Glitching RISC-V Chips: MTVEC Corruption for Hardening ISA
Hardware security experts execute electromagnetic and voltage fault injection on RISC-V silicon, corrupting trap vectors (MTVEC) to bypass Secure Boot.
Summary
The Rising Adoption of Open-Source RISC-V Architecture
RISC-V is rapidly gaining traction across automotive, IoT, and high-performance computing, driving the need for hardware-level physical security validation.
Fault Injection and MTVEC Register Corruption
Damian Zabrocki and Alex Matrosov perform precision electromagnetic and voltage glitching against RISC-V microcontrollers during early boot execution.
Bypassing Secure Boot via Trap Vector Redirection
Corrupting the Machine Trap-Vector Base-Address (MTVEC) register redirects hardware exception handling to unprivileged code, defeating BootROM verification.
Architectural Hardening for Future RISC-V Silicon
The authors propose hardware-level glitch detection circuits, redundant execution registers, and verified BootROM architectures to secure RISC-V ISAs.
Related talks
Main Stage·36 min
Lennert Wouters
KU Leuven researcher Lennert Wouters demonstrates a custom hardware modchip that executes voltage fault injection on the SpaceX Starlink user terminal to bypass secure boot.
Main Stage·43 min
Yaniv Balmas · Lior Oppenheim
Yaniv Balmas and Lior Oppenheim demonstrate reverse engineering KVM switch firmware, subverting the 8051 microcontroller to install an undetectable, persistent hardware keylogger.
Wireless Village·33 min
Travis Goodspeed
Travis Goodspeed provides an update on the Goodwatch open-source wrist-worn RF radio hacking and packet manipulation platform.