GlitchGlück: Enabling Software Vulnerabilities through Guided Hardware Fault Injection
summary
GLITCHGLÜCK presents a guided fault-injection pipeline that builds a Dynamic State Transition Graph (DSTG) from register outputs in simulation, uses layout-aware timing to pick fault site/time (example: PC/R13 transition at cycle 923, 4.7–6.0 ns preparation window), and maps those parameters to physical attacks. Validation shows a single clock glitch (5 ns) flips R13 to bypass an input-size check and overwrite return data; results reproduce on a physical OpenMSP430 ASIC with scan-chain validation and in simulation on PicoRV32 and IBEX.
AI-written summary · about
chapters (9)
- 0:00GlitchGlück introduction
- 3:46Traditional fault injection limits
- 5:11Need for guided hardware fault injection
- 7:41Tooling and dynamic state graph
- 9:28Finding vulnerable decision states
- 13:42Fault injection timing
- 15:06Simulation validation
- 17:14Post-silicon validation
- 19:02Conclusion
related talks
04mBridging the Glitch Gap: Hash Salehi on Making Professional Fault Injection Accessible
46mChip.Fail - Glitching the Silicon of the Connected World
43mImplementing Practical Electrical Glitching Attacks
32mSecSi Product Development
32mGlitching Edge Ai Fault Injection On Npus, Automated By LLM Agents
44mSilicon Under Attack Physical Exploitation Of Modern Chips
44mPractical Software Countermeasures 4 Hardware Glitch Attacks
43mRaiden Glitching Framework