The PicoEMP is a low-cost Electromagnetic Fault Injection (EMFI) tool,

Overview

ChipSHOUTER-PicoEMP

CC BY-SA 3.0

The PicoEMP is a low-cost Electromagnetic Fault Injection (EMFI) tool, designed specifically for self-study and hobbiest research. Under the safety shield it looks like this:

Background

The ChipSHOUTER is a high-end Electromagnetic Fault Injection (EMFI) tool designed by Colin at NewAE Technology. While not the first commercially available EMFI tool, ChipSHOUTER was the first "easily purchasable" (even if expensive) tool with extensive open documentation. The tool was not open-source, but it did contain a variety of detailed description of the design and architecture in the User Manual. The ChipSHOUTER design optimization focused in rough order on (1) safe operation, (2) high performance, (3) usability, and finally (4) cost. This results in a tool that covers many use-cases, but may be overkill (and too costly) for many. In additional, acquiring the safety testing/certification is not cheap, and must be accounted for in the product sale price.

The PicoEMP tries to fill in the gap that ChipSHOUTER leaves at the lower end of the spectrum. This PicoEMP project is not the ChipSHOUTER. Instead it's designed to present a "bare bones" tool that has a design optimization focused in rough order of (1) safe operation, (2) cost, (3) usability, (4) performance. Despite the focus on safety and low-cost, it works suprisingly well. It is also not sold as a complete product - you are responsible for building it, ensuring it meets any relevant safety requirements/certifications, and we completely disclaim all liability for what happens next. Please only use PicoEMP where you are building and controlling it yourself, with total understanding of the operation and risks. It is not designed to be used in professional or educational environments, where tools are expected to meet safety certifications (ChipSHOUTER was designed for these use-cases).

Building a PicoEMP

The PicoEMP uses a Raspberry Pi Pico as the controller. You could alternatively use an Arduino or another microcontroller. You basically just need a few things:

  1. PWM output to drive HV transformer.
  2. Pulse pin to generate a pulse.
  3. Status pin to monitor the HV status.

You have two options for building the PicoEMP: (1) total scratch build, or (2) easy-assemble build.

Scratch Build

The PCB is mostly one layer. Original versions of it were milled on a Bantam PCB mill, and the final 'production' version is designed to still allow this simple milling process. You can find details in the gerbers folder, including Bantam-optimized files which remove some of the smaller vias (used for the mounting holes), and require you to surface-mount the Raspberry Pi Pico. Here was 'rev3' of the PCB with a few hacked up tests:

If you've got time you can order the "real" PCBs from the gerbers as well.

The BOM and build details are described in the hardware folder. If you cannot find the plastic shield (the upper half of Hammond 1551BTRD is used), you can find a simple 3D-printable shield as well. The official shield is low-cost and available from Digikey/Mouser/ Newark so you can purchase alongside everything else you need.

IMPORTANT: The plastic shield is critical for safe operation. While the output itself is isolated from the input connections, you will still easily shock yourself on the exposed high-voltage capacitor and circuitry. NEVER operate the device without the shield.

Easy-Assemble Build

The Easy-Assembly build uses a "mostly complete" SMD board, which you need to solder a Raspberry Pi Pico, switches, and through-hole headers.

This does not yet exist to buy! If you are interested drop a note on Issue #1

Programming the PicoEMP

You'll need to program the PicoEMP with the firmware in the firmware directory. You can run other tasks on the microcontroller as well.

Building the EM Injection Tip (Probe / Coil)

You will also need an "injection tip", typically made with a ferrite core and some wires wrapped around it. You can see examples of such cores in the ChipSHOUTER kit. The following shows a few homemade & commercial tips:

You can make your own from suitable SMA connectors, magnet wire, and a ferrite core material. See the injection_tips folder for more examples and details on building the probes.

Reader Note: Please submit your own examples with a pull-request to this repo, it would be great to have more examples of probe geometries

You can find additional examples of homemade cores in research papers such as:

  • A. Cui, R. Housley, "BADFET: Defeating Modern Secure Boot Using Second-Order Pulsed Electromagnetic Fault Injection," USENIX Workshop on Offensive Technologies (WOOT 17), 2017. Paper Link. Slides Link.
  • J. Balasch, D. Arumí and S. Manich, "Design and validation of a platform for electromagnetic fault injection," 2017 32nd Conference on Design of Circuits and Integrated Systems (DCIS), 2017, pp. 1-6. Paper Link.
  • J. Toulemont, G. Chancel, J. M. Galliere, F. Mailly, P. Nouet and P. Maurine, "On the scaling of EMFI probes," 2021 Workshop on Fault Detection and Tolerance in Cryptography (FDTC), 2021. Paper Link. Slides Link.
  • LimitedResults. "Enter the Gecko," 2021. Blog Link

Using the PicoEMP

The general usage of the PicoEMP is as follows:

  1. Press the "ARM" button. The red "ARMING" led will come on instantly telling you it's trying to charge the high voltage.
  2. The red "HV" led will come on after a few seconds saying it is charged to "some voltage".
  3. Place the probe tip overtop of the target.
  4. Press the "Pulse" button.

You can see more examples of this in the video (TODO RECORD A VIDEO).

You can even use the Raspberry Pi Pico to attack a Raspberry Pi "regular"! Here's a demo hitting a RSA signature on a Raspberry Pi (the demo code taken from Colin's Remoticon 2021 Talk):

WARNING: The high voltage will be applied across the SMA connector. If an injection tip (coil) is present, it will absorb most of the power. If you leave the SMA connector open, you will present a high voltage pulse across this SMA and could shock yourself. Do NOT touch the output SMA tip as a general "best practice", and treat the output as if it has a high voltage present.

The full ChipSHOUTER detects the missing connector tip and refuses to power up the high voltage, the PicoEMP does not have this failsafe!

About the High Voltage Isolation

Most EMFI tools generate high voltages (similar to a camera flash). Many previous designs of open-source EMFI tools would work well, but exposed the user to high voltages. This was fine provided you use the tool correctly, but of course there is always a risk of grabbing the electrically "hot" tool! This common design choice happens because the easiest way to design an EMFI tool is with "low-side switching" (there is a very short mention of these design choices as well in my book if you are curious). With low-side switching the output connector is always "hot", which presents a serious shock hazard.

PicoEMP gets around this problem by floating the high-voltage side, meaning there is no electrical path between the EMFI probe output and the input voltage ground. With the isolated high voltage output we can use the simple "low-side switching" in a safe manner. Some current will still flow due to the high-frequency spikes, so this isn't perfect, but it works well enough in practice (well enough you will shock yourself less often).

The caveat here is for this to work you also need to isolate your gate drive. There are a variety of solutions to this, with the simplist being a gate drive transformer (GDT). The PicoEMP uses the transformer architecture, with some simplifications to further reduce BOM count.

More details of the design are available in the hardware folder.

Hipot Testing for Validating Isolation

Easy-assemble builds have been subject to a hipot test. This test validates the isolation exists, and has not been compromised by things like leftover flux on the PCB.

This test applies a high voltage (1000V) from the SMA connector pads to the low-voltage signals shorted together. The test is done at 1000V DC, with test passing if LESS than 1 uA of current flows over the 60 seconds test duration. Note this limits is far lower than most industry standard limits.

Technical Differences between ChipSHOUTER and PicoEMP

The main differences from a technical standpoint:

  • ChipSHOUTER uses a much more powerful high voltage circuit and transformer (up to ~30W vs ~0.2W) that gives it almost unlimited glitch delivery, typically limited by your probe tip. The PicoEMP is slower to recover, typically ~1 to 4 seconds between glitches.

  • ChipSHOUTER has a larger internal energy storage & more powerful output drivers.

  • ChipSHOUTER has a controlled high-voltage setting from 150V to 500V. PicoEMP generates ~250V, there is some feedback but it's uncalibrated. NOTE: The PicoEMP allows some control of output pulse size by instead controlling the drive signal. This is less reliable (more variability in the output), but meets the goal of using the lowest-cost control method.

License

This work is licensed under a Creative Commons Attribution-ShareAlike 3.0 International License.

Owner
NewAE Technology Inc.
NewAE Technology Inc. is the embedded security arsonist.
NewAE Technology Inc.
Count the number of people around you 👨‍👨‍👦 by monitoring wifi signals 📡 .

howmanypeoplearearound Count the number of people around you 👨‍👨‍👦 by monitoring wifi signals 📡 . howmanypeoplearearound calculates the number of

Zack 6.7k Jan 07, 2023
This Home Assistant custom component adding support for controlling Midea dehumidifiers on local network.

This custom component for Home Assistant adds support for Midea air conditioner and dehumidifier appliances via the local area network. homeassistant-

Nenad Bogojevic 92 Dec 31, 2022
SALUS THERMOSTAT Custom component for Home-Assistant

Home-Assistant Custom Components Custom Components for Home-Assistant (http://www.home-assistant.io) Salus Thermostat Climate Component My device is R

21 Dec 18, 2022
E-Ink Magic Calendar that automatically syncs to Google Calendar and runs off a battery powered Raspberry Pi Zero

E-Ink Magic Calendar that automatically syncs to Google Calendar and runs off a battery powered Raspberry Pi Zero

2.8k Dec 30, 2022
Unofficial Playdate reverse-engineering notes/tools - covers file formats, server API and USB commands

Unofficial Playdate reverse-engineering notes/tools - covers file formats, server API and USB commands ⚠️ This documentation is unofficial and is not

James 106 Dec 31, 2022
🎃 Some spooky code samples to hack yourself a pumpkin 👻

🎃 Tech Or Treat 👻 It's spooky season for those who celebrate Halloween, and to get in the spirit (spirit - get it? 👻 ) we thought it would be fun t

Jim Bennett 5 Feb 07, 2022
Playing diabolo with two robot arms in ROS + Gazebo

Playing diabolo with robots This repository holds the ROS packages for playing diabolo with two UR5e robot arms on ROS Melodic (Ubuntu 18.04). Read ou

23 Dec 18, 2022
A Python program that makes it easy to manage modules on a CircuitPython device!

CircuitPython-Bundle-Manager-v2 A Python program that makes it easy to manage modules on a CircuitPython device! The CircuitPython Bundle Manager v2 i

Ckyiu 1 Dec 18, 2021
An arduino/ESP project that can play back G-Force data previously recorded

An arduino/ESP project that can play back G-Force data previously recorded

7 Apr 12, 2022
🏡 My Home Assistant Configs. Be sure to 🌟 my repo to follow the updates!

Home Assistant Configuration Here's my Home Assistant configuration. I have installed HA on a Lenovo ThinkCentre M93P Tiny with an Intel Dual-Core i5-

iLyas Bakouch 25 Dec 30, 2022
A python script for macOS to enable scrolling with the 3M ergonomic mouse EM500GPS in any application.

A python script for macOS to enable scrolling with the 3M ergonomic mouse EM500GPS in any application.

3 Feb 19, 2022
Интеграция Home Assistant с ЛК "Интер РАО"

ЕЛК ЖКХ «Интер РАО» для Home Assistant Предоставление информации о текущем состоянии ваших аккаунтов в ЕЛК ЖКХ. Введение @ TODO @ Установка Посредство

Alexander Ryazanov 27 Nov 05, 2022
A iot Bike sytem based on RaspberryPi, Ardiuino

Cyclic 's Kernel ---- A iot Bike sytem based on RaspberryPi, Ardiuino, etc 0x1 What is This? Cyclic 's Kernel is an independent System With self-produ

Retr0mous 2 Oct 09, 2022
gdsfactory is an EDA (electronics design automation) tool to Layout Integrated Circuits.

gdsfactory 3.5.5 gdsfactory is an EDA (electronics design automation) tool to Layout Integrated Circuits. It is build on top of phidl gdspy and klayou

147 Jan 04, 2023
HA-Edge-Connector - HA Edge Connector For Python

HA-Edge-Connector 1. Required a. Smartthings Hub & Homeassistant must be in same

chals 21 Dec 29, 2022
a library for using WS2812b leds (aka neopixels) with Raspberry Pi Pico

pico_ws2812b a library for using WS2812b leds (aka neopixels) with Raspberry Pi Pico You'll first need to save the ws2812b.py file to your device (for

76 Nov 25, 2022
Smart EQ connect - Custom Integration for Home Assistant

Smart EQ Connect platform as a Custom Component for Home Assistant.

Rene Nulsch 2 Jan 04, 2022
Samples for robotics, node, python, and bash

RaspberryPi Robot Project Technologies: Render: intent Currently designed to act as programmable sentry.

Martin George 1 May 31, 2022
Pi-hole with Inky pHAT ePaper display

Pi-hole with Inky pHAT ePaper display This is my Pi-hole with an ePaper display.

11 Sep 13, 2022
It is a program that displays the current temperature of the GPU and CPU in real time and stores the temperature history.

HWLogger It is a program that displays the current temperature of the GPU and CPU in real time and stores the temperature history. Sample Usage Run HW

Xeros 0 Apr 05, 2022