3 ms·
The simple example in the article is demonstrated: you have a fail safe condition, not a fail open condition. Since you only need to flip one bit, unlocking the
by Kirby64 4y ago
The simple example in the article is demonstrated: you have a fail safe condition, not a fail open condition. Since you only need to flip one bit, unlocking the bootloader is trivial. If you need to flip multiple bits, in a specific pattern, this makes the challenge exponentially more difficult.
For something like the reset glitch hack on the Xbox 360, for example, they were glitching a single opcode to do the compare with the checksum. Multiple ways to defend/harden against that attack (which, likely, were implemented on the Xbox One).
- jesprenj 4y agoAs also mentioned in the article, the glitch could've affected the branching or comparison part of the code, so you may still be able to glitch a chip with the proposed solution.
- Graziano_M 4y agoAnother tactic is to run the check a bunch of times, maybe in parallel. If any of them don't match then assume locked or halt. Getting multiple glitches to each hit each check in the same way is very difficult. Literally something like if (read_flash(0xdeadbeef) != 0x1234) { count += 1; } if (read_flash(0xdeadbeef) != 0x1234) { count += 1; } ... but of course, then you have to worry about how `count` is being checked.