+1reset S₀ · add each transitionsuccess = 0TARGET · success₁ ∨ … ∨ success₁₂₂ = 1
Bounded reachability
7 EARLIER BITSCYCLE 08?CYCLE 09?CYCLE 10?CYCLE 11?CYCLE 12?CYCLE 13?…108 LATER BITSUNROLL FORWARD · ONE TRANSITION PER CYCLESt + It → RECOVERED CIRCUIT → St+1reset S₀, then add each recovered transitionsuccess = 0TARGET · success₁ ∨ … ∨ success₁₂₂ = 1C08?C09?C10?C11?C12?C13?7 EARLIER BITS · 108 LATER BITSUNROLL FORWARD · ONE TRANSITIONSt + It → CIRCUIT → St+1reset S₀ · add each transitionsuccess = 0TARGET · success₁ ∨ … ∨ success₁₂₂ = 1

Rendering article…

Cross-implementation replay
00000001010 … 01010000000same exact bits
FORMAL PATHZ3 transition model

predicts success = 1 at cycle T

SUCCESS @ T
STRUCTURAL REPLAYGenerated Verilog

official SKY130 models · Icarus

SUCCESS @ T
cycle TMATCHcycle T

Rendering article…

SOLUTION
0000000101010000100000000000010101010000000000001010000001000001000000100000101000010000000100000010000010010001010000000
SOLUTION
0000000101010000100000000000010101010000000000001010000001000001000000100000101000010000000100000010000010010001010000000

Rendering article…

The grid lines were added as a visual aid to make the separation between layers easier to see.

Rendering article…

© 2026 Leon Do ・ 恋してる