From 25M instructions to one faulty skip: fault analysis of a secure boot
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
An eshard blog post describes an AI agent (Claude Opus 4.8) analysing a secure boot ROM of an ARM router SoC, using emulation and time-travel tracing to find that skipping one 2-byte instruction turns a rejected, tampered BL2 into an accepted one.