BitBangingBytes

Don’t need lasers for that chip, it absolutely can be done with enough time and effort.

Don’t let fancy language like lock-step dissuade you from trying. The people who configured that chip also have to have done their job perfectly or it might still have a way in!

I appreciate all the details they provide in the post. The $250k in lab gear is useful when initially discovering, exploiting and documenting attacks like this.

Definitely doable in a home lab for under $25k in equipment, likely under $10k.

Same as my replicating Colin O’Flynn’s BAM BAM attack on a MPC5566 chip, he used a ChipShouter ($5,000) and I used a PicoEMP ($50).

https://youtu.be/URmI1VVilek

I used this to EMP pulse a locked processor to gain access and extract flash memory from it.

Gave a talk at hardwear.io this year on it. YouTube live stream here: https://youtube.com/live/0tkdst3JE0g

Have you published anything about this anywhere? I also had to work on the SLEIGH file for the M16C.

Overall it just seemed like the processor definition for Ghidra needed more work.

I don’t know if it was autocorrected or what, but it was SAM when I hit submit.

Edit: seems I could fix it, thanks!

The glitch has to happen within the window shown to you by the microcontroller. It seems to be in a different location for each microcontroller evaluated. The fact that it shows you where depending on which processor you’re attacking is pretty convenient!

All decoupling caps were removed so the voltage fault injection could have maximum effect.

Starting a Reverse Engineering Weekly News Show, second week. All feedback is welcome!

There are two radio’s in the meter, one for zigbee and one for the 900MHz mesh that sends this data back to power company. The zigbee side isn’t used at all here anymore, they killed our ability to view our usage with it.