Jane Street published a challenge: here is a GDS layout file describing a custom chip, work out what it does, and extract the password hidden inside it. Jestoph spent a month on it and shipped the answer, (* TWO STARS *). The essay’s subtitle tells you what kind of writeup this is — “Why do I always do things the hard way?”

The technical work is real: chip layouts are geometry, not code, so the only path in is to reconstruct a netlist from polygons and then reason about the resulting circuit.

  • He read the GDS with Python’s gdstk, then inferred which shapes were inputs, outputs, and standard cells (sky130_fd_sc_hd__*)
  • The warmup puzzle existed precisely so solvers could validate their extraction pipeline before facing ~10k components across 81 cell types
  • Crucially, labels sit on cell centrepoints, so a 2D overlap test maps geometry to cell I/O — revealing connections that visual inspection would never surface

What makes the piece worth reading is that he narrates the failure modes rather than hiding them.

  • Before dropping it all for off-the-shelf tools, he built a circuit simulator on sqlite3, then a hardware description language, then a parser for it, then a test harness, then an abandoned waveform viewer and GDS viewer
  • The sky130 documentation he needed had the answers the whole time; he read it weeks later and asked himself why he always does things the hard way
  • Two or three days were lost to a simulation that would not run at all, because he had forgotten to drive the reset pin
  • The final shortcut — many inputs just needed two pulses at a multiple of 11 — was visible all along, but he was too deep in the lower layers to look up

The most instructive moment is the brute-force wall. 120 input bits is unsurvivable, so he reframed the circuit as a recurrence relation — output known at step 120, all zeros at step 0 — and let z3 solve it backwards. He prototyped the idea in a Google Sheet first, on the reasonable grounds that a spreadsheet is a surprisingly sophisticated constraint solver.

He also found a genuine bug in Jane Street’s chip: an undriven wire and a connection to a pad that is neither input nor output. Reporting it sheepishly, he was told he was right. A defect in the source artifact is far stronger proof his pipeline was correct than any passing test.

The lesson is not “never explore.” It is that every unblock came from finally using existing information or tooling, and every week-long detour came from refusing to.