Laser Beams & Light Streams: Laser Fault Injection on a Budget | Trowell & PANTH13R | BSides312 2026

Okay, we've got 50 minutes. Um, and you'd think that, um, through the several times that we've done this talk and definitely not retired it, uh, we have somehow managed to get our timing down. Uh, that would be a lie. Complete absolute lie despite the several years that we've done this already. Um, so for those of you who really care about the content in the sense of like the technical details, etc., etc., Um, historically we have managed to shove 30 minutes worth of talking in five minutes. Uh, because I may have not seen the timekeeper give me the 10 minute, the 20 minute, and the 30-minute warning. So, you probably want to get a copy of

this screenshot right here because you may have questions at the end. Yeah. So, in the case that we don't get to the end with questions or we're unable to like uh have any questions or maybe we skip over some content to really get through uh the slides and the video that is those QR codes uh is a pretty good representation of everything that we typically cover plus any questions that you have. Okay, perfect. Well, thank you for attending our talk. Um to introduce ourselves, we are project Lauren. We are two of five people um who represent um a team of complete absolute nerds with too much time in our hands. Uh some of us some of

you have asked me why did we call ourselves project Laur and that is because Larry hates me. So whenever we're working on a report or project or whatever Sam's uh placeholder word for needs to be finished is Lauren. So it'll be all over the report and so she knows when things are actually finished. Now she can't get rid of it. Yes. Um, I always said that it was uh it was a bad omen that every single time for this project I typed in the word laur to figure out what we needed to finish or complete. Uh, every single slide came up because, you know, this project is never finished. And, uh, true to fashion, um, Larry promised me that

we could retire this talk last year in Germany for CCC in December. Technically said we retired at Triple C. I didn't say which year. Yeah. Uh, so I actually deleted this talk from my brain. Uh so to find out that we were coming to Chicago to do this one more time for the folks in 312 uh I was utterly thrilled uh in both the good and the bad way. Uh so we we typed into chat GBT what could LAM stand for? Uh and it was laser oscillation for retrieving electronic memory. But since then we decided to update what it stood for to well you see um some context. I promised Larry that we would rehearse last night.

Um, and I may have been on the other side of Chicago that night not rehearsing. Um, so he's quite upset with me because we ended up having to do it in the morning and he didn't really get any sleep. So he changed what Lorm stood for to lack of optimal rest equals misery. Um, and honestly I feel like I was the one who suffered because I woke up the next day and I don't know what happened to my glasses, but they are in fact broken. Um and uh so I will either be wearing an eye patch or contacts for the rest of my life. Um yeah, so there is there is some karma involved with not

rehearsing with your co-speaker. Uh but of course a little bit about me. Uh my name is Sam Bowmont or otherwise known as Panther or apparently pantheair. Now um I'm perpetually tired and known as the woman who never sleeps. Um and I hack anything that flies, sells or drives. But one specific thing about me is that I'm really bad with nouns. It doesn't matter if you're my best friend or a common household item, I will forget the name of the thing. So, after the talk, if you introduce yourself to me or even if we've met before, please continually refer to yourself in third person because I will recognize your face, but I won't remember your name,

and I'll probably go through your entire family history before I figure it out. Um [sighs] unfortunately for me, Larry now calls me version 2.0. Uh, now with more sleep, I made some major changes last year that were positive to my life. And according to my my watch that I always wear, this giant gargantuan thing on my on my wrist. Um, uh, for the last 10 years, my average sleeping cycle was 3 hours and 12 minutes over 10 years. Uh, and in [laughter] somehow still alive. Uh, that is not something to be proud of, by the way, to be extremely clear here. Being still alive. Yeah. Well, What was living then? Um, but yeah. So, uh, now since the changes, my average

sleeping cycle is six hours. So, honestly it's except for last night. Look, man, I [laughter] said I was sorry. Like, it was an accident. So, yeah, 6 hours and 8 hours, but more is still more. Um, so I am SAM or Panther version 2.0. My name is Larry Tr. I go by Patch. I had a horrible time dealing with any acronyms. I want to remember the first 80,000 times I hear it. Um, and I navigate similar to Dirk Gently from Douglas Adams series. I will follow someone and end it where I have to be. I don't know how it works, but it works. Um, we affectionately call it amongst our friend circles that Larry has the

hand of God navigation. Um, if you find him following you, just don't question it. It's probably to get him somewhere that he he doesn't even know where he's going. Um, but you'll get him there one way or another. The most famous occurrences is we were in the UK and I was trying to get to Stonehenge and I am lost and Sam's trying to find out where I am. Said, "Don't worry. I found a Chinese family. I'm gonna follow them and I'll get there." And he did somehow. I I truly do not know where it was. I I don't want to ask any questions. It might break. Um so yeah, hand overall navigation is uh is

Patch's thing to do. Uh and I mentioned we are two of five. So these are the other three individuals that contributed to the project. CA Chaz, Casey, and Curtis. Uh together we represent a team of hardware and um AI folks uh and we are project uh and special thanks to John McMaster and Dr. Matt Lley which some of you in the room may already know. Um because when we originally did this talk uh the supply chain shut down all of the acids I was using for decapulation. I can't [ __ ] speak. And some of the laser diodes were like misnomerred and mislabeled. may or may not have broken something extremely expensive and had to call a professor at

three o'clock in the morning to fix it before our talk. Uh so yeah, so um all of you guys came here to hear us talk to you about lasers. Now before we can actually do that, we have to have you read this completely legally binding document and disclaimer from OSHA specific to the United States. And don't worry, there'll be a test afterwards. Yes. Um uh but for those of you who are I see some of you are fast readers [laughter] and got to my session require more caffeine. So for those of you who can't read, there are four specific things that you need to know before you start working with lasers. The first is you can be blinded or

worse. The second is that even though the light is invisible, it can still burn you. You must wear protection, which is true for everything. And you only get two chances to protect your eyes. And I love this slide and I love [laughter] changing this because when BSI was promoting this talk, of course they posted on LinkedIn with a really nice call out, etc., etc., etc. And I'm a big believer that if you do something in social media, um, we reserve the right to use it because it's in a public domain. And of course uh we did say there is a test and some people do fail the test as we find out from a commenter

here who says you will ruin your phone camera and possibly go blind. Ask me how I know um on our talk and I went yeah I mean like that's why we spend about five minutes talking about this but because we can't demonstrate why it's so dangerous we use this slide to actually emphasize what the actual dangers are. So on your left there, you're seeing a concert as is common occurrence where people have light shows and lasers, but they're not actually calibrated properly, so they can burn out the actual men's chip in your phone. And the same thing will happen to your eyes. So if you're not very careful, what happens on the left will happen on the right to you. Yes,

you'll end up like Velma on the on the floor. Or like me this morning because my glasses were broken, but not because of lasers. Or remember guys, ask me how I know. Okay. All right. Now that we've got the safety aside, um, hands up. Who knew that laser was an acronym? And who hasn't learned in the last five times we've given this talk? The call out on stage [laughter] is crazy. Okay, so for those of you because none of us likes to show off. Um, what a lasers are and how many types they are and what they what they can be used for is out of the scope of the talk. But sometimes we like to introduce is specifically that

laser is an acronym and it stands for light amplification by stimulated emission of radiation. And yes, every single time I do this talk I have to read the slides to do that. But in English it really just means so when you actually apply enough energy to a lasing medium photons will emit in a coherent beam that can actually transfer energy. Okay. So uh why do we use lasers in things like hardware hacking or semi semiconductor um glitching? Well, it's really easy. Uh light is very easy to source. Uh transistors are very poor photo diodes but photo diodes nonetheless. Uh it's completely contactless and it's hard to damage anything although it is possible. Again the call out. Um and uh it's

typically consider it's considered a semi-invasive technique to use when you do something like hardware hacking. Um, so what do I mean when I use the word uh semi-invasive? All right, so when you're using lasers in hardware hacking, you generally have to prep the target to actually receive the las so it can do something. Um, and there are two specific ways that you can do that. The first is my favorite way. So it's called chemical decapsulation. uh you take the not fun kind of acid and you use it to etch away the layer or the casing of epoxy that covers the silicon housing that has all of the logic that you're trying to get to. So you use it

to remove that layer so it can receive the lays and be exposed to the outside elements. Second way is Larry's favorite way which is chaotic destruction or brute force. That's your sand blasting that is uh extreme heat or abrasion. And let me assure you we use proper protection and Chaz's hat is completely safe. Yes. And this is not AI because as you can see you can count every single finger there that is left that is that is in fact left. Yes. All right. So semi-invasive allows you to prep a target to receive a las once you've done that you have a laser and you have a semi-invasive way of uh of working with the target. What do you use it for in

hardware hacking? Typically it's something called laser fault injection. So laser fault injection is a method in which you create a aberration inside of the actual processing RAM. You change either making it skip an instruction or change what the bits instruction actually mean so that it doesn't do what it's supposed to do. There are three basic areas that you can target it. The first one is front side which is where you hit the top of the chip. A lot of the chips now have protection so it's harder to get to them. They're shielding for magnetic radiation and so it's harder to do that. But you can go from the back side which usually has less protection on on at least the older

chips. So there's not much shielding on the bottom of the chips. You can actually shoot through. Now there tends to be shielding on both the top and the bottom. So you have to go it through laterally and try to bounce the beam until it hits something that's actually useful to your attack. The amount of times that I've had to stop myself from saying that's what they said on this slide is very very high. Um but really in English uh laser fault injection is a really fancy way of trying to get a processor to do something like skip instructions. The reason why that's super useful is typically processors can start with something like check a password before

it enters a debug mode or some sort of security function that it needs to do. Uh fault injection or specifically the one that we're covering today which is laser fault injection can be used to make the target skip or maybe alter its function so it doesn't do what it originally intended. So that's why we have laser fault injection. Um, before we kind of go on, I like to ask the room um quite a few questions. And for those of you who may or may not have met me before, I really like puns. And that's going to be the theme of the talk if I have enough energy in my body. And you will be punished.

No. [laughter] Too much. Too much. It's too much. All right. Hands up here. Um, who here has an LFI rig in their house, home, office, or lab? Oh, look at that. They're smart. Because if you had actually raised your hand, I would have said, "Oh, the wrong button again." I would have said, "Uh, drinks are on you." Um, so LFI rigs traditionally when especially when we were doing this talk originally, um, they cost around uh, new 150,000 USD. Now, of course, 150,000 USD is a lot for a new. So, a used or decrepit system is anywhere between 5 to 20,000 USD. Now, that doesn't mean the system's actually going to work. It comes in a

state that's kind of questionable. It could work, could not. There's a lot of money to invest on something that's impossible. Maybe. Yeah. And remember when we were doing this talk, it was pre-tariff. So all of these prices now could have gone up or down, but I will bet money it's gone up, especially with the state of hardware at the moment uh with our lovely Lord and Savior AI. Um so uh there's a very special person in this crowd that knows how much I suck at doing expense reports. Um so [laughter] and some of us aren't lucky enough to try and get somebody to do it for them. Uh so instead of that uh we had to

embark on a journey. How do we how do we figure out how to do laser fault injection without having $150,000 worth of expense report to do um or $150,000 worth of money to spend because I don't know about you guys but um I'm broke. I don't I don't have that kind of money. Um so doing the rave or doing this talk was kind of our way of trying to prove that you could do LFI at home and these kind of attacks are real and do happen all the time. So one of the reasons we do this also is because every time we come up with the this may be dangerous this may be affected by laser fault injection or

something our response from our clients was that's a nation state attack no one can do that practically and our comment was yes you can. Yeah. And the other thing is is um Larry and I really believe in education and it's really hard to learn how to do these kinds of techniques with that kind of high bar. Like not all of us come from formal education. Not all of us have access to that kind of laboratory. Um and not all of us have the kind of um uh maybe like friends or family who can kind of tell us the dangers of lasers. So it's like a really high bar to get to to even learn this kind of stuff. So by lowering the

cost floor, not only are we proving that everybody can learn it, it's also Yes, I'm aware like I get it. The timing the timing is important. Um uh we lowering cost floor, not only are we proving it doesn't require a nation state to secure our hardware. Um it's also everybody can learn it and you know get better together. All right. So in order to do this and build an LFI rig ourselves, there are three specific essentials that you need to achieve in order to actually achieve laser fall injection. So the first thing is the rig has to have an imaging system so you can actually target the laser. Okay. They you well focus focus laser sorry [laughter]

they need a positioning system so you can target it. Uh and then you need a laser obviously because the lasers are cool. Everybody loves a good one. All right. Okay. So let's start with the first one. Traditional imaging systems and expensive LFI rigs are microscopes. They're used for targeting and or identify identification of the target that you are looking at. So when we were going through the research originally, we scanned a bunch of actual thesis where people actually built their own rigs. Most of them use something similar to this trinocular system which can run about $4,000 used. Okay, so that's about 4K out of pocket. [snorts] What about the positioning systems? So traditionally positioning systems are purpose-built or highly

specialized uh tables with um steppers and motors that are very very high quality to achieve the kind of um kind of resolution resolution that you needed for the positioning. um they're used for nano positioning of the target or the laser depending on the type of LFI rig you have. So while you can find cheaper units, you have to get one that's accurate nanometer and do stuff. It's still going to cost you a little bit more than just something you get off the shelf usually. So it's around $2,000. Okay. So for those of you doing math, we're around $6,000 and we haven't even touched the laser to actually achieve the laser fault injection. And 6K is a

lot for people who don't have that kind of money or andor access to that kind of stuff. Now realistically all we need is something that can house a laser, something that can focus it and something that can you that can take the target and allow us to position for laser fault injection. And now the beauty of this thing is is actually there's something that already exists. So open flexure project was an science micros microscope that was actually used to look for malaria and other bacterial infections. It's a self-positioning microscopic platform that has nanoscale resolution and is 3D printable. So basically in English using a 3D printer and things that you can buy on Amazon for around 275 USD with the

current cost of uh 3D printing filament alone. Uh you have you can both build your own microscope and positioning system. And that's you're saving around 5,000 USD alone just by printing this thing and buying it off Amazon. Um and that's that's a huge cost saving. And the only thing we have left is the laser. Now, not to make a mountain out of a whole molehill, but what makes the laser so freaking expensive? So, traditionally, laser systems in LFI rigs are highly powerful lasers that get fired at a target for extremely short amount of times. So, a type of LFI can use something called a YAG laser. And a YAG laser uses tens of milligles um in

less than 10 nanconds. So, that's a lot of things in a very small amount of time. Um, and these kind of kind kinds of lasers can cost by themselves over 35 grand. And that's just when I last looked. Sometimes it fluctuates, but 35 grand is a lot of money just for a source of light. So, when we were trying to kind of lower the cost for for building an LFI rig, we really had to figure out how to fix this problem. So there were three specific questions that we asked ourselves to get to this solution which is first how much energy is actually required from the laser to achieve uh achieve a fault or also known

as a glitch. Did we really need that much energy fired in that small amount of time? And how much time could we get away with when lasing a target? Turns out it's not as much as you think. So a lot of the recent research papers have indicated that instead of having to have milligles you do it in nanogles typically around 42 nanogles and that's reduction of 1 to e to the 6 which as you can see in blue is a big difference and you may be wondering how can it be so possible to induce a fault like that like why has nobody else done this before and that is because of the wonders of physics the photoelectric

effect so as I said earlier all transistors are pretty much photo dodes they take energy in they build up a charge and then they can change state. The trick is it doesn't matter how long it takes to get to that state. As long as you can get to between the 42 and 82 jewels in some amount of time in one clock pulse, it can cause the fault. So the trick here that we're using is we figured out that you can actually use a lowowered laser over a slightly longer amount of time to achieve the same kind of glitch that you would have done with a high-powered laser. So if we translate that into components, you could use a

low powered 2.5 watt laser that you can buy on Amazon. Uh you can fire it at a um at a target for over 25 nanconds and you can accumulate the same amount of energy required to do a fall. And if you just extend the time a little bit longer, you can use a questionably legal laser from Amazon that should be much lower, but is typically unknown. So, these we got from Amazon for $9 for two. Uh, and the reason that they are a little questionable is on our next slide. Who here remembers all the horror stories about the green laser pointers that have been happening for a number of years? Don't shoot them at helicopters.

Don't shoot them at aircraft. Don't shoot them at your friends. Well, the reason this is because they're not actually green. Ask me how I know. Forever. Basically, of the spectrum you get out of the green laser pointer, 5% of that is actually green. The other 95% is wasted going through the uh frequency doubler and is at 164. So, what you see in that bright green laser is 10 times as powerful as you think it is, which is why it can burn your eyes and harm people. Yeah. So the waste of the waste wavelength of these cheap green laser pointers is precisely what makes them so dangerous, but also precisely what makes them so useful for our stuff. So we can

take a cheap laser pointer that was definitely legally questionably magnet. It is definitely 5 m in green. Yes, the other freum may not have been tested. May yeah, may or may not should may or may not. There's a slight deviation in the power levels. Yes. All right. Okay. So uh what do we have? We have a laser pointer from Amazon. We've got a 3D printed housing and we got a couple of stepper motors that we bought on Amazon. What does that make? Well, it makes the Rave, uh, which is somewhere around this area. Yes, it's right here. What's left of it, it did not make it through the airline. Yes. Now, before we cover the Rave,

there were custom mods that were made. Very small, but enough for the Open Flexure project. So, we replaced the uh fluorescent chamber that's used for the shooting the light up to the bacteria to see how it is from under the microscope with a laser diode. We replace the filter there with a beam splitter so we can actually split the beam so we can have it go up and down into our trigger systems. And that's the main one for this. And then on the actual casing, yeah, we just remove a brace. We made one brace on the system so it has room for the actual laser to go up and down without causing any like structural issues.

Yeah. So with two minor mods to something that was made to to to look at biological cell samples in that in like in uh in areas where doctor without borders were uh we've created a laser fault injection um because open source is cool. Uh so putting it all together what is the rave and how does it work? We have an FPGA that slows the target clock enough that we can it can have the target receive the laser over that short over one clock volts. Yes. Correct. Uh we have an LED to to look at the target. We'll cover that a little bit more later. We have a green laser pointer from Amazon and we have an

objective to focus the laser. Uh I prefer pretty pictures. Um so, uh if you freshly print the rave, uh it is on the left naked. Uh Larry really wanted to censor this, but I figured we're all over. I think it'd be hilarious. Yeah. And assembled with some clothes on, it's on the right. Um if we have a target, you load it on the top, it becomes an enclosed housing. Uh if you look from underneath, you can see that that is the semi that that is the target exposed to receive a lace. Um and it will be firing up. And because Larry likes all of us and his phone camera because phones are expensive now, he replaces the laser with a blue laser

pointer for this GIF to show you that the laser fires up into the target. Uh and that is uh in total the rave. And you now have a fully enclosed laser fault injection rig that will work for your projects. Now, uh, some of you may be wondering, um, the skeptics among us, that's us all, which is everyone, um, how on earth is this possible using a 3D printer to get something from $150,000 to something under $500? And that is because the beauty of plastic is that it bends. Um so it turns out if you take the flexibility of PLA and you combine it with uh very specific stepper motors you can get an accuracy of 50 nanometers

along the X Y and Z axis or XY in our case um for the positioning table. So that's all you really need is to bend plastic just a little bit. Um, now of course because it's portable uh and you don't have a case that can go a little bit wrong and um it can in fact bend too far and break. Uh but you know for if it's on a lab bench or if you have the good thing is it takes $3 for the plastic to fix. Yes. Normally I bring the actual naked system so people work move it and work around it but it's the fact that PLA bends and it's great and it has microp

positioning for the target and that works. Now, traditionally, we go through each individual component and explain what they all do, etc., etc. for for folks, but that's where we lose about like 10 to 15 minutes worth of time individually going through those components. So, please feel free to use those QR codes you had earlier to find this slide and look at what things are. Yes. But in total, uh the housing unit that you see in front of you is the LFI or what we call a rave. Um uh that is the laser fault injection rig, which is really cool. Um but does it actually work? Now, we can't demonstrate this on stage um for several reasons. Uh one,

none of you have goggles on and I don't have a plate with me. Um so, the way that we we demonstrate this in the next video is that we have a target that had that does a series of mathematics on the IC. That's all it does. And if it receives a fault, the mathematics fails and we have an LED that indicates whether or not it did solve correctly or didn't solve correctly. not solving correctly indicates that something happened and some processing like an instruction was skipped i.e. a fault was induced. Um we do that with two two yellow LEDs. Oh god, why do I keep doing this? You think I do the same thing. Here we go.

So if you look really quickly, you'll see a red light come on. Then that green flash is the laser actually flashing. The yellow light is the first indicator that thing is being processed. And the second yellow light that'll happen about now or sometime soon right there is the glitch actually happening with the math did not add up to the expected value. So um with our testing and especially because it's been a couple years now um we have proved that uh this LFI rig does work and it it is very useful for us for specific types of use cases for hardware hacking and it's great and it's all for under $500. Um, and when we first did

this talk, we originally intended to stop there, but why stop there? Because we're a bunch of hackers. We have we have way too much time on our hands and we're just very bored and we can always do something completely different. Exact. We could, but that would make sense. Um, so we went through all the all of the effort to go through building the rig. So we figured, okay, what else could the rig do that was useful that was kind of related to the hardware hacking world? Like what if you didn't just induce faults? What if you could do things like imaging something statically or what if you could dynamically image memory and pull memory off? We wanted to

see if we could bring the affordability component to those kind of things too because static imaging is typically done through things like X-rays and dynamic imaging is uh a very very hard research topic to cover. All right, so we're about to go do something completely different. Um so let's start with uh static imaging. Now if we combine something called infrared insitu inspection of selinkan i.e iris with a rave we can achieve something like that. So first what is iris? So iris was a project Bunny hun did in 2023 in which he showed that with an IR light around 1050 nanometers you could actually see through the back of silicon. There are a number of chips

that have the silicon close to the top and he showed a bunch of videos using a microscopic rig and a modified camera where he took out the IR sensor or filter and was able to actually see through the silicon into the chip layer. We were able to do the same thing with our rig because coincidentally even though the IV IR camera that we're using the PI nor is rated to be 800 nanometer for that wavelength of light it actually go all the way to 1200 and so we have 1000 works fine. So we're able to see through some of the chip. So common LEDs that you use can come in this wavelength of 1050. Um and that's really really

useful. So um I again love pretty pictures. So uh if we do the ray plus iris visually speaking this is what you would see with your optical eye um or your actual eye of what the what what a target has which isn't really that useful. But with our invisible oh forgot yeah with our invisible light camera. Sorry this is the first time she clicked the right direction on this slide in 10 times. with an invisible light, i.e. using iris, you can actually see the circuitry within the chip without doing anything additional or an X-ray. Uh, which is super cool. Um, and if you actually pan the LED across the, uh, the chip, you can actually on top of using the open

flexures kind of like zoom in controls, you can actually look into the circuitry and actually target the laser depending on what you're looking at or having a look at the internal circuitry. And if you're not looking at this through PowerPoint, it'd be a very detailed image. Yes. Turns out it's actually possible to top out the HD requirements of PowerPoint. So this is actually a really high quality GIF with lots of detail that no one can see. So we promise you we can show you later. Uh but it's you the point here is with Iris and using the micropositioning stage that we have, you can in fact look at circuitry which is really great. Um but what does this

really mean for for people like us on the stage? Um, so, uh, when we were when we were testing out kind of Iris with the Rave, we were kind of like, oh, let's test it on something. So, in front of me, um, I had an Arduino Nano, uh, because I was decapping all the the AT mega chips. And on the other side was an FT232R because it was a serial IC for responsible for handling all of our USB connections for the Arduino. And for those of you who are good at hiding at the highly image game, you may notice some subtle differences in these two chips. Yeah. Um, so hands up. Who actually knows what the image on the right is?

No. That's good cuz we don't either. Well, no, that's the left one. All right. So, if you ordered a chip, a component, an FT232R online today, FTDI, the official OEM manufacturer of that chip, it should look like that. If you fully decapsulate it and look at the silicon, i.e. what the hardware actually looks like. That's what it's meant to look like. So, Iris allows us to do that without decapsulating the chip. And as you notice, my FT232R alternative that I have to say legally. Um, it seems to be a variant that was undisclosed at the time of our talk, um, that FTDI did not know about. Um, which really means that we were using the rave

to do things like supply chain manufacturing validation because how many of you have ordered hardware parts, done all of the firmware programming, loaded it onto your your unit, and went, why doesn't it work? Well, probably because the thing that you ordered isn't actually the thing that you ordered. So, using the Ray Plus Iris, you can actually check your own stuff. And, hey, that's really cool. Um, and the funny fact with actually these two images is when we first did the the the pan and the scan of the the FT232R, I went to Silicon Porn and a few other friends that I know that do silicon imaging and I was like, "Have you seen this thing

before?" And they were like, "No, we've literally never seen this variant before in our lives." Um, so this was pretty cool. We actually found like a new one in the wild that hadn't been documented yet. Um, so yeah, so that's static imaging. What about what if we didn't want to just look at the the chip? Uh because that doesn't really help us for things like hardware hacking. If we wanted to find secrets in the chip or anything like that, what if we wanted to pull memory out? Could we somehow be an overachiever and pull memory out using the rave? Well, in order to do something like that, it's a specific type of research called laser logic

state imaging or LLSI. So, what exactly is LFI? LLSI. Um, and why does it work? So, basically, if memory is stored on a chip, it's stored in a series of gates. Each of these gates are made up by a couple of transistors and they're put in clusters and the combination of the gates and the clusters determine if a value and sort in the binary memory is one or is zero. Um, and each of these are distinct to the chip and can be distinct to the run. So, in order to do this, you have to actually map out a target representative of your chip before the attack. But if you do that, you can build yourself a lexicon or a

map to where the binary bytes are. Hardware memory are transistors and how those gates are arranged uh represent a binary of one or a binary of zero. So literally if you were to perform an LLSI or a laser logic state image of a chip in memory in the moment, this is the kind of image that you would see which is like kind of fuzzy. If you abstract it, these are the types of gate arrangements that you would see on an NLSI image. And what that actually means to us in binary are zeros and ones. And that's how reading memory dynamically using lasers work. Now that's a little complicated. How exactly does LLSI actually achieve that?

All right. So as voltages pass through any electronic circuit in this case transistors the reflectivity and the absorption rate of silicon with light is changed. Now typically there is and you're doing hardware debugging there's a process called electrooptical frequency mapping or that you use to actually do debugging of the system and as it changes states goes across the variables will change and so the resistance the reflectivity of the silicon will change and you can map that process that does not help us try to actually remember from the chip. However, someone figured out another process called laser logic state imaging in which you don't run the process or you pause it by making the FPJ stop,

stopping the clock, doing something like that and run a ripple above the actual activation of the transistor over the electrical system around 10k to 300k and that causes an interference pattern that you can pick up with the laser by running a high power uh a highp pass filter. you can just see which areas of the chip are actually responding to that signals you're sending over like a radio wave and an AM antenna. So basically when chips think or when they process or when they change memory states from ones to zeros or zeros to ones um they release something that can be read kind of like a radio wave. Um now the problem is that's great and

everything but if I'm trying to image something I don't want it to constantly change what it's doing because I'm trying to actually figure out what it is it's doing. So you have to pause the processor. Now the problem is when you pause silicon thinking, well, how are you going to read it? So in order to do that, we basically attach it to a voltage regulator or something that can change its voltage like power and we cause something called a ripple. So some of us who aren't into hardware, it's just basically we add more power or remove more power and we create a little wave which acts like a change and that allows us to read the zeros and ones

that are frozen in time when we do the freezing without affecting the transistor state. Correct. So as I mentioned before overachieving uh because at this point we are working with hyperfoldable components to do something extremely difficult. Uh this is a really really new field of research in hardware. Um, uh, let's figure out if we can do it for under $500. Um, all right. So, just like we did with LFI, um, LLSI. Now, I'm getting the acronym. LSI needs a couple of essential techniques to be able to actually run six specifically. You need to be able to modulate the target. You need a laser that can actually go through the backside of the target far enough to actually reach the data point.

You need a sensor, so something something to read it. You need to be able to smoothly pan across the system so you know where you're hitting. Emphasis on the word smooth. uh you need to be able to reduce the noise floor and you need to be able to have a result that's actually readable by a human. Yes. So we've already actually achieved a lot of these things with the rave. So we'll start with the laser um that the Rave is using to figure out if we can use it for LLSI. So the graph that you see here is something called a reflectivity graph. When you fire light at silicon, there's a reflectivity rate of it because we need to be able to read

what we're we're firing now. So what's the reflectivity rate of silicon at certain weights? And this is the depth of how far it can penetrate in and reflect back. Correct. On the bottom. So for laser fault injection, we use 1064. And those reading or able to see the graph, you can see that 1064 is a very low reflectivity, which means it sucks for things like LLSI. So instead for LLSI, we can just swap the laser housing to something like 1300. Now some may be wondering why did we choose 1300? And the answer is because we're cheap. So 1300 is the same frequency they use for communication systems like your uh fiber optic cable systems. They make

them mass quality. They are $6 for 13. You get them on eBay pretty cheaply. And best of all, they have a photo diode built in that's supposed to measure the strength of the actual laser that's going across the system. However, we can use it for something else. So with two birds and one stone, we can get a laser and a sensor. And using something called self-mixing interferometry, because I'm the only person in this group who can say that slide, we can read and fire a laser at the same time and possibly achieve LLSI because so what happens is the laser's photo diode is supposed to be measuring how much power is being emitted to the laser. But it also

indirectly measured the reflective back of the laser at a perpendicular angle to what it strikes at. So by observing it through that photo diode and knowing what the constant voltage you're putting into that diode is, you can figure out the change in reflective latency of the gates that is hitting. So basically you measure it coming out, you measure it coming in. If you get more than you put in, something's happened. Something's happened. And you you can actually measure that. All right? Because the rave achieves literally almost everything else by swapping the housing and we put it all together. We can pause the instructions in memory. We can send the signal through the transistors i.e. the target. We just um

we just modulate the voltage of the target to create a ripple. We can fire a laser and we can see if we can read the laser beam back and see if we can achieve some sort of LLSI. So does it work? We get to fire the lasers. Anybody who's early 2000s memey and dank memes would get that joke. Um, right. So, what you see in front of you here is kind of like a like an exploded version of the rave um of us kind of mixing up the components to try and prove that it works here. So what we're doing is we use a function generator to actually send a ripple across our system and

we're trying to actually see if we can pick up the frequency that we're sending on the on the function generator here over the transistor and scope on the actual logic notcope oscilloscope there and the orange arrow is supposed to be following the FT trace but it's not but you can see it's moving across as he moves the dial here so we're actually able to track the frequency going across the actual diode at the bottom which means using affordable components it is plausible that you we can in fact read using these lasers and these components um an LLSI type of frequency in order to image data which is great. Obviously we've got a lot of problems in

here. We have to lower the signal to floor ratio etc etc to make this panning a lot more smooth. So turns out PLA has some kinks in it. Um so we're going to we're going to modify that a little bit. Uh but but the point is yeah it does actually work. Uh which is actually great. So the once you fix the signal to floor ratio and once you fix everything else, you need to be able to actually read what that laser and what that icon means. Um and the irony of using a robot to make something more human readable is not lost on me. Um now those of you who know me within the industry, you'll know that I

absolutely despise the term artificial intelligence because I think it is a hyper overused term and I am a detail orientated individual. So uh we're going to call this how it is which is we're using machine learning not chat GPT I promise. Um and we're doing statistical analysis of and using convolutional neural networks or also known as CNN's um to read data and make it human readable. Right? So how do we do this? So as I said before you have to map the chip to actual the run and the thing to be able to run it. So, we need to actually decap the chip, run the laser over it, see what the effects are with various like bits of ones and zeros, and

see if we can make a map to actually read the chip. And that can be a little complicated. So, we're going to walk you through the process. Yes. And the reason why we want to do this is because memory by itself is unique. Like every every IC that you have has a unique memory. So, even if you were to do this once, you need something that's able to do it again for the new system. So, you have to train a model to do it. It's just more it's just more effective. All right. So for the purposes of this talk we use a data set and the data set is an MSP 432 SRAM log which has 512 bits of known programmed

memory because last time we did this talk Larry said bytes and I said bits about like next five minutes and then we had to clarify that actually the word was bits that we were saying. Yes. So the image you see on the right is what an LLSI image looks like if you were to finish doing all of the panning and all of the scanning across the So it's a little hard to see but you kind of make out the bits. Can anyone see the bits in here? Yeah. So, does like there are 512 bits that you can actually see on this screen. Maybe we zoom maybe we can highlight them a little bit. Yeah. So, here I'll help you out.

Maybe we zoom in a bit. Yeah. Anyone else? Can you Can you read it? Yeah. So, it's a little hard to read still, but what we're going to do is we're going to subtract one image from another and then put it into a different color channel so it actually more visible to the eyes. Yeah. So, voila. Now, you can see where the bits are. Yeah. We don't know what they are, but we know where they are. And that's half the battle. Yeah. So you we can see where the bits are on an LSIM image doing this, but we don't understand what on earth they are. So the next step is to help the model identify exactly where those 512 bits

are stored within an image because remember we're working with a computer and not a human. It needs to figure it out. So we do this by dividing it into a search grid. Yeah, we could do this by hand, but we're not going to. So basically there's this thing where you can have conflicts inside of a neural network when trying to train it because there are areas where things will always be positive in some combination. So what we do is we lower the search area for each bit and we try to train each neural net on actual values that come across the bit we programmed it to see if any of them have a learning value which is actually

sort of high. We do this 64 times or how many squiz are in here and the ones that are higher is probably indication of where our bits are inside the memory map. Yeah. So each segment now has a number of bits. We need to know which segment actually has the bits that we're looking for and what that actually means. So how do we search through the segments? If we were going to do this manually, we would take all of the bits and change them to ones and then change one bit to something else or as the slide says everything to the complete opposite to zeros and ones and then do a cross comparison. So basically, all right, if you if you

look at the same target, right, and you've programmed every 512 bit to the binary number of one, every 512 bit, you've got 512 bits of ones, and you image that with LLSI. And then you do it again, but this time you've programmed the same memory with all ones except for one, which is a zero, or in my case, it's completely flipped on these slides because, you know, I like to keep things interesting. And you image that again. You have two LLSI images and two 512 bit states of a representation of where that one is stored somewhere. And [snorts] we need to help we use segment searching to help the model identify where that one is so it knows where that gate cluster

is for the one and zero. If you do this 512 times, you can manually map it. Or if you're really smart with math, you can figure out how to do that more efficiently. But you know what? Who needs time? We have too much time on our hands. Um now uh image-wise this is how it this is my favorite slide. All right. So you take one image you make the model select a segment you take the other image and you make the model select the same segment. You take those segments you do something called an absolute diff which means compare. If the model identifies a change in that segment, it will highlight it and therefore that means

that highlighted section is an identified location of where a one or a zero is possibly stored. You do this 512 times but not what it actually is. Yes. So once you do that 512 times, you now have to figure out which of those images is a one and which of those images are zero. And to do this in machine learning, you do something called supervised learning. Now [snorts] going through what supervised learning is is completely out of the scope of the talk but the point is with some time you can in fact the model is able to correlate what the gate representation of a one is and what the gate representation is that a five minute

that's a five that's not 50 minutes say that's five five minute warning oh my lord here we go 30 minutes in five minutes let's go in time the model is able to identify the gate representation of a one or a gate representation of a zero so those of you who are still awake at the end of these 45 minutes. Previously, you notice I use these images, which is another memories locate version of gates of 0 and one. With the new one that we were doing for the LLSI, you'll notice that this has a different image of what that versions of a one or a zero is. And that's it. So once you train the model,

you can point it at a target and go, hey, read the memory and it can do something. So we did that. So we took the images that we found on another paper that we actually use. I had sample images and we built an AI based with a training set of X number of data and then a testing set to see if you actually read the data from it and we trained it to be able to read the first eight bits of the data stream based on those images and we were able to successfully get a pretty good ratio in we had nine errors in 256 bits that we actually trained it on 264 264 which is I think around 90% accuracy

says on the slide 96 okay 96 I'm standing behind the screen so everything's backwards. It's fine. So, uh the point here is it's a really high accuracy because the data set's pretty limited. But the point here is that it is possible um and the model does work uh plus or minus and in the world of hacking even if you get 80% of the way there uh we have a good representation of what we're looking at now. So you can brute force arrest the key from that. So uh this is to generally the the end of kind of like the rave. So we've kind of done a few things. Generation one rave recap and use cases. Um, we proved

that building an LFI for less than $500 was possible. We proved that uh building an LSI using affordable components is also plausible. CNN's can be used to extract data. Uh, you can learn chip layout through imaging and do supply chain stuff. You can introduce faults uh in embedded controllers using the rave. And it's completely because I won the argument. It's portable, movable, and affordable. So, you can do this at home, but you may want a better case in a regular suitcase. Yeah. Apparently, it didn't survive the UK's um No. Or the border control. It didn't survive your Amsterdam airport. Yeah. And uh I think it's really important when you do talks like this, especially because they're

high highly um highly researched. Uh we, you know, to to to call out the research papers specifically that helped us get here because we did not do this alone. Um you can go through the slides and like really pull out all the papers if you want if you want to read them. Um because it really was like nine PhDs that we read and a whole couple other things. Um, and corrected. Yes, and corrected. Uh, don't want to talk about that. That's I need some M for that one. Some people can't do math. We lost. I uh actually, fun fact, doing this research paper, I actually got alopecia, which is stress induced bolding. Um, and I always make this joke

because I always turn to patch and I go, "You made me bold." Uh, two years ago because she got better. He made me read this research paper where I I have a mild form of OCD where I was doing the maths in my head and I was like this doesn't work. Yeah. Turns out the PhD the published PhDs math was wrong. Fact of 10. This guy over here every time I was like dude this doesn't make sense. Like nothing in my head I corrected the math and he goes like just read the paper and I'm like I have read this seven times. [laughter] I am not crazy. Yeah. Two things can also be true. Yeah. Yeah. So uh we're like honestly

miracle we're still friends but you know forged through fire. Uh but specific call outs that we do want to say is um Bunny Hongs Iris re research the open flexure project and Martin escali a specific PhD researcher who kind of like started started this whole hey it's possible to do this with silicon. Um thanks surprised us we could finish this in under 50 minutes actually. Yeah this is the first time that we figured out how to do this so uh great. Um but things that surprise because uh research isn't fun if you don't have fun. Um that laser was an acronym for me. Yeah. You know what? I'm I'm happy to to admit that. Um his

hoarding finally pays off. Um because I have time to say this story. Um when we when we had that component break and we had to call um the PhD lecturer at 3:00 in the morning, this man walks through the door holding a component like this, [laughter] okay, with all five of us in a in a lab. and he goes, "Would this work? I had this. I dreamt this in a dream." And he had a dream literally weeks ago about buying this component on Amazon and he'll need it later. This is not a joke. This is like literally a thing. And he keeps it and he doesn't know what it could be. And then Chaz is working on

it. We've broken something. And Chaz goes, "God is we really need this hyperspecific thing to amplify the signal that you can't really get anywhere." And blah blah blah. And Larry goes, "Will this work? I dreamed this." Um, and yeah, it actually did and it fixed it. So, you know what? Hoarding works. Uh, we can do this from our house. That's not hoarding. That's divine inter intervention. Divine intervention. Yes, we done. Sorry. Yes. Okay. Not all data sheets are real and we didn't kill each other. Uh but one of the things I do want to say before we end is um we did uh we did find out literally minutes before we came on stage um others were doing this

research and proved that it was wasn't a nation state thing. Others like uh Fractal had actually built their own rig in Europe for under $500 and they were commercially selling this to their clients. um and we release it at the same time and then now that there's been some time we've had other researchers and we love it uh have that have built their own versions and kind of gone further with the research and etc etc. Um graphs that don't make sense. Yeah. If anyone can read this and tell me what the it what it means like we would love color blind but I don't think that's the reason it makes no sense. Yeah. And because we don't have any time

um uh next time you'll see us it will hopefully be version 2.0 of this because he promised me I could retire this talk. Um, lasers are fun, wear protection, money's no obstacle because we don't have it. Open source is king. And for those of you who uh who really want to look at this project yourself, you can scan this QR code. It will take you to the GitHub link and not malware. I promise that's a different QR code. Yes. Yeah. [laughter] Um, and yeah, thank you for attending our talk. Yep. Remember everyone, these are cool. [applause]