Join the discussion
Write your take first — we'll ask for email only when you're ready to publish.
- Hacker News
- Is there something like an Extract-SPICE tool that takes a circuit and gives you back a text rendering of it ?by whitten
- Practically No, the stack-up of metal layers often hides the gate structures underneath, and the billions of process cells may not all be the same.
Theoretically Yes, as an ion-beam-mill and electron-microscope combination machine can slice up semiconductors layer-by-layer. Given these machines can often also give precise x-ray analysis material data, the exact makeup of the chip can be extracted by competitors given enough time. =3
by Joel_Mckay - Yes. There is exactly that, and we call it an "extraction" tool. It takes a GDS (text representation of shapes in the physical layout), and gives you back a "netlist" (text representation of components and connections in a circuit schematic).
Circuit designers use these tools basically daily for two reasons - the first is Layout Versus Schematic. We want to make sure that the physical layout matches the schematic, so the tool turns the layout GDS into a netlist and compares that to the netlist created from the schematic (basically a diff, but more complicated). The second is so we can run simulations that take into account the "parasitic" resistances and capacitances of the wires and metal shapes in the physical layout. It's basically the same procedure as LVS with an extra step that analyzes the metal shapes to determine said R's and C's.
by kayson - looks like they didn't post any blog post about 2nd NN challenge (https://huggingface.co/spaces/jane-street/droppedaneuralnet)
I was waiting for some writeup about permutation decyphering
by NooneAtAll3 - I wrote a guide for newbies to learn
- Hasn’t Ken Shirriff been doing this for quite a while? (:->by BobbyTables2
- I'm too busy trying to reverse-engineer the Intel 8087 floating-point chip, although it would be interesting to look at this puzzle chip.by kens
- In a simplified scenario (not too far from this)? Yeah, we've done that in CTFs almost a decade ago.by q3k
- From where do I know the name Dragon Sector and q3k? You aren't the ones who hacked the train DRM, are you? Or maybe active in the demo scene? Or maybe I'm just confusing you with TRSi?by inigyou
- Getting a logic-gate-level netlist from a GDS is trivial with industry standard chip design tools. Circuit designers do this every day. The hardest part will be reverse engineering the functionality.
I wish I had more time and I'd throw Calibre at it.
by kayson - It's even easier in this case because they've included the original verilog source ....by Taniwha
- No need for Calibre. Me + KLayout + Claude had a verilog sim of the example vcd input and gate-level netlist 30 minutes after I cloned the repo.by smprather
- Indeed, this is a problem for an energetic student who has free access to every tool in the Cadence, Synopsys, and Mentor portfolios: take the GDS-II layout, run it through extraction, generate a netlist, convert to higher-level blocks ("netlist-to-gate recovery"), translate to RTL HDL, then attempt to work out "what it does."
This is just a job posting in disguise for Jane Street: solve the puzzle, get a call from one of their recruiters.
by roadbuster - (A crash course in how chips get made)
That paragraph + illustration is one of the simplest, concise, easy-to-grasp descriptions of IC design process I've come across. Nice!
Now the reverse: what I'd really love is a free (libre) automated toolset to go from IC die shot(s) -> transistors+interconnects -> gate-level schematic (logic gates & flipflops). Person interested in RE a chip's function can take it from there.
To me, the whole "here's a section of the die photo" to "that's an n-bit adder" etc step is like black magic. Not to mention extremely tedious.
Get that to a higher-level view easy, and it would be much more doable to work out function of each element.
by RetroTechie - Solved it. Took me ~6 human hours, over a total of 24 hours. But it was NOT easy!
I've been making chips for amost 30 years, and I run the https://github.com/smprather/engineering-loadout project, so I had all the tools sitting at my fingertips (KLayout, Surfer, Icarus Verilog, etc).
by smprather - Pretty same tool used to me.by krumcqz
- I've looked at Visual 6502 and it's way beyond me. I've even looked at the scans where it shows how they severed the connection to disable 6502 decimal mode on the NES.by Dwedit
- To be fair, the 6502 is very dense, and very hand optimized.
Modern systems tend to use "standard cells" for logic which is a lot more digestible.
by monocasa - At my uni, 15 years ago, one postdoc reverse engineered NVIDIA chip and wrote more performant compiler. He did that by connecting oscyloscops to all chip's outputs and started with applying random current on inputs. Using ML and his genius he rediscoverd all opcodes including a few hidden ones. Eventually he got hired by some company that was doing a lot of GPU on supercomputers.by zie1ony
- Detailed write-up please, or it didn't happen. At least not as described.
Really simple ICs with a few counters etc in there might be possible to RE this way. Complex ICs with lots of internal state, memory blocks etc like a modern-ish GPU? Not a chance.
Some hybrid approach? Software fiddling with the chip's internals, with say. a big FPGA attached to physically probe outputs? Architecture docs, and maybe some IC die shots at hand? Perhaps (hence my ask for "detailed").
Sounds like requiring the kind of hardware setup that would not be available to uni students.
by RetroTechie - “oscyloscops” is a way better spelling I gotta say.
- There is absolutely no way that happened. 15 years ago, we're talking Fermi class GPUs and chips with hundreds of millions of bits of on-chip state and much more if you include the DRAM.
You can't tease out the right information by applying random inputs. Which input would you even use? The PCIe interface? You'd first "randomly" need to get past its complex training sequences...
Your postdoc probably wrote micro-benchmarks of some sort. That is a common technique.
by tverbeure - You can't do that by applying random inputs to any single-chip GPU - it has far too much state. I can see that perhaps it worked on some of the early multi-chip cards - where one chip was a texture sampler, and so on.
You'll have more luck reverse engineering the software driver first. They're not hidden, you can just open the driver files in Ghidra, the almost-universal tool for open-sourcing proprietary code. Hidden opcodes can be discovered first by just trying all the opcodes you couldn't discover any other way. You only need to go to the physical level if they're really hidden.
by inigyou - > He did that by connecting oscyloscops to all chip's outputs and started with applying random current on inputs
This is absolutely not how reverse engineering a digital logic ASIC works.
Either the story got embellished through retellings, or this person was a fantasist.
There are people who hack on GPUs but it’s done at the software level.
I did get a kick out of imagining a scene where someone is trying to connect an oscilloscope to a circuit board to reverse engineer the CPU opcodes. That’s like the CSI: Miami version of what this would look like.
by Aurornis - I thought the article was going to be about how people scan chips
Rapid Chip Reverse Engineering Using Laser, Focused ion beams, and Scanning electron microscope https://academic.oup.com/mam/article/30/Supplement_1/ozae044...
FIBs are also used to test modifications before doing a respin. I'm still in awe that matter can be manipulated so precisely
by zoenolan - FIB is awesome but there’s nothing easy about it, and the success rates are not super great.by QuiEgo
- I reverse engineered the Game Boy from pictures of the die - https://github.com/aappleby/metroboy - so yes, it's totally doable. It is also incredibly tedious and frustrating.
Not sure if that gives me an advantage in this challenge, but I have too many things to do already. :D
by aappleby - seeing this was done 5yrs ago. Is this easily recreatable by an AI model nowadays? If so, what does it make you feel?by Marciplan
- Earlier this year I watched a video from a conference where a researcher took a die shot (one of Ken's I think) and then did guided learning by identifying on the image which were the different layers, metals, and layout of the gates on the die. The machine learning algorithm could go off and identify other gates and provide a netlist(?).
I've tried searching REverse, and some of the hacker conferences from January, but haven't found it yet.
by markedathome