PwnPad part 4 - Fault Injection challenges

Fault Injection (Glitching)

Glitching is a technique to interfere with processor electrical input. One way to achieve this is briefly lowering the voltage a CPU gets in hopes that it results in skipped instructions, incorrect fetches, decodes or bad writebacks.

Voltage Fault Injection 1

Description:

Challenge 7: "Power Trip"

You’ve discovered a device that appears locked down tight, every known interface rejects your commands. But somehow you find a code block that’s never supposed to execute, likely due to built-in protection checks.

By carefully injecting a voltage glitch at the right moment, you might be able to bypass those checks and force the device into revealing its hidden path. The SDA pin serves as your glitch trigger, and if successful, the device will spill the flag over UART @ 9600 baudrate.

Your mission is clear:

    Identify the timing window during which to trigger the voltage glitch.
    Inject a glitch using the SDA pin as your trigger source.
    Access the dead code block and retrieve the flag via UART at 9600 baudrate.

I have started the challenge by building a simple fault injector using pi pico and a project from MKesenheimer https://github.com/MKesenheimer/PicoGlitcher

Parts needed:

• Pi Pico
• 2 Resistors (1K and 10-50Ohm)
• jumper cables
• NPN transitor, I used BC546
• breadboard

using those parts I have built the following circuit

When the transistor is not switched on (no glitch signal is being send from pico) then 5V are being supplied to the PwnPad via pico VBUS or VSYS lines, but as soon as we switch the transistor on the voltage on those lines drops for a very short period of time below typical operating voltage resulting (if we did it correctly) in the fault being injected and hopefully returning the flag.

This is the glitcher connected to the PwnPad with the capacitor desoldered, as they might interfere with the glitch.

Connecting to UART we see a message

when enabling the glitch we can see that cnt got corrupted and appear to have been set to higher than possible value

Voltage Fault Injection 2

Description:

Challenge 8: "Glitch Storm"

Building on the success of the Power Trip challenge, you are once again faced with the same challenge. The goal remains the same, trigger a voltage glitch to enter a hidden code path and retrieve the flag.

However, the catch this time is that the glitch trigger is no longer the obvious SDA pin. You must discover the new trigger pin and timing to successfully glitch the device.

Your mission is clear:

    Analyze the device to identify the new glitch trigger.
    Precisely time and inject the voltage glitch at the discovered trigger.
    Access the hidden code block and extract the flag over UART.

For this challenge I have decided to use a MOSFET for glitching, which I felt gave more reliable results. I used the same 33R resistor and IRLZ44N as the mosfet

Here it is on a breadboard

In this case the glitch works a little bit different, when the mosfet is switched on as we can see from the schematic the input voltage from pico will be pulled to ground for a short period of time. We can observe this using our logic analyzer.

This is the controller input I used to glitch the PwnPad and the resulting flag, you can also notice it did not work the first time and the device actually turned off a couple of times.