5 ms·

I don’t quite have the courage to physically short pins, nor the patience to slowly overclock my RAM, waiting multiple minutes for DDR5 link training each time.

I don’t quite have the courage to physically short pins, nor the patience to slowly overclock my RAM, waiting multiple minutes for DDR5 link training each time. So instead, I’m content with knowing that the memory controller is reporting that ECC is enabled. How about hitting the RAM with a warm stream of air from a hair dryer? I've seen that technique used in the past to generate errors.

willis936 3y ago
I feel like potentially reflowing BGAs on a high speed I/O PCBA you want to run continuously for a decade is riskier than simply shorting a pair of diode-protected pins. Link training can be disabled in the BIOS, which would make searching for borderline bandwidth settings a quick operation. The results would not be very repeatable, but that's not important.
- mlyle 3y ago
  > I feel like potentially reflowing BGAs on a high speed I/O PCBA y If you're trying to get chips up to something less than 100C, but instead get stuff underneath it with significant thermal mass up to above 200C, you're really messing up. Hair dryers tend to emit like 65C-70C air on their "high heat" setting (as opposed to hot air guns used for heat-shrink and reflow soldering).
- 15155 3y ago
  SAC305 solder won't reflow until >230C vapor phase. Will a hair dryer get a chip to these temps, ever?
latchkey 3y ago
Boot the OS off ram and then do something that uses a lot of ram. If the machine crashes randomly or you have a corrupted "disk", chances are it is an ECC error.
Tuna-Fish 3y ago
More sensibly, you can do some memory overclocking live on a running system, with no link training. It's not advisable for actual use, but you can use it to find the limits of your memory, or to generate errors.
fomine3 3y ago
Or buy a radioactive material on eBay?
- voxadam 3y ago
  Thoriated tungsten welding electrodes might be an option.
KirillPanov 3y ago
You should be able to use a propane barbecue lighter at short distance; those things generate stupid amounts of EMI. https://hackaday.com/2022/01/29/blast-chips-with-this-bbq-lighter-fault-injection-tool/ https://hackaday.com/2022/01/29/blast-chips-with-this-bbq-li... https://hackaday.com/tag/emfi/ https://hackaday.com/tag/emfi/
- edrxty 3y ago
  I'd be careful with EMI/EMP based testing, if it's latching up one line or flipping one bit, it's probably also doing it to a ton of lines/bits. I'm guessing here but based off my experience with such things, I'd expect it to be more likely to latch up whole busses and generally just crash the system than trigger anything ECC could report unless you had a very repeatable setup you could ramp up in a very controlled fashion. The mode of action here is you're producing a very wide band pulse but it's most strongly couple to the PCB traces long before anything within the chip itself. Guessing again but when people are using this to hack chips, they're probably just causing voltage swings on the power traces that are effectively voltage glitching the chip. The problem is you're over volting the part rather than under volting it which may cause permanent damage.
HankB99 3y ago
Would rowhammer testing reveal whether or not a system has ECC RAM? It reveals errors on my I7-4770K (not overclocked) system whereas an ancient Supermicro board (X10 era) seems to run the rowhammer test indefinitely w/out detecting errors. I suppose this won't work if newer systems have been designed not to be susceptible to rowhammer attacks. Incidentally the RAM on a Raspberry Pi 4B (and CM4) is feported to use ECC RAM, but this is not the same as discussed here. It's on die ECC and the purpose is to improve yield of the chips. ECC errors are corrected and not reported via H/W. ECC errors that cannot be corrected (I suppose) are just read out as incorrect data. I wonder if modern RAM sticks use chips with on-die ECC.
- ThePowerOfFuet 3y ago
  > I wonder if modern RAM sticks use chips with on-die ECC. DDR5 does, AFAIK, but it is not a replacement for running it 72 bits wide like previous off-die ECC systems.
  - HankB99 3y ago
    > ... not a replacement for running it 72 bits wide Agreed, but is it better than no ECC at all?
bilbyx 3y ago
How about just bringing your cell phone close to the DIMMs to trigger errors? That would be easy to do.

willis936 3y ago

I feel like potentially reflowing BGAs on a high speed I/O PCBA you want to run continuously for a decade is riskier than simply shorting a pair of diode-protected pins. Link training can be disabled in the BIOS, which would make searching for borderline bandwidth settings a quick operation. The results would not be very repeatable, but that's not important.

mlyle 3y ago
> I feel like potentially reflowing BGAs on a high speed I/O PCBA y If you're trying to get chips up to something less than 100C, but instead get stuff underneath it with significant thermal mass up to above 200C, you're really messing up. Hair dryers tend to emit like 65C-70C air on their "high heat" setting (as opposed to hot air guns used for heat-shrink and reflow soldering).
15155 3y ago
SAC305 solder won't reflow until >230C vapor phase. Will a hair dryer get a chip to these temps, ever?

latchkey 3y ago

Boot the OS off ram and then do something that uses a lot of ram. If the machine crashes randomly or you have a corrupted "disk", chances are it is an ECC error.

Tuna-Fish 3y ago

More sensibly, you can do some memory overclocking live on a running system, with no link training. It's not advisable for actual use, but you can use it to find the limits of your memory, or to generate errors.

fomine3 3y ago

Or buy a radioactive material on eBay?

voxadam 3y ago
Thoriated tungsten welding electrodes might be an option.

KirillPanov 3y ago

You should be able to use a propane barbecue lighter at short distance; those things generate stupid amounts of EMI. https://hackaday.com/2022/01/29/blast-chips-with-this-bbq-lighter-fault-injection-tool/ https://hackaday.com/2022/01/29/blast-chips-with-this-bbq-li... https://hackaday.com/tag/emfi/ https://hackaday.com/tag/emfi/

edrxty 3y ago
I'd be careful with EMI/EMP based testing, if it's latching up one line or flipping one bit, it's probably also doing it to a ton of lines/bits. I'm guessing here but based off my experience with such things, I'd expect it to be more likely to latch up whole busses and generally just crash the system than trigger anything ECC could report unless you had a very repeatable setup you could ramp up in a very controlled fashion. The mode of action here is you're producing a very wide band pulse but it's most strongly couple to the PCB traces long before anything within the chip itself. Guessing again but when people are using this to hack chips, they're probably just causing voltage swings on the power traces that are effectively voltage glitching the chip. The problem is you're over volting the part rather than under volting it which may cause permanent damage.

HankB99 3y ago

Would rowhammer testing reveal whether or not a system has ECC RAM? It reveals errors on my I7-4770K (not overclocked) system whereas an ancient Supermicro board (X10 era) seems to run the rowhammer test indefinitely w/out detecting errors. I suppose this won't work if newer systems have been designed not to be susceptible to rowhammer attacks. Incidentally the RAM on a Raspberry Pi 4B (and CM4) is feported to use ECC RAM, but this is not the same as discussed here. It's on die ECC and the purpose is to improve yield of the chips. ECC errors are corrected and not reported via H/W. ECC errors that cannot be corrected (I suppose) are just read out as incorrect data. I wonder if modern RAM sticks use chips with on-die ECC.

ThePowerOfFuet 3y ago
> I wonder if modern RAM sticks use chips with on-die ECC. DDR5 does, AFAIK, but it is not a replacement for running it 72 bits wide like previous off-die ECC systems.
- HankB99 3y ago
  > ... not a replacement for running it 72 bits wide Agreed, but is it better than no ECC at all?

bilbyx 3y ago

How about just bringing your cell phone close to the DIMMs to trigger errors? That would be easy to do.