Decoding EM-FI Attacks: Lessons Learned from Glitching the GigaDevice GD32F407
No ratings
Presented at Black Hat Europe 2024 by
Electromagnetic Fault Injection (EM-FI) rigs can be complex and challenging to operate. There can be large amounts of data collected to assess how a target responds to glitching, and many tunable parameters involved in preparing and executing a successful EM-FI glitch attack. Real-world attacks can be further complicated by limited access to firmware and debug interfaces. As glitching is a brute force process, ultimate time to success is determined not only by glitch rate, but more importantly, by proper rig calibration and intelligent parameter choices. It is not uncommon for a researcher attempting EM-FI to reach a point of being stuck - having invested significant time and money and collected lots of data without success and is then unsure of how to move forward. Unsure of how to interpret the collected information, unsure whether to collect different or additional data, and unsure of what changes to make to the rig parameters or the glitching process itself. In this presentation we distill our experience of successfully glitching a GigaDevice GD32F407 via two distinct attacks to bypass hardware-based firmware read out protection into deterministic, actionable methods and strategies for operating and tuning an EM-FI rig to achieve results on your real-world target in the least possible time. We will also discuss unique observations our research has revealed including a related firmware readout protection bypass. We focus on rig calibration and tuning of common parameters in detail including the Trigger, Target Voltage, Pulse Power, Pulse Timing, and Spatial Coordinates (XYZ), as well as what key data to observe and record. We describe a decision-making process to narrow parameter ranges or even collapse them entirely to optimize the process of finding device sensitivities and to understand which glitches are more important to your goal, which is critical to moving past uncertainty and toward success.