Vlind Glitch: Blind VCC Glitching Technique to Bypass the Secure Boot of Qualcomm MSM8916 Mobile SoC
summary
Describes a practical Blind VCC (Vlind) glitch that forces Qualcomm MSM8916/APQ8016 into EDL during root-hash verification by briefly lowering an exposed APC rail (removed capacitor C228) using a Whisperer Nano triggered from a Beagle USB sniffer and a relay power reset. A modified Qualcomm programmer injects a payload that prints over USB and a PBL dumper; 125 automated attempts over 15 hours yield an average successful bypass in 7.25 minutes, and a full bootrom dump confirms the method works reliably enough for follow-up attacks.
AI-written summary · about
chapters (9)
- 0:00Intro
- 1:20EXFILES Project
- 4:14Target: DragonBoard 410c
- 13:13EDL Image verification
- 15:47Attack Overview
- 20:46Enabling Secure Boot
- 22:09Soldering to the Chip Whisperer
- 23:41Characterising the DragonBoard
- 28:05Bypassing Secure Boot
related talks
45mExploiting Qualcomm WLAN and Modem Over The Air
24mSecurity through Transparency: Tales from the RP2350 Hacking Challenge
39mReflections on Trusting TrustZone
22mAchilles Heel in Secure Boot: Breaking RSA Authentication and Bitstream Recovery from...
51mSecure Boot Under Attack: Simulation to Enhance Fault Attacks & Defenses
25mBootStomp: On the Security of Bootloaders in Mobile Devices
23mBypassing the Maginot Line: Remotely Exploit the Hardware Decoder on Smartphone
35mKernel Alchemy: Crafting Mobile Kernel Code to Evade Modern RASP Protections