Faulty Cat

描述

Faulty Cat

A high-end electromagnetic fault injection (EMFI) tool to find vulnerabilities in microcontrollers.

What is Faulty Cat?

Faulty Cat stands as a top-tier electromagnetic fault injection (EMFI) solution. EMFI is a recognized technique employed for modifying chip behavior to undermine its security. The majority of such attacks are directed at simple microcontrollers.

The design prioritization revolves around ensuring safe performance, affordability, ease of use, and efficiency. Despite the primary focus on safety and cost-effectiveness, its performance remains remarkably impressive.

WARNING:

The plastic shield is critical for safe operation. While the output itself is isolated from the input connections, you will still easily shock yourself on the exposed high-voltage capacitor and circuitry. NEVER operate the device without the shield.

⚠️ Disclaimer ⚠️

Cirket holds no responsibility for any unauthorized use of the tool or any resulting damages. You are in charge of developing it and making sure it complies with any necessary safety standards or certifications. We assume no responsibility for what happens after that. Please only use Faulty Cat if you are creating and managing it yourself, and you completely understand all the hazards. It is not intended for use in settings like work or school, where equipment is required to adhere to safety regulations.

How does Faulty Cat work?

Many EMFI tools generate high voltages similar to a camera flash. Earlier open-source tools were effective but risky due to electric shock potential. This was due to a common design choice called “low-side switching, ” where the output is always active, posing a shock hazard.

Faulty Cat addresses this issue by isolating the high-voltage part, preventing direct electrical paths. This allows safe use of “low-side switching.” Some current still flows due to energy bursts, but it is practical enough.

Technical Differences between Faulty Cat, ChipSHOUTER, and PicoEMP

The main differences from the technical point of view:

• ChipSHOUTER uses a much more powerful high-voltage circuit and transformer (up to ~30W vs ~0.2W) that gives it almost unlimited glitch delivery, typically limited by the probe tip. The PicoEMP is slower to recover, typically ~1 to 4 seconds between glitches. Faulty Cathas a faster recovery.
• ChipSHOUTERhas a larger internal energy storage & more powerful output drivers.
• ChipSHOUTER has a controlled high-voltage setting from 150V to 500V. PicoEMP generates ~250V, and Faulty Catuses a low-power high voltage circuit using only 3xAA batteries and can generate ~200V.
• PicoEMP includes a Raspberry Pi Pico and Faulty Catuses only the RP2040 MCU.
• The operation of the Faulty Cathas been tested in the laboratory and ensures that it will cause your chip to fail, and its use is safe as long as the instructions and recommendations are followed.
• Faulty Catis similar to PicoEMP and ChipSHOUTER, but Faulty Cat is a low-cost all-in-one with a battery holder mounted on the board, making it easier to use.

Getting Starter with Faulty Cat

To start using Faulty Cat it is not necessary to upload any firmware to the board, Faulty Cat has a preload and ready-to-use firmware.

The only thing you need to start doing tests is your Faulty Cat and some microcontroller or chip that you can monitor its operation, in our case we will use a Raspberry Pi Pico board.

To demonstrate the operation of the board we upload a fairly simple sketch to our board, like an infinite counter. Then we can check what happens when Faulty Cat induces a discharge of electromagnetic pulses, will the chip of our Raspberry Pi Pico board be able to resist them?

Note: Remember to turn On the switch of the Faulty Cat.

In this case, we will use Arduino IDE, since it is a friendly interface and we can monitor the data through the serial port.