你能逆向工程 ASIC 吗?
Can you reverse engineer an ASIC?

原始链接: https://blog.janestreet.com/can-you-reverse-engineer-an-asic/

Jane Street 发布了一项新的技术挑战:一个硬件逆向工程谜题。参与者将获得一个定制专用集成电路(ASIC)的最终 GDS 布局——即其晶体管和布线的几何表示——并必须重建该电路的网表以确定其功能。一旦理解了逻辑,目标就是输入特定信号来触发“成功”输出,并揭示一个隐藏的字符串值。 为了帮助初学者,组织者包含了一个以简单二进制加法器为特色的“热身”练习,并建议使用 KLayout 或 Magic VLSI 等开源工具来分析这些文件。鼓励参与者进行协作,在 2026 年 9 月 4 日之前提交的最引人注目的解题报告将会在后续文章中展示,表现优异者还将获得奖品。 该谜题反映了 Jane Street 硬件团队的实际工作,他们经常需要对复杂的 ASIC 和 FPGA 系统进行故障排除。此外,该公司预告了即将举行的一项竞赛,届时参与者将设计自己的芯片以进行实际制造。所有必要的文件、规则和指南均可在其项目网站上找到。

Hacker News 最近的一场讨论探讨了逆向工程专用集成电路(ASIC)的可行性。 参与者普遍认为,虽然物理上可行,但该过程极其繁琐且技术要求极高。相关方法包括对芯片进行“去层”处理——利用化学或机械工艺、扫描电子显微镜和聚焦离子束对芯片裸片进行拍照,以及使用专业软件从 GDS(版图)文件中提取网表。 此次讨论引发了关于“通过示波器探测引脚即可逆向工程复杂 GPU”这一“都市传说”的辩论。专家指出,现代芯片过于复杂,无法使用此类粗糙的方法;硬件逆向工程通常需要精密的实验室设备或软件级分析(例如检查驱动代码或在可访问的总线上使用逻辑分析仪)。 许多贡献者强调,现代的“标准单元”设计比过去的人工优化芯片更容易理解,但同时也指出,真正的困难在于如何从底层的门电路逻辑中还原出高级功能。归根结底,该讨论将此项任务定性为专家级的难题,通常仅在工业或研究环境中为了验证安全性或发现未公开功能时进行,而非初学者能够轻易完成的任务。
相关文章

原文

Earlier this year we published a puzzle that handed you a complete neural network and asked you to figure out what it did. The response was great, so we’ve made another one! This time, we’re going much deeper down the tech stack.

For this puzzle we’ve designed a chip, but we’re only giving you the layout.

A crash course in how chips get made

Modern chips start life as code. A hardware designer describes a circuit in a hardware description language like Verilog, which gets synthesized into a netlist of logic gates—NANDs, NORs, XORs, flip-flops. Then electronic design automation tools place and route those gates: they pick a physical location for every gate on the die and draw the metal wires that connect them, across many stacked routing layers connected by vias. The end result is a GDS file: a geometric description of every polygon on every layer of the chip, from the transistors that do the actual logic to all the metal on top of them. That’s the file a foundry such as Intel or TSMC uses to fabricate the physical silicon.

The GDS is, in a very real sense, the chip. Everything the circuit does is in there. The tricky part: nothing is labeled!

Diagram of the ASIC design flow: Verilog code is synthesized into a netlist of           logic gates, placed and routed into a GDS layout, then fabricated on a wafer           and packaged into a chip

The puzzle

We’ve designed an ASIC, and we’re giving you its final mask: all of its metal, routing, and active transistor layers, along with some sample inputs and outputs.

Your job is to reverse engineer it. First, recover a netlist from the layout. Then figure out the circuit’s true purpose. And then comes the puzzle within the puzzle: once you understand what the chip does, use it to tease out the output it’s looking for, and find the string value that’s your final answer.

You can find everything you need here.

Some pointers for getting started:

  • The circuit is physically arranged to hint at its functionality, so look closely at the layout!
  • There is one section of the design that is used to generate the output but does not affect the [success] output. You can safely ignore it for the initial reverse-engineering steps.
  • You’ll need to come up with a way to simulate the underlying circuit to test your solution and get the final output!
  • You’ll know you have the correct solution when the [success] output signal goes high. Don’t forget to toggle [rst_n] before each input attempt.
  • We hid a few fun Easter eggs in the circuit and in the repository (including in parts you don’t need to look at to solve the main puzzle), see if you can spot them once you’re done with the puzzle.

Once you figure it out, submit your answer here along with a brief description of how you did it. Submissions close on September 4th, 2026.

Feel free to collaborate with friends on the puzzle, but please refrain from posting spoilers (or a full writeup) online until the submissions are closed. If you do publish your solution (on a personal blog or repository) after submissions are closed, email us and we may include the link in our follow-up post!

Please don’t feed the puzzle files directly into an AI tool, nor use it to generate your writeups. Feel free to use AI for writing any scripts or code you may need as part of solving the puzzle, though! It’s also fair game to use AI to work through the warm-up puzzle, see below.

If you have questions as you go, please reach out to [email protected] — we can’t give hints, but we’re happy to help otherwise.

We’ll feature the most interesting writeups and techniques in a follow-up post, and send swag for our favorite solutions.

A warm-up

If you’ve never opened a GDS file before, don’t worry: most people haven’t either. To help you get started, we’re providing a small worked example: a simple binary adder, with its Verilog source, its gate-level netlist, and the resulting GDS. You can use it to get familiar with how a circuit maps onto a layout, and to test any tools you build before pointing them at the real puzzle.

The warm-up files are available in the puzzle repository.

Everything you need is free and open source: the design uses an open-source PDK, and tools like KLayout or Magic VLSI will happily open the GDS and let you poke around the layers.

And a bigger challenge is coming

Consider this puzzle a warm-up of its own. Later this year we’ll be launching a competition where, instead of reverse engineering our chip, we’ll challenge you to design your own - and the most interesting entries will actually get fabricated, so you can test your chip in real life.

Stay tuned—we’ll announce the details here on the blog in the coming months.

Hardware at Jane Street

The hardware team at Jane Street designs FPGAs and ASICs that run some of the fastest trading systems in the world, and the day-to-day work is full of puzzles just like this one: staring at a sea of gates, timing reports, or waveforms and slowly teasing out what’s really going on. These problems are hard in a way that’s deeply satisfying to solve, and honestly, it’s a big part of why we like working here.

If that sounds intriguing, some ways of learning more:

If you just want to stay in touch, you can fill out this form.

联系我们 contact @ memedata.com