TECH Signal 502 2 feeds carried it
Puzzle releases GDS and VCD files for reverse-engineering a SkyWater 130 nm ASIC
↗
Illustration only Photo by Declan Sun on Unsplash
A two-file puzzle provides a GDS layout and example VCD inputs to let participants reverse-engineer a SkyWater 130 nm ASIC design.
The puzzle shows how raw layout data can be turned into a functional understanding of a chip, which is useful for hardware security analysis and education. Public documentation of the SkyWater 130 nm standard-cell library and its PDK makes the reverse-engineering process feasible without proprietary tools.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
The puzzle includes a GDS layout file and a VCD test vector file that define the chip’s physical geometry and expected behavior.
Cell names beginning with "sky130_fd_sc_hd__" identify the design as using the open-source SkyWater 130 nm standard-cell library, allowing lookup of layer definitions in the public PDK.
By examining layer annotations, cell hierarchies, and input/output labels, participants can trace signal paths and locate a stimulus that drives the “success” output high.
THE READ
What the cluster adds up to.
A new puzzle has been released that consists of two files, puzzle.gds and example_inputs.vcd, intended for reverse-engineering an ASIC. The GDS file encodes the physical layout of the chip as polygons on multiple layers, while the VCD file supplies a simple test case with an input and the expected output. Together they give both structural and functional clues about the design.
Opening the GDS file in a layout viewer such as KLayout reveals a hierarchy of cells, each representing logic gates or registers. The cell names start with "sky130_fd_sc_hd__", which directly points to the SkyWater 130 nm standard-cell library. Because the library and its process design kit (PDK) are publicly documented, the layer numbers in the GDS can be mapped to actual materials like nwell, diff, poly, li1, and the five metal layers met1-met5.
The layout also contains text labels on various layers that name the top-level inputs (clk, rst_n, enable, I) and outputs (eight-bit O and a separate success signal). Within individual cells, labels such as A, B, X, VPWR, and VGND indicate the pins of gates like an XOR. By following the polygons across the metal and via layers, one can reconstruct the wiring and determine how signals propagate to the success output.
Performing this reverse engineering requires familiarity with GDS syntax, the ability to interpret layer stacks, and access to the SkyWater PDK to resolve layer meanings. It also demands manual tracing of connections through multiple metal layers and vias, which can be time-consuming compared to having the original Verilog netlist. The effort is justified for learning chip internals or assessing security properties of a design.
The approach works only because the design uses an open-source standard-cell library and a publicly documented process. For ASICs built with proprietary libraries or undocumented process stacks, the same method would lack the necessary layer definitions and cell semantics, making functional reconstruction far more difficult or impossible.
Written by elseif from the cluster below · checked for specifics the sources never containedTHE CLUSTER