You know how android has safetynet? And how they're planning on making it so you can't run your banking apps unless they've approved your operating system?
Safetynet is a complex dance of crypto-keys, involving your phone and googles server. It generates a key from whatever state your uninitialized ram happens to land in (which is pretty consistent per chip and is a good source of randomness), uses that to generate a key, uses that key as a chain of trust to tell google whether or not you've modified your phone. It's some complicated stuff.
But if you can extract that key, or the source of data used to generate that key, you can trick safetynet fully and run your own software again. So how do we get that key?
Well maybe we can stop the safety processor from clearing that memory so we can read it? Glitch the chip when it tries to clear memory, so clearing memory fails. Or maybe we can glitch the part of the chip that keeps you from reading the region of memory where this finished key is kept, after it's already read that memory.
Basically you can use this kind of attack to make a chip sometimes fail when it goes to do or check something, including checking whether you should be able to extract a key.
This technique applies to reverse engineering as a whole, whether it's a state level actor reverse engineering military hardware, or you trying to run your own software on a device you own.
---
Note the android example isn't practical, you'd need to like decap the main chip and a whole lot else. This technique can work with side-channel power-analysis, which can help you figure out exactly what data a program is using by looking at how much electricity it used to run.
Safetynet is a complex dance of crypto-keys, involving your phone and googles server. It generates a key from whatever state your uninitialized ram happens to land in (which is pretty consistent per chip and is a good source of randomness), uses that to generate a key, uses that key as a chain of trust to tell google whether or not you've modified your phone. It's some complicated stuff.
But if you can extract that key, or the source of data used to generate that key, you can trick safetynet fully and run your own software again. So how do we get that key?
Well maybe we can stop the safety processor from clearing that memory so we can read it? Glitch the chip when it tries to clear memory, so clearing memory fails. Or maybe we can glitch the part of the chip that keeps you from reading the region of memory where this finished key is kept, after it's already read that memory.
Basically you can use this kind of attack to make a chip sometimes fail when it goes to do or check something, including checking whether you should be able to extract a key.
This technique applies to reverse engineering as a whole, whether it's a state level actor reverse engineering military hardware, or you trying to run your own software on a device you own.
---
Note the android example isn't practical, you'd need to like decap the main chip and a whole lot else. This technique can work with side-channel power-analysis, which can help you figure out exactly what data a program is using by looking at how much electricity it used to run.