brute forcing the js asic

We are initially given the image here. The image shows we have a clk, rst_n, enable, and 1 input, a success bit, and 8 output bits.

The authors suggest looking at the GDS file directly and derive the netlist. Looking at the GDS from KLayout we can see some parts at the bottom distinctly separate from the rest of the chip. Parsing the symbols as morse code we get the first hint.

"Per arenam ad astra" -> "Through the sand to the stars"

** using the online tiny tapeout gds viewer will prune this detail.

The waveform file is essentially the log of a run, and is viewable on a oss waveform viewer called surfer. With enable high it provides serial bits and when we hit enable low we get an output which spells TRY AGAIN in hexadecimal. After toggling rst_n it repeats.

What is notable is it ran for exactly 121 clock cycles each run. Each clock cycle is 10ns, enable goes high after 40ns, then low at 1250ns. (1250 - 40)/10 = 121 Happens again 1600ns, 2810ns, (2810 - 1600)/10 = 121

We need to input the correct 121 bit input to get the solution string

Because its 2026 I'm going to just brute force the success output. 2^121 is unrealistic but we can use something called a SAT solver, which determines if a boolean expression can be resolved to true.

GDS is a file specifying polygons, KLayout extracts the polygons and builts a circuit using gates in the form of a netlist. The gates are labeled in sky130 specs, so we use the sky130pdk to define these gates, which provides enough context to build a large sequential boolean expression. OSS tools like Yosys can convert a verilog netlist into a CNF which can then be put through a solver like MiniSat. We then use the solver to figure which serial input makes success go high.

When the input is fed through the chip we output.

(* TWO STARS *)

Searching up "two stars puzzle" shows that its a nytimes puzzle called twos not touch. So the 121 input size indicates its a 11x11 board, and the 1s represent the stars.

https://krazydad.com/twonottouch/

A large % of the conversion from GDS to the verilog netlist was heavily assisted with AI.

https://github.com/albatrossethan/asic-reverse-script

This post captures the true complexity of the puzzle without the sat solver.

https://pradyun.net/blog/reverse_engineering.html

KLayout will not be openable on the Tahoe 26.6.2. This version should work.

https://github.com/albatrossethan/klayout/releases/tag/v0.30.12-tahoe

It is unsurprising how old and complex this chip design software ecosystem is. It takes a tremendous amount of time and capital to tapeout, and which point you'd be okay paying Cadence. As the renewed interest for custom silicon grows I anticipate oss tooling will modernize.