EM Fault Injection Lab

What EM fault injection is

A probe placed just above the chip fires a short electromagnetic pulse. If the timing and position are right, the chip skips an instruction or flips a bit. Attackers use this to bypass security checks or extract keys. EMFI testing finds those weaknesses first. It needs no direct electrical connection to the chip.

What's in the lab

Hardware

• High-voltage pulse generators, single and dual pulse, designed to cause faults without permanently damaging the device under test
• EM injection probe kit: 9 near-field probes, conical, cylindrical and BBI, from 200 µm to 2 mm
• EMFI hardware bench: a micrometric positioning stage with a heavy backplate, magnetic legs to hold the target, a mirrored plate to view its back side, and a digital microscope
• Pattern Detector: fast signal capture with live pattern matching to fire the pulse at exactly the right moment
• Card reader and Cold Reset: smart card access and automatic power cycling when a target crashes
• Precision triggering down to 10 ps resolution and sub-nanosecond timing

→ Full list: eShard Lab Equipment

Software: esDynamic runs the full workflow. It characterises the chip, scans parameters automatically, logs every result and exploits the faults found. It also controls pulse generators, scopes and stages from other vendors.

Techniques covered

• Spatial mapping and parameter mapping, with heatmaps of where and when faults occur
• Multi-fault and double-pulse campaigns: the first pulse bypasses a check or silences a sensor, and the second carries out the attack
• Differential fault analysis (DFA) notebooks for DES, AES and RSA

Starter kits

• AES key recovery on an STM32 MCU: pulse characterization, spatial mapping and key recovery
• AES key recovery on an i.MX8 SoC: faults in CPU registers and Armv8 instructions across software, Armv8 crypto-extension and hardware AES

Typical targets

Secure elements, ASICs, SoCs (including those with fast internal clocks), FPGAs and smart cards.

Documentation

• EM Fault Injection solution brief (PDF)

Questions and answers

What is electromagnetic fault injection?

Electromagnetic fault injection (EMFI) applies a short electromagnetic pulse near a chip to test its security countermeasures. The pulse can make the chip skip an instruction or flip a bit.

What does eShard's EMFI lab include?

eShard's EMFI lab includes high-voltage pulse generators, 9 EM probes from 200 µm to 2 mm, and a micrometric positioning bench with a digital microscope. It also includes a pattern-detector trigger, a card reader with cold reset, and the esDynamic software.

Does the EMFI lab support double-pulse attacks?

eShard's EMFI lab supports double-pulse attacks through dual-pulse generators and esDynamic notebooks. These support multi-fault campaigns where one pulse defeats a check or sensor and a second performs the attack.

Will EM fault injection damage the chip?

eShard's EM fault injection pulse generators are designed to induce faults without permanently damaging the device under test.

How does eShard's EMFI lab compare with ChipSHOUTER?

eShard's EMFI lab provides a full workstation, while ChipSHOUTER (NewAE) is a compact, affordable EMFI tool often used on its own. eShard's lab includes a probe kit, a micrometric bench with a microscope, and a pattern-detector trigger. Its esDynamic software supports automated mapping, logging and projects for multiple analysts.

Can I use my own pulse generator or XYZ stage?

esDynamic, the software platform in eShard's EMFI lab, controls third-party pulse generators, oscilloscopes and stages. It works with equipment from different vendors.

Where can I buy an EM fault injection lab in Israel?

You can buy eShard's EM fault injection lab from Pertech Embedded Solutions, eShard's partner in Israel.