Reverse-Engineering a Jane Street ASIC, One Rabbit Hole at a Time

Jane Street’s reverse-engineering puzzle hands you a GDS file describing a custom chip and asks you to figure out what it does—with a warmup round that includes the actual design, and a real round that gives you nothing but a wish of good luck. The author took the scenic route, poking at the raw files before reading any documentation. Early reconnaissance turned up familiar signals like clock, reset, and power/ground rails, plus a swarm of cells prefixed sky130_fd_sc_hd__. Python’s gdstk library parsed the geometry (27 cells in the warmup), and a companion VCD simulation trace, once decoded with a quick C program, spelled out ‘TRY AGAIN’—confirming the circuit encoded a message.

Much of the month vanished into self-inflicted detours: a homegrown circuit simulator backed by SQLite, a bespoke hardware description language, a test harness, and a half-finished GDS viewer in raylib, all eventually scrapped in favor of existing tools like the Surfer waveform viewer and the GDS viewer Jane Street itself recommended. The real breakthrough came from reading the docs for sky130—the open-source process design kit whose standard-cell library defines what each gate (from a plain ‘and’ to the cryptic ‘o21bai’) actually does. Exporting cells to SVG preserved their pin labels, and an overlap check mapped those labels onto the circuit’s inputs and outputs, even catching connections invisible to the naked eye.

With I/O identified, the task became extracting a netlist from roughly a thousand paths and 17,000 polygons: detecting elements that ‘touch’ across adjacent, overlapping layers and coalescing wire fragments into single logical nets to build a graph of the circuit. The writeup is a candid look at how hardware reverse engineering really goes—equal parts standard-cell knowledge, geometric reasoning, graph algorithms, and stubbornness—with promised follow-ups on each step.