SecSi Product Development
summary
Manual RTL inspection of open-source Verilog cores finds concrete, exploitable mistakes: OpenRISC has a JTAG one‑hot state machine whose uneven LUT packing creates a timing/glitch window that can produce simultaneous shift‑IR/shift‑DR states and corrupt TAP behavior; OpenMSP430 uses combinational sensitivity lists (debug clock/reset) that let external debug toggles force CPU halt and desynchronize front/back state machines; Amber has 32MB address wrapping and default-to-main‑memory decoding that create aliased accesses able to bypass intended memory protections. Methods: pattern searches, targeted code fixes, and follow‑up hardware pen‑testing on FPGA/ASIC.
AI-written summary · about
chapters (22)
- 0:00Introduction
- 0:34Who am I
- 2:05Overview
- 2:59Hardware Security
- 4:08Software Security
- 4:46Verilog
- 7:20Open Risk
- 8:02State Machines
- 15:18Tap States
- 15:42One Hot or Not
- 17:58ID Code Select
- 18:33Pause Dr State
- 19:10MSP430
- 22:05Amber
- 25:32HDL Verilog
- 25:49Better Lock
- 26:29Physical Vice
- 28:00Commercial Projects
- 28:39OpenRisk
- 30:03Jasper Gold
- 30:27Free copy
- 30:41Coherent denial of service
related talks
24mSystem Level Security Verification of RISC V Based SoCs
21mOpen Source IC Design and Hardware Reverse Engineering Or: How I Learned to Stop...
27mReverse Engineering Custom ASICs By Exploiting Supply-Chain Leaks
16mLost in Translation: Enabling Confused Deputy Attacks on EDA Software...
21mGlitchGlück: Enabling Software Vulnerabilities through Guided Hardware Fault Injection
30mBeyond Simple Software Debugging
45mIntegrated Circuit Offensive Security
37mIt's a Hardware Bug and I can Prove It