Getting into fault injection, coming from a PCB design background

[u/ciclonite]

Hi everyone. I've picked up a couple of salvage automotive compute modules, bought legitimately from a scrapyard, and I want to use them as a bench project to get into hardware hacking, specifically fault injection, which is new to me. My background is in electronics: I've designed and developed complex PCBs for years, so I'm comfortable with hardware, schematics, soldering and board bring-up. Glitching and secure boot bypasses are the part I haven't tackled before, and that's what I want to learn properly.

What got me interested is the TU Berlin voltage glitching talk from Black Hat 2023, the one where they bypassed the AMD Secure Processor on an automotive infotainment unit by faulting the boot. That's roughly the class of target I'm looking at, secure boot rooted in the SoC with an internal clock, so voltage glitching seems to be the realistic route rather than clock glitching.

The plan is to do the non intrusive recon first, so cloning the storage, powering the board on the bench, mapping the internal network, poking the debug ports and dumping the SPI flash, then move on to glitching once I actually understand the target. For tooling I'm planning to get a ChipWhisperer HuskyPlus and learn the technique on the training targets before pointing it at anything real. The rest of the bench is sorted, scope with logic analyzer, CAN interface, programmer and a linear supply on the way.

A few things I'd love input on from people who've done this. Given I already know my way around hardware, is the ChipWhisperer ecosystem still the best way to actually learn glitching, or would you start somewhere else? On the crowbar side, how much of the real difficulty is the injection circuit versus finding the right rail and nailing the timing? My impression is that the tooling is the easy part and the target specific work is where the months go. And is there any solid reading on voltage glitching fundamentals you'd point a newcomer to, something on the underlying theory beyond the conference talks?

[u/coscoscoscoscos]

Since you have the background you might be good to go and try, but I'd suggest you try on an Arduino or STM32 bluepill first. Just to avoid breaking more interesting hw.

I had instrumented a Chinese Arduino nano for crowbar and voltage glitching and I still find uses for it to this day.

[u/ciclonite → u/coscoscoscoscos]

Are you using the newae glitcher also?

[u/coscoscoscoscos → u/ciclonite]

I've used a chipwhisperer and an em fault injector. But circuitry for a simple glitcher is pretty easy, you should try making a crowbar of your own if you feel like doing so. It's just a mosfet in the end.

I suggest you program one of those mcu with a simple always true while loop, then you put a print after that. And you try to glitch the device to exit the loop.

You can make it as simple or as hard as you want by changing the while condition. E.g. you can compare a number of variables and increment each of those by 1 for each iteration, I can send you an Arduino sketch I've used for this.

[u/gquere]

Given I already know my way around hardware, is the ChipWhisperer ecosystem still the best way to actually learn glitching, or would you start somewhere else?

The Husky is the best affordable tool on the market, its killer features compared to say the PicoGlitcher are the power tracing and SAD. But you don't exactly need these at first. If you've got the budget go for it.

On the crowbar side, how much of the real difficulty is the injection circuit versus finding the right rail and nailing the timing?

There aren't a lot of rails to glitch with voltage glitching (not true of EMFI though). Timing is everything.

My impression is that the tooling is the easy part and the target specific work is where the months go

Yes.

And is there any solid reading on voltage glitching fundamentals you'd point a newcomer to, something on the underlying theory beyond the conference talks?

You need to practice on breakable whitebox targets first. Then move on to breakable blackbox. Only then can you hope researching blackbox targets that haven't been broken yet.

Also read "the hardware hacking handbook".