Rendered at 22:26:58 GMT+0000 (Coordinated Universal Time) with Cloudflare Workers.
aappleby 10 hours ago [-]
I reverse engineered the Game Boy from pictures of the die - https://github.com/aappleby/metroboy - so yes, it's totally doable. It is also incredibly tedious and frustrating.
Not sure if that gives me an advantage in this challenge, but I have too many things to do already. :D
markedathome 2 hours ago [-]
Earlier this year I watched a video from a conference where a researcher took a die shot (one of Ken's I think) and then did guided learning by identifying on the image which were the different layers, metals, and layout of the gates on the die. The machine learning algorithm could go off and identify other gates and provide a netlist(?).
I've tried searching REverse, and some of the hacker conferences from January, but haven't found it yet.
markedathome 2 hours ago [-]
and of course I find it...
giulioz: MMO-CHIP: From Microscope to Verilog in an hour[1]
FIBs are also used to test modifications before doing a respin. I'm still in awe that matter can be manipulated so precisely
zie1ony 1 days ago [-]
At my uni, 15 years ago, one postdoc reverse engineered NVIDIA chip and wrote more performant compiler. He did that by connecting oscyloscops to all chip's outputs and started with applying random current on inputs. Using ML and his genius he rediscoverd all opcodes including a few hidden ones. Eventually he got hired by some company that was doing a lot of GPU on supercomputers.
Aurornis 23 hours ago [-]
> He did that by connecting oscyloscops to all chip's outputs and started with applying random current on inputs
This is absolutely not how reverse engineering a digital logic ASIC works.
Either the story got embellished through retellings, or this person was a fantasist.
There are people who hack on GPUs but it’s done at the software level.
I did get a kick out of imagining a scene where someone is trying to connect an oscilloscope to a circuit board to reverse engineer the CPU opcodes. That’s like the CSI: Miami version of what this would look like.
MomsAVoxell 15 hours ago [-]
Many laymen confuse logic analyzers with oscilloscopes. Don't take it personally - the person you responded to is clearly not a native English speaker.
You absolutely can reverse chips with logic analysis. It is big business in some parts of the world.
Aurornis 6 hours ago [-]
> You absolutely can reverse chips with logic analysis.
You are not going to reverse engineer a GPU with a logic analyzer and by applying currents to pins.
You could replace oscilloscope with logic analyzer in the comment above and nothing changes. It’s a fantasy story. The GPU I/O is high speed PCIe and memory buses.
If you want to explore the chip you connect it to a PCIe host and use the host. Connecting logic analyzers and applying current to pins does not make sense on any level.
Also, if you think probing high speed signals like PCIe or memory buses with logic analyzers is easy, you’ve probably never tried it. The equipment needed to do that properly is incredibly expensive because even probing those buses slightly incorrectly or with cheap probes will make them fail to work at the speeds they use.
MomsAVoxell 3 hours ago [-]
I use this type of equipment every day. I'm aware of the expense - nobody said it was cheap to do this kind of work.
You might be thinking that the hobby-level logic analyzers you're used to, are what folks who are serious about doing this kind of work would be using. Just, no.
>Connecting logic analyzers and applying current to pins does not make sense on any level.
Tell me you've never fuzzed a chip without telling me you never fuzzed a chip.
Nobody said it would be easy or cheap, or that fuzzing is the only way to do it. The OP may not have had all the details correct.
But, you certainly can reverse engineer high-density digital electronics this way.
Aurornis 2 hours ago [-]
> You might be thinking that the hobby-level logic analyzers you're used to, are what folks who are serious about doing this kind of work would be using. Just, no.
No I'm not. I'm referring to the logic analyzers and probes, and fixturing that would be necessary to probe something like this.
It's not as simple as saying "wouldn't be cheap". I'm saying it's virtually impossible for a university student to do for fun with the resources available to them.
> Tell me you've never fuzzed a chip without telling me you never fuzzed a chip.
Please don't be snarky. Also please don't take my quotes out of context to try to attack a strawman.
I'm talking about the comment thread we're responding to about someone reverse engineering the opcodes by applying current to the pins.
Nobody is going to be fixturing up an nVidia GPU chip, acquiring enough probes and logic analyzer inputs to measure it, then applying currents to pins, just to reverse engineer the opcodes. You're off trying to argue something else to show off your knowledge on the internet, but you've missed the point of the thread.
If someone wants to reverse engineer a GPU, the first thing you do is plug it into a system and access it through software. Nobody is going to connect logic analyzers to a million pins and re-invent PCIe signaling just because it's technically possible to do.
MomsAVoxell 11 minutes ago [-]
Your extreme claims that "nobody is going to do that", while I have actually seen people doing exactly that in modern universities and other reverse engineering institutions, just renders your stubborn know-best boring.
Yes, people do this. Yes, it is a lot of tedious work. PCIe signaling is not a panacea - there are reasons to fuzz like this.
I've also seen folks break out a tunneling electron microscope to dig deeper on de-laminated cores.
>I'm saying it's virtually impossible for a university student to do for fun with the resources available to them.
Now who's inventing straw man claims? "For fun"? Yes, for fun. "For profit"? Yes, for profit too. At universities? Yes, at universities.
Just give it up. The world is big.
i_am_a_peasant 11 hours ago [-]
with very, very expensive logic analyzers... But yeah, nothing weird here. Plus OP was retelling a story of someone else doing it, while probably not being a specialist in this field. So I wouldn't take the "random inputs" part literally.
Aurornis 6 hours ago [-]
> with very, very expensive logic analyzers... But yeah, nothing weird here.
You can’t simply get an expensive logic analyzer and probe PCIe or memory buses at these speeds. There are expensive custom fixtures that need to be made to even begin to be able to probe at these speeds without disturbing the circuit so much that it fails to work. This isn’t like probing the I2C bus on a raspberry pi. It would be like connecting to the pins under the chip. It’s fantasy.
It’s also illogical. If you have a PCIe device, you plug it in to a PCIe host and use the host to interact with it. You don’t start probing pins and trying to apply signals to it.
MomsAVoxell 3 hours ago [-]
Your pessimism belies a distinct lack of experience, if not also a dearth of imagination.
Harnesses for such things are not cheap, nor are they something you can just order from Reichelt. But, I assure you, there are reverse engineering labs in the world that can do this. There are technicians who think nothing whatsoever of de-soldering a BGA and using microscopes to rig things up. They do it before lunch, even.
The OP may have some details wrong - they're clearly laymen describing an anecdote - but that doesn't mean for an instance that this "isn't possible".
There is always a higher-speed logic analyzer, capable of operating faster than the consumer device under test. That's how the consumer DUT's get tested at the ATE, in the first place ..
Aurornis 2 hours ago [-]
> Your pessimism belies a distinct lack of experience, if not also a dearth of imagination.
You keep missing the point and trying to insult my experience in the process.
We're talking about a university student and CPU opcodes. The whole side story about probing the chip is completely irrelevant. This is a software task.
> But, I assure you, there are reverse engineering labs in the world that can do this.
We're talking about a university student.
> There are technicians who think nothing whatsoever of de-soldering a BGA and using microscopes to rig things up. They do it before lunch, even.
I'm talking about the fixturing required to actually probe those pins. Replacing the BGA is the easy part. You can't probe a large BGA by having a tech remove and replace it. The contrast between you trying to insult my experience while not understanding the task at hand is truly something.
You've chosen a weird hill to die on, given how much you're arguing things that have no relevance to the story.
MomsAVoxell 8 minutes ago [-]
Maybe your university students aren't as well-funded as my university students, ever thought of that, huh? Maybe your universities are lagging behind the state of the art in the rest of the civilized world. Maybe, you just don't know enough about this subject, actually.
>I'm talking about the fixturing required to actually probe those pins.
This just isn't as impossible as you claim. And, there are plenty of reasons to do it.
Just because you can't imagine it, doesn't mean someone else hasn't already actually done it.
RicoElectrico 14 hours ago [-]
Thank you for taking your time to squash another potential "urban legend" in the making. We've got enough of them already in tech.
RetroTechie 48 minutes ago [-]
Detailed write-up please, or it didn't happen. At least not as described.
Really simple ICs with a few counters etc in there might be possible to RE this way. Complex ICs with lots of internal state, memory blocks etc like a modern-ish GPU? Not a chance.
Some hybrid approach? Software fiddling with the chip's internals, with say. a big FPGA attached to physically probe outputs? Architecture docs, and maybe some IC die shots at hand? Perhaps (hence my ask for "detailed").
Sounds like requiring the kind of hardware setup that would not be available to uni students.
inigyou 1 days ago [-]
You can't do that by applying random inputs to any single-chip GPU - it has far too much state. I can see that perhaps it worked on some of the early multi-chip cards - where one chip was a texture sampler, and so on.
You'll have more luck reverse engineering the software driver first. They're not hidden, you can just open the driver files in Ghidra, the almost-universal tool for open-sourcing proprietary code. Hidden opcodes can be discovered first by just trying all the opcodes you couldn't discover any other way. You only need to go to the physical level if they're really hidden.
sigbottle 1 days ago [-]
To be fair, Ghidra was released in 2019 and in general knowledge was still hard to find even back in 2010 I feel (well, compared to 2026 in the age of AI)
inigyou 1 days ago [-]
Before that there was, and still is, IDA Pro. Works largely the same but costs a lot, on the order of $1000/seat/year. Useless for hobbyists unless pirated, but reasonable if it's your job. Probably had academic discounts.
rzzzt 22 hours ago [-]
Also a few free-but-cut-down versions like 5 (which still recognizes MS-DOS executables). I'm not going to recommend downloading it from any of the locations mentioned here but it's out there: https://reverseengineering.stackexchange.com/questions/19179...
JSR_FDED 21 hours ago [-]
Small pedantic nit: Open-sourcing is not the same as reverse-engineering.
inigyou 11 hours ago [-]
We are taking back control of our computers by force.
tverbeure 1 days ago [-]
There is absolutely no way that happened. 15 years ago, we're talking Fermi class GPUs and chips with hundreds of millions of bits of on-chip state and much more if you include the DRAM.
You can't tease out the right information by applying random inputs. Which input would you even use? The PCIe interface? You'd first "randomly" need to get past its complex training sequences...
Your postdoc probably wrote micro-benchmarks of some sort. That is a common technique.
kjs3 24 hours ago [-]
And you don't use an o-scope in anycase, since you'd need...what...a thousand of them to watch all the signals. You'd use a logic analyzer. I think I read somewhere that those older nvidia chips had something like 2000 BGA balls, and Tektronix does make an LA that can scale to 2000-something channels (TLA7000), for a modest US$500k or so. Then you gotta figure how to mount the thing to attach the probes.
So...agreed...far more likely there was a software solution of some kind if this happened.
15 hours ago [-]
Taniwha 16 hours ago [-]
You might is they included DFT (design for test, stuff to make sure when you make a chip all of it actually works) - a scan chain thru all the internal flops will provide you with info about the internal flops and how they are connected - reverse engineering this into a model of reality would certainly be extremely hard, but maybe not impossible
tverbeure 16 hours ago [-]
While that's theoretically possible, it's even harder than trying to do it over, say, PCIe, because the latter at least still has a higher meaning to it while scan chain FFs are just grouped based on spatial proximity.
And of course that's assuming that a) the JTAG port is accessible on these boards and b) the raw scan chain access before scan chain compression hasn't been fused off or isn't locked behind some authentication protocol.
So, no. That didn't happen either. :-)
pixelatedindex 24 hours ago [-]
“oscyloscops” is a way better spelling I gotta say.
i_am_a_peasant 11 hours ago [-]
sounds like a mythical creature hahaha
kayson 23 hours ago [-]
Getting a logic-gate-level netlist from a GDS is trivial with industry standard chip design tools. Circuit designers do this every day. The hardest part will be reverse engineering the functionality.
I wish I had more time and I'd throw Calibre at it.
roadbuster 21 hours ago [-]
Indeed, this is a problem for an energetic student who has free access to every tool in the Cadence, Synopsys, and Mentor portfolios: take the GDS-II layout, run it through extraction, generate a netlist, convert to higher-level blocks ("netlist-to-gate recovery"), translate to RTL HDL, then attempt to work out "what it does."
This is just a job posting in disguise for Jane Street: solve the puzzle, get a call from one of their recruiters.
Taniwha 22 hours ago [-]
It's even easier in this case because they've included the original verilog source ....
mercurywells 22 hours ago [-]
No, that's for the warmup. The real puzzle only has a .gds file available.
Dwedit 21 hours ago [-]
I've looked at Visual 6502 and it's way beyond me. I've even looked at the scans where it shows how they severed the connection to disable 6502 decimal mode on the NES.
monocasa 21 hours ago [-]
To be fair, the 6502 is very dense, and very hand optimized.
Modern systems tend to use "standard cells" for logic which is a lot more digestible.
duskwuff 3 hours ago [-]
The original NMOS 6502 also used a lot of rather weird dynamic logic which can't easily be represented as standard digital logic elements. Some details here:
I was waiting for some writeup about permutation decyphering
whitten 1 days ago [-]
Is there something like an Extract-SPICE tool that takes a circuit and gives you back a text rendering of it ?
kayson 23 hours ago [-]
Yes. There is exactly that, and we call it an "extraction" tool. It takes a GDS (text representation of shapes in the physical layout), and gives you back a "netlist" (text representation of components and connections in a circuit schematic).
Circuit designers use these tools basically daily for two reasons - the first is Layout Versus Schematic. We want to make sure that the physical layout matches the schematic, so the tool turns the layout GDS into a netlist and compares that to the netlist created from the schematic (basically a diff, but more complicated). The second is so we can run simulations that take into account the "parasitic" resistances and capacitances of the wires and metal shapes in the physical layout. It's basically the same procedure as LVS with an extra step that analyzes the metal shapes to determine said R's and C's.
Taniwha 22 hours ago [-]
yes, but at the transistor level .... it has no idea at that level how those transistors are arranged into gates directly
Taniwha 22 hours ago [-]
I take it back, it's a sky130 .gds the gates are explicitly in there
kayson 21 hours ago [-]
The tools can definitely recognize static logic gates purely from the topology (nothing special in the GDS needed). I don't know that I've tested it for anything more complicated, but as you've pointed out, if the hierarchy is in the GDS it's trivial to recover
Taniwha 22 hours ago [-]
In fact if you have the sky130 libraries installed (it's where I'm working) you can get a spice netlist out of it in about 10 seconds - really they should have flattened it
Joel_Mckay 1 days ago [-]
Practically No, the stack-up of metal layers often hides the gate structures underneath, and the billions of process cells may not all be the same.
Theoretically Yes, as an ion-beam-mill and electron-microscope combination machine can slice up semiconductors layer-by-layer. Given these machines can often also give precise x-ray analysis material data, the exact makeup of the chip can be extracted by competitors given enough time. =3
duskwuff 3 hours ago [-]
> Theoretically Yes, as an ion-beam-mill and electron-microscope combination machine can slice up semiconductors layer-by-layer.
You may not even need anything as fancy as that - many microchips can be delayered by a skilled operator using mechanical polishing processes.
saltcured 1 days ago [-]
Now you're making me imagine some kind of 3D-scanning, confocal x-ray fluorescent spectroscope.
Or maybe some kind of hybrid of x-ray microtomography and spectroscopic analysis all in one.
But, maybe the energies involved would be about the same destructive power as some microtome slicing technique...
inigyou 1 days ago [-]
We already know that X-rays don't destroy chips.
saltcured 23 hours ago [-]
I was thinking of the kind of high-energy photon sources that sprawl across a large laboratory campus behind rings of security fences.
These things can definitely erode the targets. Tomography experiments have to think carefully to optimize the set exposure angles used during a session, because the target degrades more with each shot.
bofadeez 24 hours ago [-]
[flagged]
Joel_Mckay 23 hours ago [-]
I’d recommend the Chenming-Hu books on solar cells and semis available as pdfs on his site.
You're replying to a probably now shadowbanned LLM bot that advertises Fable all day
bofadeez 20 hours ago [-]
Are these "shadow bans" in the room with you right now? What a nut.
Fable needs no advertising. It was more important than the printing press. Code singularity.
But it's old news, Fable is no longer my favorite LLM. I mostly use Kimi k3 now. It's also more competent than you are in general.
The primary point you're avoiding is that programming is not a job for professional humans anymore. At least not humans with any dignity or self respect or economic value.
I'm sure you at least agree with this point, like every other reasonable person does now too.
perching_aix 22 hours ago [-]
> LLMs have already been shown to cause cognitive/skill performance losses in some users. =3
Sorry to interrupt your smugness, but have you actually read that study? It's basically tautological: people remained mostly unfamiliar with code they did not write, and remained mostly unfamiliar with a library they did not use. That's kind of the whole point to begin with! https://homepages.inf.ed.ac.uk/rni/papers/realprg.html
Unless you want to argue that anyone who cannot code is brain damaged, I'd say it's a bit difficult to suggest that this would amount to any kind of clinically relevant cognitive impairment, much to the contrary of the masses desperately hoping and asserting so. Losing a skill you don't use / want / need is very normal cognitive function.
Joel_Mckay 14 hours ago [-]
Quod erat demonstrandum =3
perching_aix 12 hours ago [-]
I genuinely wish you were at least half as smart as you think you are, cause then you wouldn't be acting obnoxiously like this, willfully betraying your own values.
It'd be generally awesome if the last bastions of humanity actually demonstrated any of the values they're championing so hard at all.
Joel_Mckay 7 hours ago [-]
I would never kink shame a persons cognitive dildo, or irrational off-topic cult dogma.
Have a wonderful day =3
perching_aix 7 hours ago [-]
[dead]
21 hours ago [-]
mentat 24 hours ago [-]
30 minutes with /goal for the solution from Sol w/ high.
q3k 1 days ago [-]
In a simplified scenario (not too far from this)? Yeah, we've done that in CTFs almost a decade ago.
From where do I know the name Dragon Sector and q3k? You aren't the ones who hacked the train DRM, are you? Or maybe active in the demo scene? Or maybe I'm just confusing you with TRSi?
q3k 1 days ago [-]
Maybe. :)
IshKebab 1 days ago [-]
That sounds like a fun challenge. Feels a lot more tractable than the neural net one.
arjie 18 hours ago [-]
Man, these guys always have insane puzzles. What the heck.
inigyou 1 days ago [-]
[flagged]
1 days ago [-]
ck2 1 days ago [-]
people who can do this stuff are super-smartypants
but reminds me how we're going to find out on an industrial level when the Saudis give China some nvidia chips they were grifted
they've cloned lots of chips before but nothing that advanced
Taniwha 22 hours ago [-]
I'm a chip designer, back in the early 90s I visited a small silicon house who were doing some work for us, their boardroom table had been taken over by a giant sized photomicrograph of IBM's VGA chip and they had a bunch of summer hire grad students tracing wiring and matching standard cells (easier back then because we only worked in 2 layers of metal).
They weren't trying to steal IBM's design, they already had one of their own, what they wanted to know was "is there any as yet unannounced functionality in the IBM VGA chip?" they didn't want to be caught out when some unknown registers popped up. Of course it turned out there was as yet unannounced functionality - but not by IBM's design, more because of the orthogonality of the design - MODE-X was discovered and became the basis for DOOM's speed, anyone who didn't support it lost out
jsLavaGoat 22 hours ago [-]
MODE-X launched 1,000 ships too with the demoscene.
inigyou 1 days ago [-]
You can do this. If you commit the whole next month to it you'll make quite some progress. But you won't.
bofadeez 24 hours ago [-]
[flagged]
JSR_FDED 21 hours ago [-]
They did give the chips to China, but they didn’t work. Turns out they’d first taken them to the basement where someone cut them into pieces before sending them to China.
inigyou 1 days ago [-]
China has no shortage of Nvidia chips. It costs nothing (relatively) for someone to just buy a 5090 off the shelf and send it there.
Not sure if that gives me an advantage in this challenge, but I have too many things to do already. :D
I've tried searching REverse, and some of the hacker conferences from January, but haven't found it yet.
giulioz: MMO-CHIP: From Microscope to Verilog in an hour[1]
source code is on github[2]
[1] https://www.youtube.com/watch?v=5211iYEqnzo [2] https://github.com/giulioz/mmo-chip
Rapid Chip Reverse Engineering Using Laser, Focused ion beams, and Scanning electron microscope https://academic.oup.com/mam/article/30/Supplement_1/ozae044...
FIBs are also used to test modifications before doing a respin. I'm still in awe that matter can be manipulated so precisely
This is absolutely not how reverse engineering a digital logic ASIC works.
Either the story got embellished through retellings, or this person was a fantasist.
There are people who hack on GPUs but it’s done at the software level.
I did get a kick out of imagining a scene where someone is trying to connect an oscilloscope to a circuit board to reverse engineer the CPU opcodes. That’s like the CSI: Miami version of what this would look like.
You absolutely can reverse chips with logic analysis. It is big business in some parts of the world.
You are not going to reverse engineer a GPU with a logic analyzer and by applying currents to pins.
You could replace oscilloscope with logic analyzer in the comment above and nothing changes. It’s a fantasy story. The GPU I/O is high speed PCIe and memory buses.
If you want to explore the chip you connect it to a PCIe host and use the host. Connecting logic analyzers and applying current to pins does not make sense on any level.
Also, if you think probing high speed signals like PCIe or memory buses with logic analyzers is easy, you’ve probably never tried it. The equipment needed to do that properly is incredibly expensive because even probing those buses slightly incorrectly or with cheap probes will make them fail to work at the speeds they use.
You might be thinking that the hobby-level logic analyzers you're used to, are what folks who are serious about doing this kind of work would be using. Just, no.
>Connecting logic analyzers and applying current to pins does not make sense on any level.
Tell me you've never fuzzed a chip without telling me you never fuzzed a chip.
Nobody said it would be easy or cheap, or that fuzzing is the only way to do it. The OP may not have had all the details correct.
But, you certainly can reverse engineer high-density digital electronics this way.
No I'm not. I'm referring to the logic analyzers and probes, and fixturing that would be necessary to probe something like this.
It's not as simple as saying "wouldn't be cheap". I'm saying it's virtually impossible for a university student to do for fun with the resources available to them.
> Tell me you've never fuzzed a chip without telling me you never fuzzed a chip.
Please don't be snarky. Also please don't take my quotes out of context to try to attack a strawman.
I'm talking about the comment thread we're responding to about someone reverse engineering the opcodes by applying current to the pins.
Nobody is going to be fixturing up an nVidia GPU chip, acquiring enough probes and logic analyzer inputs to measure it, then applying currents to pins, just to reverse engineer the opcodes. You're off trying to argue something else to show off your knowledge on the internet, but you've missed the point of the thread.
If someone wants to reverse engineer a GPU, the first thing you do is plug it into a system and access it through software. Nobody is going to connect logic analyzers to a million pins and re-invent PCIe signaling just because it's technically possible to do.
Yes, people do this. Yes, it is a lot of tedious work. PCIe signaling is not a panacea - there are reasons to fuzz like this.
I've also seen folks break out a tunneling electron microscope to dig deeper on de-laminated cores.
>I'm saying it's virtually impossible for a university student to do for fun with the resources available to them.
Now who's inventing straw man claims? "For fun"? Yes, for fun. "For profit"? Yes, for profit too. At universities? Yes, at universities.
Just give it up. The world is big.
You can’t simply get an expensive logic analyzer and probe PCIe or memory buses at these speeds. There are expensive custom fixtures that need to be made to even begin to be able to probe at these speeds without disturbing the circuit so much that it fails to work. This isn’t like probing the I2C bus on a raspberry pi. It would be like connecting to the pins under the chip. It’s fantasy.
It’s also illogical. If you have a PCIe device, you plug it in to a PCIe host and use the host to interact with it. You don’t start probing pins and trying to apply signals to it.
Harnesses for such things are not cheap, nor are they something you can just order from Reichelt. But, I assure you, there are reverse engineering labs in the world that can do this. There are technicians who think nothing whatsoever of de-soldering a BGA and using microscopes to rig things up. They do it before lunch, even.
The OP may have some details wrong - they're clearly laymen describing an anecdote - but that doesn't mean for an instance that this "isn't possible".
There is always a higher-speed logic analyzer, capable of operating faster than the consumer device under test. That's how the consumer DUT's get tested at the ATE, in the first place ..
You keep missing the point and trying to insult my experience in the process.
We're talking about a university student and CPU opcodes. The whole side story about probing the chip is completely irrelevant. This is a software task.
> But, I assure you, there are reverse engineering labs in the world that can do this.
We're talking about a university student.
> There are technicians who think nothing whatsoever of de-soldering a BGA and using microscopes to rig things up. They do it before lunch, even.
I'm talking about the fixturing required to actually probe those pins. Replacing the BGA is the easy part. You can't probe a large BGA by having a tech remove and replace it. The contrast between you trying to insult my experience while not understanding the task at hand is truly something.
You've chosen a weird hill to die on, given how much you're arguing things that have no relevance to the story.
>I'm talking about the fixturing required to actually probe those pins.
This just isn't as impossible as you claim. And, there are plenty of reasons to do it.
Just because you can't imagine it, doesn't mean someone else hasn't already actually done it.
Really simple ICs with a few counters etc in there might be possible to RE this way. Complex ICs with lots of internal state, memory blocks etc like a modern-ish GPU? Not a chance.
Some hybrid approach? Software fiddling with the chip's internals, with say. a big FPGA attached to physically probe outputs? Architecture docs, and maybe some IC die shots at hand? Perhaps (hence my ask for "detailed").
Sounds like requiring the kind of hardware setup that would not be available to uni students.
You'll have more luck reverse engineering the software driver first. They're not hidden, you can just open the driver files in Ghidra, the almost-universal tool for open-sourcing proprietary code. Hidden opcodes can be discovered first by just trying all the opcodes you couldn't discover any other way. You only need to go to the physical level if they're really hidden.
You can't tease out the right information by applying random inputs. Which input would you even use? The PCIe interface? You'd first "randomly" need to get past its complex training sequences...
Your postdoc probably wrote micro-benchmarks of some sort. That is a common technique.
So...agreed...far more likely there was a software solution of some kind if this happened.
And of course that's assuming that a) the JTAG port is accessible on these boards and b) the raw scan chain access before scan chain compression hasn't been fused off or isn't locked behind some authentication protocol.
So, no. That didn't happen either. :-)
I wish I had more time and I'd throw Calibre at it.
This is just a job posting in disguise for Jane Street: solve the puzzle, get a call from one of their recruiters.
Modern systems tend to use "standard cells" for logic which is a lot more digestible.
http://www.aholme.co.uk/6502/Main.htm
https://siliconzoo.org/tutorial.html
I was waiting for some writeup about permutation decyphering
Circuit designers use these tools basically daily for two reasons - the first is Layout Versus Schematic. We want to make sure that the physical layout matches the schematic, so the tool turns the layout GDS into a netlist and compares that to the netlist created from the schematic (basically a diff, but more complicated). The second is so we can run simulations that take into account the "parasitic" resistances and capacitances of the wires and metal shapes in the physical layout. It's basically the same procedure as LVS with an extra step that analyzes the metal shapes to determine said R's and C's.
Theoretically Yes, as an ion-beam-mill and electron-microscope combination machine can slice up semiconductors layer-by-layer. Given these machines can often also give precise x-ray analysis material data, the exact makeup of the chip can be extracted by competitors given enough time. =3
You may not even need anything as fancy as that - many microchips can be delayered by a skilled operator using mechanical polishing processes.
Or maybe some kind of hybrid of x-ray microtomography and spectroscopic analysis all in one.
But, maybe the energies involved would be about the same destructive power as some microtome slicing technique...
These things can definitely erode the targets. Tomography experiments have to think carefully to optimize the set exposure angles used during a session, because the target degrades more with each shot.
https://www.chu.berkeley.edu/modern-semiconductor-devices-fo...
LLMs have already been shown to cause cognitive/skill performance losses in some users. =3
https://www.youtube.com/watch?v=axOcn--n_lM
Fable needs no advertising. It was more important than the printing press. Code singularity.
But it's old news, Fable is no longer my favorite LLM. I mostly use Kimi k3 now. It's also more competent than you are in general.
The primary point you're avoiding is that programming is not a job for professional humans anymore. At least not humans with any dignity or self respect or economic value.
I'm sure you at least agree with this point, like every other reasonable person does now too.
Sorry to interrupt your smugness, but have you actually read that study? It's basically tautological: people remained mostly unfamiliar with code they did not write, and remained mostly unfamiliar with a library they did not use. That's kind of the whole point to begin with! https://homepages.inf.ed.ac.uk/rni/papers/realprg.html
Unless you want to argue that anyone who cannot code is brain damaged, I'd say it's a bit difficult to suggest that this would amount to any kind of clinically relevant cognitive impairment, much to the contrary of the masses desperately hoping and asserting so. Losing a skill you don't use / want / need is very normal cognitive function.
It'd be generally awesome if the last bastions of humanity actually demonstrated any of the values they're championing so hard at all.
Have a wonderful day =3
https://blog.dragonsector.pl/2017/10/?m=1
but reminds me how we're going to find out on an industrial level when the Saudis give China some nvidia chips they were grifted
they've cloned lots of chips before but nothing that advanced
They weren't trying to steal IBM's design, they already had one of their own, what they wanted to know was "is there any as yet unannounced functionality in the IBM VGA chip?" they didn't want to be caught out when some unknown registers popped up. Of course it turned out there was as yet unannounced functionality - but not by IBM's design, more because of the orthogonality of the design - MODE-X was discovered and became the basis for DOOM's speed, anyone who didn't support it lost out