HellGates, custom CPU gate-level challenge

HellGates is a handcrafted gate-level challenge built around a custom 32-bit CPU described in VHDL, synthesized to a heavily obfuscated netlist with anti-tamper and timing checks and a bit-addressable, encrypted memory model. It was intended to be human-solvable but resistant to automation; teams and earlier LLMs spent weeks or months without success. In September 2026 GPT-6, run on SRE-Bench, recovered the CPU state and decrypted the system in under 30 minutes by exploiting a side-channel/differential analysis on the weak encryption protecting registers and memory, replaying runs after stripping obfuscation and ultimately dumping a full 1GB plaintext memory image.

Architecturally, the CPU has sixteen 32-bit general registers and special registers (overflow, condition, program counter, key modifiers, index for key modifiers, and a TEA-based pseudo-random state), a standard ALU instruction set, and memory words fixed at 64 bits so all code and data must be word-aligned. The encryption used simple, low-gate-count mixing - fake-value addition and XORs combined with a TEA state - left intentionally light to reduce logic cost; that lax design enabled differential recovery of key material. Tooling includes a custom ANTLR-based assembly (hgasm) and compiler and a CTF program with DMA and anti-tamper hooks. The takeaway: gate-level obfuscation without robust cryptography and side-channel resistance can be defeated, and powerful models can automate differential analysis.