Injecting Software Vulnerabilities with Voltage
Glitching
Yifan Lume@yifanlu.com

Abstract—We show how voltage glitching can cause timing
violations in CMOS behavior. Then we attack a real, security
hardened, consumer device to gain code execution and dump thesecure boot ROM.

VDD
SI. INTRODUCTION
Glitching, or fault injection, has been used for over a decade[1] to attack software running on secure execution environments. Due to the upward trend in pricing in the software
exploit market [8] and the increased hardening of security
in consumer devices, there has been a rise in popularity of
injecting faults to gain control of a device. Fault injections
can be used to cause a malfunction in the target’s system-onchip (SoC) and, when the malfunction is controlled properly,
can be used by an attacker to take full control of the device.
Voltage glitching is a specific kind of fault injection andis attractive because is it inexpensive to set up and is widely
applicable to most chips [2]. Crowbar voltage glitching wasintroduced by O’Flynn [6] and implemented in the ChipWhisperer open hardware platform to bring these attacks to
the mainstream. It works by abusing the capacitance ringing
effect caused by introducing a crowbar circuit into the existing
system. The ringing causes faults that can be exploited.
A. BackgroundWe looked at the prior attempts at modeling voltage fault
injections and ordered them in terms of abstraction (seetable I). Most recently, in a paper by Timmers, Spruyt, andWitteman [9], they created an architectural model of fault
injection for ARM devices. Their model considers instruction
corruption due to bit-flips caused by the fault. Their model isapplicable to many kinds of fault injection.
Another paper we drew inspiration comes from Zussa,
Dutertre, Clédière and Tria [10]. Their work focused on
confirming empirically that the mechanism for faults inducedby voltage glitching is due to setup/hold time violations.
They concluded that voltage glitches increased the propagation
time of combinational logic which creates setup/hold time
violations. Another connection we make is that while theirpaper wanted empirical evidence for a wide-held belief in how
voltage glitches work we want a rigorous theoretical model forthe same wide-held belief.
One level down from that is the paper by Djellid-Ouar,
Cathebras and Bancel [4] which concluded that D-flip-flops
This work was not supported and do not represent the approval or rights
of any third parties.

G
D

Vin

Vout
CL

G
VSS

Fig. 1. Standard CMOS inverter with load capacitance CL(and therefore most memory elements) were mostly immune tostandard voltage attacks. Their paper analyzed bistable CMOS
elements using the small signal model.
In addition to modeling voltage glitches, there has been
many experiments in applying voltage fault injections to affectprocessor operations on complex SoCs. The aforementioned
paper from Timmers, Spruyt, and Witteman [9] details a
bypass of a secure boot code integrity check on an ARM
processor through voltage glitching. O’Flynn [6] used his
crowbar method on a Raspberry Pi computer to modify the
result of a running counter.
The PlayStation Vita was a hand-held gaming console
released in 2012. It used a custom designed Samsung 45nm
SoC [3]. The SoC includes a MeP architecture processor which
we nicknamed “F00D,” that performs cryptographic tasks andserves as the boot processor. The boot ROM used by F00D is
unmapped early in the boot process and is then unable to beread out through pure software means.
Our contribution will be in two separate domains. In section
II, we will analyze the CMOS transistor behavior in order tounderstand when the combinational logic is most susceptible
to voltage glitch induced faults. Then, in section III we will
apply our understanding to perform a fault injection attack on
the PlayStation Vita’s SoC to gain early (boot time) execution
control of F00D in order to dump the boot ROM.
II. CMOS VOLTAGE GLITCH MODEL
To analyze the CMOS behavior during a voltage glitch,
we will only consider the voltages near the gate itself. ThisTABLE I
R ELATED WORKS IN MODELING VOLTAGE GLITCHESPaper
TSW [9]ZDCT [10]
DCB [4]This Paper

Year
2016
2013
2006
2018

Level
Architectural
Digital Logic
Gates/Elements
Transistor

Applicability
ARM, any glitches
Voltage/clock glitching
Voltage glitching
Voltage glitching

Results
Faults modeled by corrupted instructions
Fault caused by setup/hold violations
D-flip-flops not susceptible to voltage glitches
Effects are data dependent0
VDD

TABLE IIN OTATIONS USED
VDD
VSS
0
VDD
Vin
Vout
CL
VSG
VT H
VIL
VIH
Reqp
Reqn
0
Reqp
tpHL
tpLH
τA
τB
tG
tgHL
tgLH

Supply voltage (normal operations)
Ground voltage (typically 0 V)
Glitch supply voltage (typically ∼ 0 V)
CMOS input voltage
CMOS output voltage
Gate load capacitance (simplified)
Voltage from PMOS source to PMOS gate
PMOS threshold voltage
Switching threshold for input low
Switching threshold for input high
PMOS equivalent resistance with source VDDNMOS equivalent resistance with source VSS0
PMOS equivalent resistance with source VDD
Propagation delay for output going low
Propagation delay for output going highGlitch start time
Glitch end timeτB − τA
Propagation delay for output going
low during glitch (to be defined)
Propagation delay for output goinghigh during glitch (to be defined)

simplification will disregard everything that happens when thevoltage pads on the IC is suddenly changed. For example, if
a crowbar circuit is used to quickly short VDD to VSS forsome amount of time, we do not actually observe a short at
the MOSFET. Instead, the capacitance and the power-deliverynetwork of the circuit will create a ringing effect [6] thatwill be observed at the MOSFET. Our analysis will therefore
only consider the duration and amplitude of these rings as the“glitch” and not the source of them. We note that a more in
depth analysis can incorporate such external effects without
affecting our understanding of what happens at the MOSFET.
A. Notation
We will use standard notation where applicable. For convenience, they are defined in table II along with other labels
relevant in our analysis.
B. Motivation
Consider a standard 1-input CMOS gate (an inverter, figure1). Let Vin be the input voltage and Vout be the output.
We define a voltage glitch to be a span of time from τA to
00
τB during which, we set VDD ← VDD. VDD
is the glitch0
voltage (and ideally VDD = VSS ). tG = τB − τA is the glitch
width. CL represents the load capacitance and includes thegate parasitic capacitances, the wire capacitance, and the input
capacitance of the next gate.
We will focus on the span of time between τA and τB whenthe voltage glitch happens. Looking at only one inverter, we

0
Reqp

Vout
CL
VSS
Fig. 2. Equivalent circuit for PMOS in non-saturation.

see that in that span of time, the input could either toggle atleast one time or not toggle at all. We will analyze the behaviorof the inverter in both cases to see when the output value canbe influenced by the glitch.
C. Non-toggling
First, consider the case when Vin does not change during
the voltage glitch. If the input is a logical ‘1’ (Vin ≥ VIH )then the output would be at Vout = VSS . Since VSG < VT H ,the PMOS is off and there is no source for Vout to change.
Therefore the voltage glitch caused no change in behavior.
If the input is at logical ‘0’ (Vin ≤ VIL ), then before thevoltage glitch, Vin = VSS and Vout = VDD . When the glitch
happens, the PMOS will be on, so we can use the equivalent
resistance model defined in Chapter 5.4 of [7] to analyze thedynamic behavior.
Using equation 5.17 in [7], we find the fall time to be
tgHL = ln(2)Reqp CL(1)where Reqp is the on-resistance of the PMOS at the glitch0
voltage VDD. Note that this is slightly different from thecommonly used value tpHL (fall time of the inverter) because
tpHL is defined with respect to Reqn , the on-resistance of the
NMOS.
The output goes to ‘0’ for the duration of the glitch andthen is be restored to ‘1’ as VDD is restored to its pre-glitch
value. This means that if the input is ‘0’ at the start of thevoltage glitch and does not toggle, then the output will be low
from τA + tgHL to τB + tpLH (assuming tgHL  tG ). Note
this is similar to a static hazard, which can cause setup andhold time issues.

D. Toggling
Consider a transition from a logical ‘0’ to ‘1’ at the input
during the voltage glitch (from τA to τB ). Since this turns
off the PMOS, there should be no change in behavior at theoutput (compared to what happens if it toggles while there is
no voltage glitch). However, if the transition is from a logical‘1’ to ‘0’, then according to [10], the rise time of the inverter0
output, tgLH increases as VDD
decreases. Additionally, if the0
glitch voltage VDD < VT H , then the output will not gohigh for the duration of the voltage glitch (tgLH would be
infinite). So this means the propagation delay increases as0
VDD
decreases up to tG . This also causes setup and hold timeissues.
E. Results
In both cases, we see that the delay introduced to a single
gate by a voltage glitch is composed of a rise/fall time (tgHLor tgLH depending on the input value), the glitch width tG , andfinally the delay for when VDD is “restored” and the “correct”
input must propagate to the output again (tpLH ). We can define
tg to be the propagation delay of that inverter during a voltage
glitch from the input to the output (we consider the value tobe “propagated” only when the output has the correct value).
From above, we see this can be broken into four cases.
(tG + tpLH ,if tgHL > tG
tg,non-toggle,0 ≥tG − tgHL + tpLH , otherwise
tg,non-toggle,1 = 0(
tG + tpLH , if tgLH > tGtg,toggle,0-to-1 ≥tgLH ,
otherwise(2)

tg,toggle,1-to-0 = tpHL
Now, if we have a chain of N inverters, we can find thetotal propogation through the chain considering that only the
first inverter is affected by the voltage glitch (with delay tg0 =(tg,non-toggle,0 + tg,toggle,0-to-1 )/2, the average delay of the twocases that are affected by a voltage glitch). Note that if two
inverters in a chain are affected, we do not care about thestatus of the later inverter because the earlier one will alreadypropagate its corrupted value and later corrected value down
the chain.
tg (N ) = tg0 + (N − 1)

tpLH + tpHL
2

(3)

In practice tgHL , tgLH , tpHL , tpLH will all be very small
compared to tG 1 . Therefore we can simplify equation 3 to:tg (N ) ≥ tG + N

tpLH + tpHL
2

(4)Note that the second part is just the CMOS propagation
time with fanout 1. That means as long as tG is much greater1t
pHL and tpLH are around the order of 30 ps for 0.25 µm CMOS
technology [7].

than the rise/fall time of the output, the propagation delay isbounded by the CMOS delay plus the glitch width.
Of course in reality, the analysis gets a lot more complicated. First, the voltage glitch will not affect every CMOS at
the same time. There will be a sort of “propagation delay” ofthe voltage change itself. Second, when we consider 2-input
gates and higher, there could be a mixture of non-toggling andtoggling behavior at each gate. Then of course, there are thenon-linear capacitance that makes computing CL difficult.
However, there are some conclusions we can draw from thisanalysis.
• Asynchronous circuits are most affected by voltage
glitches due to the introduction of hazards.
• Synchronous circuits are not immune if the voltage glitch
cause a setup/hold time violation.
• Critical paths can be extended if a voltage glitch happensat the right time (0-static or 1-toggling).
• Long critical paths are the best targets for voltage glitching (i.e: processor ALU).
III. VITA GLITCHING
The firmware and boot loader are found on an external
eMMC storage, which has logical sectors 512 bytes wide.
Upon boot, sector 0, the master boot record is read. The Vita’s
MBR is a custom format not used in any other device. The
details of this MBR format are beyond the scope of this paper,
but two fields are of importance. bldr offset is at MBR
offset 0x30 and bldr size is at MBR offset 0x34. These
two fields are both 4 bytes wide and both the offset and size
are defined in number of sectors. They are used by the bootROM to determine where the boot loader is located.
One thing we discovered early on (through trial and error)
was that if bldr size > 0xDE, then an assertion fails and thedevice is rebooted. Otherwise, the eMMC is read starting at
the offset for bldr size blocks. Our hypothesis is that there
is a fixed size buffer that the boot loader is read into which
necessitates the size check. If we use a fault injection to bypass
this check, we can introduce a buffer overflow vulnerability.
A. Experimental Setup
There were three main components to our setup. First, we
needed a way to monitor the eMMC traffic and use it as a
trigger for the voltage glitch. Second, we needed a way to
perform the voltage glitch. Finally, we wished to automate thesteps in order to find the optimal parameters for glitching.
Fortunately, the ChipWhisperer gave us an easy way to do
all of this. The hardware has a MOSFET that performs thecrowbar voltage glitch [6]. The open hardware design allowed
us to implement a custom eMMC trigger for the MOSFET (seeappendix A-A). Finally, because the timing and duration of thevoltage glitch is highly dependent on the power distribution
network of the device [6], it is difficult to compute the optimal
timing parameters for a successful glitch on the size check.
Instead, we exhaustively searched for the timing offset andwidth of the crowbar activation after being triggered that
results in a successful fault injection.

Additionally, we made sure to synchronize the ChipWhisperer’s glitch module clock with the device’s external clock
input. This way we can make sure the two devices are in phaseand decrease the variance in finding working parameters.
B. Parameters
For a successful fault injection, we need to find parameters
f , the clock frequency of the glitch module and the Vita’s
external clock input, N , the number of cycles after seeing theeMMC trigger before activating the crowbar circuit and M ,the number of cycles to hold the crowbar on before releasingit. Note that these parameters will determine the response of
the ringing effect that will ultimately cause a fault in the size
comparison2 .
We know from experimentation3 that F00D boot ROM runs
at fclk = 91 f (where f is the external clock input). A fasterclock will increase the chance of a successful fault (due totiming violations). In practice, we cannot over-clock much past
the default rate of 37MHz or we will run into non-voltage
glitch related timing violations that prevent the circuit fromworking properly4 . However, in our case, because of the noisy
design of our glitching setup, we picked f = 12 MHz since
it was the fastest we were able to go without running into avariety of signal integrity issues.
For N and M , we chose to brute force every possible value
to find ones that worked.
For the parameter search, we first used manual analysis toget a ballpark idea of when bldr size is being checked. We
hypothesized that the check must happen after the response
packet for the eMMC READ SINGLE BLOCK request for the
MBR block. First we narrowed the window for the search tobe the period of time between commands. We measured theamount of time from the response of READ SINGLE BLOCK
packet (with a valid bldr size) to the request of the
SEND STATUS5 packet using a Rigol DS1054Z oscilloscope.
At fclk = 12/9 MHz, it took 36 ms6 . This yields an upperbound for N .
When an attempt fails with a particular N , M pair, weobserve one of the following behaviors:•

The device halts. Usually we only see this with very large
M so it’s likely the CMOS is losing power and shuttingoff.

2 Many sources mention removing decoupling capacitors for better result
without giving a detailed reason. We were able to get voltage glitches towork both with and without removing the decoupling capacitors. It is ourbelief that removing the decoupling capacitors changes the response of theringing and therefore the parameters for a successful glitch. But in our case,it does not make it any more or less tractable.
3 Toggle GPIO and measure with the Rigol DS1054Z.
4 This might be prevented with, for example, better cooling but we did not
go down this avenue.
5 Defined as part of the eMMC read procedure [5].
6 We discovered that due to a bug, the boot ROM spins the processor to
wait for the READ SINGLE BLOCK request to complete. However, the smallest
granularity of the spin time is about 1000 times the average amount of time
it takes for the command to complete (as we observed on the DS1054Z). So
to make things easier, our brute force actually ran backwards starting fromthe far end of the window.

Power On

Wait N
cyclesSet clockto f

Activate
CrowbarCircuitReset

Wait M
cyclesWait forMBR read

Deactivate
CrowbarCircuitSee
packetread?

Yes

Success!

No
Power
still
on?

No

Yes

M ← M +1

M ← 0,N ← N +1

Fig. 3. Parameter search process

The device reboots and we observe the eMMC
GO IDLE STATE packet. This is the most common observation7 .
• The device goes into an unknown state and makes an
unexpected request (and possibly restarts).
• The device requests the first block of the bootloader (thisis the success case).

•

We therefore only need to record the next packet seen after
reading MBR (or time out) and check if it is the first block of
the boot loader to indicate success. Figure 3 summarizes the
7 We believe this is due to the fault happening at the wrong place or nothappening at all. Both of which would cause an assertion to fail. Originally
we wanted to try some timing attack to differentiate the two cases. However
we later found out that the designers actually anticipated this and masked
any reboot triggered by an assertion fail to first spin for a random number ofcycles determined by a TRNG to make it hard to determine “which” assertion
fail caused the reboot.

for ChipWhisperer, we created a working attack on a security
hardened consumer device.

TABLE IIIR ANGE OF WORKING P
Parameter
f
N
M

Units
Hz
cyclescycles

Min
12
40800
45

Max
12
40820
55

R EFERENCES[1]

process.
[2]

C. Results
After writing a script with the ChipWhisperer API to
try all possible N and M values (see appendix A-B) andrunning it overnight, we found a successful case with thefollowing parameters (see table III). Due to the effects ofwire capacitance and external capacitance, the parameters arehighly specific to our setup and environment. However, after
finding a valid N ,M pair, even with environmental variations,
we can find another valid N ,M pair close by. If the equipment
and target board and not moved or touched at all, we canreproduce the injected fault with the same N ,M for > 80%of the time.

[3]

[4]

D. Exploiting
We managed to find the glitch parameters N and M thatfaults the bldr size check. However this only gives us avulnerability. We still need to exploit it. Fortunately, thiswas made easy when we observed that when the glitch was
successful, we see exactly 0xE2 blocks read if bldr size ≥0xE2. If bldr size < 0xE2, then it will read bldr size
blocks exactly (with a successful glitch). Therefore we guessedthat we were overwriting the currently executed code andthat guess was correct. With that, we launched a payload that
dumped everything we can read through UART.
Unfortunately we then discovered the boot ROM does notseem to be mapped anywhere. It appears that hardware copies
the contents of boot ROM to SRAM and the reset vector points
directly to SRAM. That means the boot ROM is able to clean
up parts of itself as it executes. To get the remaining parts(that were cleaned up), we had to glitch different parts of theboot ROM (running in SRAM) and gain code execution earlier
and earlier on. Each time we dump more code, we gain more
information and can develop more specific glitch targets. The
details of these additional injected faults and their subsequent
exploitation is beyond the scope of this paper.
IV. CONCLUSION
By looking at how voltage glitches introduce timing violations into a digital circuit, we can find good snippets of code
to glitch. Once a target is found, we can search for the righttiming parameters for our crowbar circuit to cause a fault.
We do an exhaustive search because it is difficult to predict
how changing the parameters N and M actually affects the
CMOS circuits. Finally, the injected fault introduces a software
vulnerability that can be exploited to gain code execution. Allof this can be done at a low cost thanks to the open hardwareinterface of the ChipWhisperer. With a custom script written

[5]

[6]

[7]

[8]

[9]

[10]

Ross Anderson and Markus Kuhn. “Low cost attacks ontamper resistant devices”. In: Security Protocols. Ed. byBruce Christianson et al. Berlin, Heidelberg: Springer
Berlin Heidelberg, 1998, pp. 125–136. ISBN: 978-3540-69688-9.
A. Barenghi et al. “Fault Injection Attacks on Cryptographic Devices: Theory, Practice, and Countermeasures”. In: Proceedings of the IEEE 100.11 (Nov. 2012),
pp. 3056–3076. ISSN: 0018-9219. DOI: 10.1109/JPROC.
2012.2188769.
Andrew Cunningham. Samsung to Manufacture PS Vita
SoC. July 29, 2011. URL: https : / / www . anandtech .
com/show/4553/samsung- to- manufacture- ps- vita- cpu(visited on 12/19/2018).
A. Djellid-Ouar, G. Cathebras, and F. Bancel. “Supply
voltage glitches effects on CMOS circuits”. In: International Conference on Design and Test of Integrated
Systems in Nanoscale Technology, 2006. DTIS 2006.
Sept. 2006, pp. 257–261. DOI: 10 . 1109 / DTIS . 2006 .
1708651.
Embedded MultiMediaCard(eMMC) eMMC/Card Product Standard, High Capacity, including Reliable Write,
Boot, Sleep Modes, Dual Data Rate, Multiple Partitions Supports and Security Enhancement (MMCA, 4.4).
JESD84-A44. JEDEC Solid State Technology Association. Mar. 2009.
Colin O’Flynn. “Fault Injection using Crowbars on Embedded Systems”. In: IACR Cryptology ePrint Archive2016 (2016), p. 810.
Jan Rabaey and Anantha Chandrakasan. Digital Integrated Circuits: A Design Perspective. Pearson Education, 2003.
Marc Ruef. Exploit Pricing: Analysis of the Market in
Digital Weapons. Oct. 13, 2016. URL: https://www.scip.
ch/en/?labs.20161013 (visited on 12/18/2018).
N. Timmers, A. Spruyt, and M. Witteman. “Controlling
PC on ARM Using Fault Injection”. In: 2016 Workshop
on Fault Diagnosis and Tolerance in Cryptography(FDTC). Aug. 2016, pp. 25–35. DOI: 10.1109/FDTC.
2016.18.
Loı̈c Zussa et al. “Power supply glitch induced faults
on FPGA: An in-depth analysis of the injection mechanism”. In: July 2013, pp. 110–115. DOI: 10 . 1109 /IOLTS.2013.6604060.
A PPENDIX A
C ODE

A. Custom ChipWhisperer with eMMC Triggeringhttps://github.com/TeamMolecule/chipwhisperer
B. Parameters Search Script
https://github.com/TeamMolecule/petite-mort