Supercharging the PicoEMP with Surplus High-Voltage Supplies

Supercharging the PicoEMP with Surplus High-Voltage Supplies

Speakers: Hash Salehi, Founder & CEO, RECESSIM

Conference: Hardwear.io USA

YouTube: https://www.youtube.com/watch?v=HpLNbTx07ZM

Overview

This talk, presented by Hash Salehi, Founder & CEO of RECESSIM, delves into a groundbreaking method for significantly enhancing the capabilities of the PicoEMP, a popular, low-cost open-source tool for electromagnetic fault injection (EMFI). Salehi's work addresses critical limitations of the stock PicoEMP, primarily its slow pulse rate of one glitch per second and its voltage cap of approximately 250 volts. By leveraging surplus, readily available high-voltage power supplies, he demonstrates how to dramatically increase both the pulse rate (up to 1000 pulses per second) and the effective voltage (to 500 volts and beyond), effectively bridging the substantial gap between hobbyist-grade tools and professional, high-end equipment like the $5,000 ChipShouter.

The motivation behind this research stems from Salehi's prior experience extracting firmware from an automotive ECU using a stock PicoEMP, an endeavor he describes as "the great suffering" due to the hardware's inherent limitations. His current work not only showcases a practical, cost-effective upgrade path for the PicoEMP but also includes the detailed reverse engineering of the surplus power supplies to enable programmatic control. This initiative is poised to democratize access to advanced hardware security research, empowering a wider community of researchers and hobbyists to perform complex fault injection attacks that were previously exclusive to well-funded academic institutions or nation-state actors. The talk emphasizes that access to better tooling directly translates to the ability to conduct more interesting and impactful security research.

Background

▶ Watch: Introducing PicoEMP limitations and project goals (0:00)

Hash Salehi’s journey into supercharging the PicoEMP began with a deeply challenging project he undertook the previous year: extracting firmware from an MPC 5566 automotive chip using the stock PicoEMP. This effort aimed to replicate findings from Colin Flynn's seminal paper, "BAM BAM." While successful, the experience highlighted the severe shortcomings of the PicoEMP. Its operational speed of merely one pulse per second rendered the process incredibly time-consuming, especially when compared to the hundreds of thousands of attacks often required to find useful vulnerabilities, as noted by other researchers like Yasper. Furthermore, Salehi was "hyperfocused" on a critical voltage value of 444 volts mentioned in Flynn's paper, a level significantly higher than the PicoEMP's native 250-volt maximum.

The market for EMFI tools presents a stark dichotomy: on one end, there's the $50 PicoEMP, which Salehi candidly refers to as a "toy" for serious work; on the other, professional tools like the ChipShouter command price tags upwards of $5,000. The ChipShouter, with its 30-watt power supply, offers vastly superior performance, including orders of magnitude higher pulse rates, cleaner pulse quality, and integrated oscilloscope outputs for detailed analysis. This immense gap—no viable mid-range option—became Salehi's primary target for innovation.

His breakthrough came serendipitously when he discovered electrophoresis power supplies on eBay. These devices, designed for laboratory use, can deliver up to 3,000 volts at 400 watts and were available for as little as $70. This presented a tantalizing opportunity to overcome the PicoEMP's voltage and power limitations at a fraction of the cost of commercial EMFI tools. The core idea was to bypass the PicoEMP’s internal high-voltage generation circuit and directly feed power from these surplus supplies into its coil driver. This approach promised to transform the PicoEMP from a slow, low-power device into a formidable fault injection platform, dramatically increasing the efficiency and scope of hardware security research for a broader audience.

Key Findings

▶ Watch: ChipShouter comparison and PicoEMP's 'incredibly long' pulse (6:00)

The central discovery of this work is that surplus electrophoresis power supplies can be effectively repurposed to supercharge the PicoEMP, transforming it from a rudimentary fault injection tool into a high-performance platform capable of advanced attacks. Salehi successfully demonstrated that by integrating a $70 power supply, the PicoEMP's pulse rate could be increased from one pulse per second to 1,000 pulses per second, representing a 1,000x improvement. Concurrently, the operational voltage was boosted from the stock 250V to 500V, directly addressing the previous limitation that prevented replication of higher-voltage attacks like those mentioned in the BAM BAM paper (e.g., the 444V target).

A critical initial hurdle involved the electrophoresis power supplies' inherent safety mechanisms, which cause them to trip into an error state when encountering a low-resistance load, such as the PicoEMP's coil. Salehi's ingenious solution involved internally bypassing the load-checking circuit board within the power supply and adding a small resistive load, allowing for stable operation. Furthermore, to enable dynamic control of the voltage—a crucial parameter in fault injection campaigns—he reverse-engineered the internal digital communication protocol of the 1989-era Motorola 68000-based power supply. By using a logic analyzer, he deciphered the 12-bit DAC (Digital-to-Analog Converter) control signal, which allowed for precise voltage adjustments through a custom Raspberry Pi Pico interface.

The "supercharged" PicoEMP now produces significantly cleaner and narrower pulses compared to the stock version, approaching the quality of pulses from a professional ChipShouter. While operating at such high rates and voltages, thermal management became a concern, with the PicoEMP's MOSFET reaching 140°C without active cooling. The addition of a small fan proved sufficient to maintain stable temperatures during sustained high-frequency operation. These findings collectively demonstrate a practical, low-cost pathway to significantly enhance EMFI capabilities, making advanced hardware attacks more accessible to researchers and hobbyists, effectively filling the market gap between cheap toys and expensive professional tools.

Technical Deep Dive

▶ Watch: Bypassing the high-voltage power supply's safety checks (9:30)

The core technical challenge was to overcome the inherent limitations of the PicoEMP while maintaining a low cost. The stock PicoEMP generates its high voltage using a MOSFET and a capacitor, rated at 650V and 630V respectively. However, its internal charging circuit limits the output to about 250V and a slow pulse rate of 1 Hz. Salehi's approach was to bypass this internal generation and feed an external, higher-voltage supply directly into the coil driver.

The chosen external supply was a surplus electrophoresis power supply, specifically models like the 3000XI, capable of 3,000V at 400W. These supplies, however, are designed for resistive loads and trip when connected to the inductive, low-resistance coil of the PicoEMP. Salehi discovered that by opening the power supply and identifying the internal board responsible for load checking, he could bypass this protection. Connecting directly to the high-voltage output stage after the load-sensing circuit, and incorporating a small resistor (to provide a minimal load for the power supply's initial startup), allowed the supply to operate without tripping.

To rigorously test and validate the modified PicoEMP, a sophisticated setup was employed:

1. Function Generator: Used to define the desired pulse rate (e.g., 100 Hz, 1000 Hz).
2. ChipWhisperer: This tool, already common in fault injection labs, was used to convert the function generator's square wave into very fine, narrow pulses (e.g., 60-nanosecond width) suitable for triggering the PicoEMP's high-voltage pulse input.
3. Modified PicoEMP: The unit under test, now fed by the external electrophoresis power supply.
4. H-field Probe: Placed near the PicoEMP's coil to measure the electromagnetic pulse energy.
5. Oscilloscope: Connected to the H-field probe (via attenuators to prevent overload) to visualize the pulse shape, width, and quality. A separate analog voltage meter was used to monitor the voltage at the PicoEMP itself, ensuring it remained stable between pulses.

Initial tests demonstrated remarkable success. At 250V and 100 pulses per second, the output pulse remained "clean" and stable. Pushing to 500V at 100 pulses per second also yielded clean pulses. However, scaling up to 500V at 1,000 pulses per second revealed a significant thermal challenge. The PicoEMP's MOSFET, lacking any dedicated thermal design or heatsinking, reached 140°C. A small, low-speed fan was necessary to prevent thermal runaway and allow sustained operation at this extreme rate.

A critical aspect of effective fault injection is the ability to programmatically control voltage. The surplus electrophoresis power supplies, being decades old (e.g., from 1989), lacked modern interfaces like USB or serial. Salehi embarked on reverse engineering its internal control mechanism. He identified a Motorola 68000-based microcontroller communicating with the high-voltage section via opto-couplers. By building a custom interposer board and using a logic analyzer, he captured the communication signals between the internal computer and the high-voltage board.

The key signal identified was a 12-bit data stream controlling a Digital-to-Analog Converter (DAC), which in turn set the output voltage. The protocol involved a clock line and a data line, with "odd pulse-like spacing" in the clock, likely due to the timing characteristics of the vintage Motorola chip. This 12-bit DAC allowed for 4096 distinct voltage levels, translating to approximately 0.7 volts per DAC value increment across the 3,000V range.

To implement programmatic control, Salehi integrated a Raspberry Pi Pico (which was already part of the stock PicoEMP design) to replace the original power supply's control board. He developed a small interface board to connect to the opto-couplers, incorporating necessary pull-up resistors and series resistance. Leveraging modern AI tools, specifically Claude, he described the required signal timing and protocol, and Claude generated the PIO (Programmable I/O) control loop code for the Raspberry Pi Pico. This custom firmware allows users to set and read back the voltage. A simple calibration procedure, involving a few measurements of DAC values vs. observed voltages, enables the system to build a lookup table and interpolate any desired voltage accurately.

The final cost breakdown is impressive: a $50 PicoEMP, a $70-$150 electrophoresis power supply (allowing for price increases post-talk), and minimal additional components (wires, resistors, capacitors, fan) bringing the total under $250. While Salehi acknowledges that this setup doesn't fully replace a ChipShouter due to its superior pulse control, thermal design, and multi-glitch chain capabilities, it offers an "epic" level of performance for hobbyists and a powerful "second rig" for professionals. The ability to measure and understand the output pulses via oscilloscope outputs, a feature easily added with a few resistors, is highlighted as crucial for moving from "guessing what you're doing" to truly profiling and understanding EMFI attacks.

Demo / Proof of Concept

▶ Watch: Reverse engineering serial protocol for voltage control (16:00)

Hash Salehi's talk included several compelling demonstrations that visually and quantitatively proved the efficacy of his supercharged PicoEMP. The core of the proof of concept revolved around showcasing the device's enhanced pulse rate and voltage capabilities, alongside the improved quality of the generated electromagnetic pulses.

Initially, Salehi demonstrated the modified PicoEMP operating at 250 volts and 100 pulses per second. An oscilloscope trace, capturing the output via an H-field probe, clearly showed a clean, consistent pulse shape. The green line on the oscilloscope, monitoring the voltage at the PicoEMP itself, confirmed that the external power supply was able to quickly recharge the capacitor bank, maintaining the target voltage even at this increased repetition rate.

Pushing the limits further, a key demonstration involved running the PicoEMP at 500 volts and an astounding 1,000 pulses per second. At this point, a thermal camera was introduced, revealing the MOSFET on the PicoEMP board reaching 140°C. This visual evidence highlighted the thermal stress on the unmodified board and underscored the necessity of active cooling. A small, low-speed fan was shown to effectively manage this heat, allowing the device to run continuously for extended periods (demonstrated for over 24 minutes) without thermal runaway. The oscilloscope again confirmed a clean, stable pulse output even under these demanding conditions, contrasting sharply with the "incredibly long" and "crazy pulse" with a "freaking tail" produced by a stock PicoEMP.

A crucial part of the demo involved the newly implemented programmatic voltage control. Salehi showed how the Raspberry Pi Pico, now running his custom firmware, could set the voltage on the electrophoresis power supply. This eliminated the need for manual, physical adjustments on the vintage power supply, demonstrating a user-friendly interface for critical fault injection parameter tuning, akin to the control offered by high-end tools.

Finally, the talk presented a direct visual comparison of pulse quality across three scenarios: the stock PicoEMP, the supercharged PicoEMP, and a professional ChipShouter. The stock PicoEMP's pulse was depicted as broad and irregular. The supercharged version showed a significantly narrower and cleaner pulse, closely approaching the ideal 60-80 nanosecond width targeted. The ChipShouter, however, delivered the cleanest and most precise pulse, even capable of sustained operation beyond 5,000 pulses per second and multiple pulses within a very short timeframe (e.g., 20 microseconds apart for a 60ns pulse), a capability still beyond the supercharged PicoEMP due to capacitor recharge limitations. These visual comparisons effectively conveyed the substantial improvements achieved while also realistically setting expectations regarding the remaining differences with top-tier commercial tools.

Defensive Implications

▶ Watch: Envisioning the 'ultimate' low-cost, high-performance fault injection platform (25:00)

The work presented by Hash Salehi carries significant implications for hardware defenders, primarily by democratizing access to powerful electromagnetic fault injection (EMFI) capabilities. What was once the domain of highly funded research labs or nation-state actors, requiring expensive specialized equipment like the $5,000 ChipShouter, can now be achieved with a sub-$250 setup. This shift means that a broader range of attackers, from hobbyists to small research teams, can now perform sophisticated hardware attacks with significantly higher success rates and reduced time investment.

Defenders must re-evaluate their threat models to account for this increased accessibility. Devices previously considered secure against EMFI due to the perceived high cost and complexity of the attack vector may now be vulnerable to a wider audience. This necessitates a renewed focus on designing hardware with robust fault tolerance and resilience against electromagnetic interference.

Specific defensive considerations include:

1. Enhanced Physical Security: While EMFI is a non-invasive attack, it still requires close proximity to the target chip. Physical tamper detection and robust packaging remain crucial to detect attempts at placing EMFI coils.
2. Increased Redundancy and Error Detection: Implementations of critical operations should incorporate redundancy, such as dual-rail logic or triple modular redundancy (TMR), to detect and correct single-event upsets caused by EMFI. Robust error detection codes (ECC) for memory and data paths can help identify corrupted data.
3. Voltage and Clock Glitch Detection: Circuits should actively monitor supply voltage and clock signals for anomalies. Sudden drops or spikes in voltage, or unexpected clock jitter, could indicate a fault injection attempt, triggering defensive responses like system resets or secure shutdowns.
4. Thermal Design for Resilience: The demonstration highlighted the thermal stress on the PicoEMP's MOSFET at high pulse rates. Attackers might leverage this by intentionally heating components to induce thermal stress-related faults, or by exploiting existing thermal vulnerabilities in device design. Defenders should ensure robust thermal management for critical components, not just for operational stability but also as a countermeasure against thermal-based fault injection.
5. Secure Boot and Firmware Integrity: EMFI is often used to bypass secure boot mechanisms or extract firmware. Devices must employ strong cryptographic verification of all boot stages and firmware, with robust rollback protection. Any detected fault during boot or firmware execution should lead to a secure reset or bricking.
6. Randomization and Diversity: Introducing randomness in execution timing or memory layout can make fault injection more difficult, as attackers rely on precise timing and location to induce specific faults.
7. Multi-Glitch Attack Awareness: The supercharged PicoEMP, while not matching the ChipShouter's multi-glitch chain capabilities, significantly increases the rate of single-pulse attacks. Defenders should consider the cumulative effect of repeated, high-frequency glitches, which could still lead to exploitable states even if individual glitches are less precise. Professional tools, as noted, can perform multi-glitch chains (e.g., multiple pulses within 20 microseconds), which can target complex multi-step operations.
8. Proactive Research and Testing: Hardware manufacturers and security teams should proactively invest in internal EMFI testing using readily available tools like the supercharged PicoEMP to identify and mitigate vulnerabilities before they are exploited in the wild.

In essence, Salehi's work serves as a loud warning: the barrier to entry for effective hardware fault injection has significantly lowered. This demands a corresponding uplift in defensive strategies, moving beyond theoretical threat models to practical, cost-effective countermeasures against accessible, high-performance EMFI tools.

Key Takeaways

• Democratization of Advanced Fault Injection: The project drastically lowers the financial barrier to entry for effective electromagnetic fault injection, making advanced hardware attacks accessible to hobbyists and smaller research teams for under $250.
• Massive Performance Boost for PicoEMP: The stock PicoEMP, limited to 1 pulse per second and 250V, can be supercharged to achieve 1,000 pulses per second and 500V, a 1,000x improvement in pulse rate.
• Surplus Electrophoresis Power Supplies are Game-Changers: Inexpensive, high-voltage, high-wattage electrophoresis power supplies (e.g., $70 for 3000V/400W) are the key enabling component, providing the necessary power for high-performance EMFI.
• Reverse Engineering Enables Control: Programmatic control of vintage power supplies is achievable through reverse engineering their internal communication protocols (e.g., 12-bit DAC control via logic analyzer and Raspberry Pi Pico), allowing for precise voltage tuning.
• Thermal Management is Crucial: Pushing the PicoEMP to high pulse rates and voltages (e.g., 1000 PPS at 500V) generates significant heat (up to 140°C on the MOSFET), necessitating active cooling solutions like a small fan.
• Not a ChipShouter Replacement, But a Powerful Alternative: While the supercharged PicoEMP offers incredible value, it still doesn't match the ChipShouter's superior pulse control, thermal design, and ability to execute rapid multi-glitch chains, serving instead as an "epic" hobbyist tool or a robust "second rig" for professionals.

About the Speaker(s)

Hash Salehi is the Founder and CEO of RECESSIM. He is a passionate advocate for sharing reverse engineering tools and techniques, aiming to increase the number of individuals capable of performing sophisticated hardware attacks. He maintains a popular YouTube channel, a wiki, and a Discord server where he publishes his reverse engineering work, particularly focusing on smart meters and, more recently, automotive systems. Salehi's motivation is deeply rooted in the belief that access to better tooling is a critical differentiator between highly funded academic or nation-state actors and independent researchers, and by democratizing access to such tools, more interesting and impactful security research can be conducted. His personal experience with the "great suffering" of using suboptimal hardware fueled his drive to find cost-effective solutions for advanced fault injection.