Solving the Jane Street reverse engineering challenge

破解 Jane Street 逆向工程挑战

Or: Why do I always do things the hard way? Jane Street periodically puts out challenges, and this one thoroughly nerd-sniped me and sent me down a month-long rabbit hole that I’m only now emerging from. This post is an overview of how I solved it with a combination of hard-headedness and sleep deprivation. It’s going to be decently technical, but in future posts I’ll go over the specifics of each step if people are interested. 或者：为什么我总是喜欢自找苦吃？Jane Street 会定期发布一些挑战，而这次的挑战彻底吸引了我，让我陷入了一个长达一个月的“兔子洞”，直到现在才刚刚走出来。这篇文章概述了我如何凭借一股倔劲和睡眠不足的状态解决了它。内容会相当硬核，但如果大家感兴趣，我会在后续的文章中详细介绍每一步的细节。

For some background I’d recommend looking at the original post on the Jane Street blog here - Can you reverse Engineer an ASIC? And if you ever want to read the (terrible) code I used for this challenge, you can find it at my github page here. 关于背景信息，我建议查看 Jane Street 博客上的原始文章——《你能逆向工程一个 ASIC 吗？》（Can you reverse Engineer an ASIC?）。如果你想阅读我为这次挑战编写的（糟糕的）代码，可以在我的 GitHub 页面找到。

Challenge Accepted. I have an engineering degree rotting away somewhere in my brain, so a lot of the words of the challenge are familiar. The challenge is to take an ASIC and work out what it does. For those unfamiliar, an ‘ASIC’ is an Application-Specific Integrated-Circuit, which is a fancy word for what we’d usually call a ‘Computer Chip’. Firms like Jane Street presumably design these to get extra performance relative to the equipment you can buy from a normal manufacturer. 挑战接受。我的大脑里还残留着工程学位的知识，所以挑战中的很多术语对我来说并不陌生。这次挑战的目标是拿到一个 ASIC 并弄清楚它的功能。对于不熟悉的人来说，“ASIC”是专用集成电路（Application-Specific Integrated-Circuit）的缩写，这只是我们通常所说的“计算机芯片”的高级说法。像 Jane Street 这样的公司设计这些芯片，大概是为了在普通厂商提供的设备基础上获得额外的性能提升。

In any case, the challenge is to take a ‘GDS’ file describing a chip, and work backwards to understand what it does, and then I guess maybe there’s a password in there or something. I didn’t, and still don’t, know what ‘GDS’ stand for. There’s two parts to the challenge - one is a warmup where you’re given a lot more information (like the actual design of the chip), and the real puzzle where you’re given a firm handshake and a ‘good luck’ as you face the increasing prospect of not sleeping for the next three weeks. 总之，挑战的内容是拿到一个描述芯片的“GDS”文件，通过逆向工程理解它的功能，然后我猜里面可能藏着一个密码之类的东西。我当时不知道，现在也不知道“GDS”到底代表什么。挑战分为两部分：一个是热身环节，会提供更多信息（比如芯片的实际设计）；另一个是真正的难题，对方只会跟你握个手说声“祝你好运”，然后你就得面对未来三周可能无法睡觉的现实。

What’s in the files? For some reason, I like to do things the hard way so rather than doing any research I just started poking around in the files. I can see there’s some familiar words in them like ‘clk’ (clock), ‘rst’ (reset) and ‘VGND’ (Ground Voltage) and ‘VPWR’ (Power Voltage). And there’s a bunch of …. something with a prefix of sky130_fd_sc_hd__ followed by things that sound like logic element, like ‘or’ and ‘not’ and things like that. I guess that’s what I’ll need to pull out of the file? 文件里有什么？出于某种原因，我喜欢自找苦吃，所以没有做任何研究，直接开始翻看这些文件。我看到里面有一些熟悉的词，比如“clk”（时钟）、“rst”（复位）、“VGND”（地电压）和“VPWR”（电源电压）。还有一堆……带有 sky130_fd_sc_hd__ 前缀的东西，后面跟着听起来像逻辑元件的词，比如“or”（或）、“not”（非）之类的。我想这就是我需要从文件中提取出来的东西吧？

I found there’s a really nice library ‘gdstk’ in python that seems to be able to read them. It tell me that there’s 27 elements on the warmup puzzle. A good start! 我发现 Python 中有一个非常棒的库叫“gdstk”，似乎可以读取这些文件。它告诉我热身关卡中有 27 个元件。这是一个好的开始！

There’s also a ‘vcd’ file for the main puzzle, which is a text file, and I guess is a simulation input or output or something. I didn’t, and still don’t, know what ‘vcd’ stands for. I can see some suspicious entries in it that look like ASCII characters. I play around with it, writing a small C program, and get the output ‘TRY AGAIN’. Ah, so the circuit has messages in it somehow! 主关卡还有一个“vcd”文件，它是一个文本文件，我猜是某种仿真输入或输出。我当时不知道，现在也不知道“vcd”代表什么。我在里面看到了一些看起来像 ASCII 字符的可疑条目。我摆弄了一下，写了一个小程序，结果输出了“TRY AGAIN”。啊，原来电路里以某种方式隐藏了信息！

Getting Distracted and wasting my time. And my life. Here we need to do a huge digression and of course build our own circuit simulator. For reasons. You can skip this section. I sure wish I did. 分心、浪费时间，还有我的生命。这里我们需要进行一次巨大的跑题，当然还要构建我们自己的电路模拟器。原因嘛……你完全可以跳过这一节。我真希望我当时也跳过了。

Focus, Chris, Focus. The Jane Street blog actually points to quite a handy GDS Viewer, so I spent some time just looking at it real hard and hoping something would come to me. I was able to roughly annotate what I thought were which inputs, and I could later confirm that by looking through the approximate locations of wires in the files. Because this was the warmup I could compare what I knew about the circuit against what I could see. 集中注意力，Chris，集中注意力。Jane Street 的博客实际上指向了一个非常方便的 GDS 查看器，所以我花了一些时间盯着它看，希望能有所启发。我能够大致标注出哪些是输入端，后来通过查看文件中导线的大致位置，我证实了这一点。因为这是热身关卡，我可以把我对电路的了解与我所看到的进行对比。

What do these files represent? These files seem to have some sense of ‘layers’ of different types of material or something, I imagine it’s a bit like a big 3d-printer that has to be told where to move the print head, and at what depth it needs to put a new material. Maybe these files are close to the instructions to the machine? But rather than having arbitrary positions in vertical space they seem to have standard layers of standard widths so that simplifies things. 这些文件代表什么？这些文件似乎包含不同材料“层”的概念，我想这有点像一台大型 3D 打印机，需要告诉它打印头移动到哪里，以及在什么深度放置新材料。也许这些文件接近于机器的指令？但它们似乎不是在垂直空间中随意定位，而是具有标准宽度的标准层，这简化了问题。

I wanted to prove that I could at least operate on these files, so I tried to extract the Jane Street logo on the upper right corner. Somehow this was way harder than I thought and I ended up extracting everything except the Jane Street logo? But whatever good enough, lets move on. I also at some point work out that the library I’m using can extract the elements to SVG file formats, and it includes a bunch of text describing the parts of the elements. This will be key to actually understanding the challenge because I can maybe use that information to work out which parts are inputs and outputs. 我想证明我至少能操作这些文件，所以我尝试提取右上角的 Jane Street 标志。不知为何，这比我想象的要难得多，最后我提取出了除了标志以外的所有东西？但无所谓了，够用了，继续前进。我还发现我使用的库可以将元件提取为 SVG 格式，并且包含了一堆描述元件部分的文本。这将是理解挑战的关键，因为我或许可以利用这些信息来弄清楚哪些部分是输入，哪些是输出。

Time to actually read about these elements. I’ve gotten as far as I can with guessing. Time to actually read some proper documentation. Looks like this is their official home, despite the ‘unofficial’ in the name - sky130-unofficial. The docs had the answers to many of my questions. Why do I always do things the hard way? It turns out that this ‘sky13… 是时候真正去了解这些元件了。靠猜测我已经走到头了，现在该去读读正经的文档了。尽管名字里带有“非官方”（unofficial），但这似乎是它们的官方主页——sky130-unofficial。文档里有我许多问题的答案。为什么我总是喜欢自找苦吃？原来这个“sky13…