Breaking Espressif’s ESP32 V3: Program Counter Control with Computed Values using...
summary
Claim: Espressif ESP32 V3’s Secure Boot and Flash Encryption are bypassable with a single EM glitch that transfers a crafted pointer into the program counter. Method: modify encrypted flash ciphertext blocks to set an arbitrary CRC-32 value using linear algebra over the 75 128-bit Signature Block blocks (CRC-32 linear algebra), then inject a timed electromagnetic fault (RiscEmfi XY stage, probe, oscilloscope, GDB-assisted tracing) to corrupt instruction flow and jump into ROM download mode to decrypt and read flash.
AI-written summary · about
chapters (7)
- 0:00ESP32 V3 introduction
- 4:08Program counter control
- 7:02CRC check vulnerability
- 12:31Glitch injection setup
- 17:16Chip surface mapping
- 18:43Download mode access
- 19:49Mitigation and implications
related talks
48mFatal Fury on ESP32: Time to Release Hardware Exploits
01h 07mPEW PEW PEW: Designing Secure Boot Securely
49mBreaking Through Another Side: Bypassing Firmware Security Boundaries from Embedded Controller
41mSecrets Of Simos18: REng The Secure Boot Mechanism Of An ECU
24mSecurity through Transparency: Tales from the RP2350 Hacking Challenge
39mTOCTOU Attacks Against Secure Boot And BootGuard
25mBreaking Bootloaders on the Cheap
39mBackdooring Hardware Devices by Injecting Malicious Payloads on Microcontrollers