Affordable EMFI Attacks Against Modern IoT Chips
summary
An accessible EMFI rig is reproducible from cheap parts: a Digilent CMOD A7 running the chip.fail bitstream for 2.5 ns timing, an affordable pulser (ChipSHOUTER used at ~500 V or a PicoEMP alternative), a $200 motorized XY stage and small PCBs. Circuit diagrams, code and a Python-controlled mapping tool produce CSV heatmaps showing clustered faultable areas. The build achieves multiple instruction skips — including first successful instruction skips on ESP32-C3 — and ships an EMFI Companion breakout for trigger, reset and scripting.
AI-written summary · about
chapters (16)
- 0:00Introduction to EMFI
- 1:05Modern security features
- 2:51Why affordable EMFI matters
- 3:36What is fault injection
- 7:30Timing and location precision
- 8:57Building the EMFI setup
- 12:08Delay generator options
- 13:17EMFI pulse devices
- 15:05Hardware reset PCB
- 16:33EMFI Control software
- 18:41Testing on modern chips
- 20:24Challenges and pitfalls
- 21:29Results and visualizations
- 23:14Attack feasibility and impact
- 24:20Conclusion and cost breakdown
- 26:09Q&A session
related talks
46mChip.Fail - Glitching the Silicon of the Connected World
44mSilicon Under Attack Physical Exploitation Of Modern Chips
48mFatal Fury on ESP32: Time to Release Hardware Exploits
25mMINimum Failure - Stealing Bitcoins with Electromagnetic Fault Injection
04mBridging the Glitch Gap: Hash Salehi on Making Professional Fault Injection Accessible
24mSecurity through Transparency: Tales from the RP2350 Hacking Challenge
32mCommon Attacks on IoT Devices
43mImplementing Practical Electrical Glitching Attacks