PicoEMP – A low-cost Electromagnetic Fault Injection (EMFI) tool

https://github.com/newaetech/chipshouter-picoemp

56•transpute•7mo ago

Comments

dlcarrier•7mo ago

ESD protection is often overlooked in hobbyist designs. Proper shielding and routing, as well as cheap ESD protection diodes, can make a world of difference, in a products lifetime, especially in applications with inductive loads.

ranger_danger•7mo ago

Let's hope someone doesn't put on a bigger "antenna" on one of these and start frying electronics from a distance.

semi-extrinsic•7mo ago

Inverse square law to the rescue!

Jokes aside, I've always been curious how much you could accomplish in this direction by driving a microwave magnetron into a horn antenna using an old pulse forming network off ebay... Hell, even travelling wave tubes are getting affordable these days.

Kirby64•7mo ago

Even the actual chipshouter isn’t capable of doing that, really. This thing has a puny amount of power in comparison.

tinix•7mo ago

you might be surprised how much you can do with a simple spark gap.

a grill lighter or modified milty zerostat can easily inject faults, albeit more manually and less precision than one of these timed devices. but it's also an order of magnitude or two cheaper...

colechristensen•7mo ago

You can also damage parts with those things just from the EMI they radiate.

mycatisblack•7mo ago

You know those cigarette lighters with an electric spark? Start a download over wifi, press the lighter a number of times in quick succession. Wifi disconnects.

Onavo•7mo ago

The first radios were spark gap transmitters (see Hertz's famous experiment). Though to be clear, Hertz's experiment was rather unconventional as the spark gap served as both the transmitting antenna (albeit a fairly noisy one) and also as a switch. Subsequent designs utilize the spark gap only as a high voltage switch. In modern tank circuits, this "switch" is replaced with a solid state transistor (or similar type of devices).

Modern plasma antennas are much more advanced than the traditional spark gaps.

https://en.m.wikipedia.org/wiki/Plasma_antenna

amelius•7mo ago

Would this pass EMC certification?

fxtentacle•7mo ago

Are there any affordable open source projects in the opposite direction?

I’ve built a rather complex robot with Nema steppers. Now something is messing with the control board and causing the CPU to glitch. Physically apart from the robot, the CPU board works fine for weeks. It also has a completely separate power circuit with optocouplers. So my guess is that it might be the power supply or one of the motors emitting electromagnetic interference. But how would I measure that?

colechristensen•7mo ago

First step is an oscilloscope so you can actually look at what's happening on data lines.

fxtentacle•7mo ago

I have one and the power supply lines (to the glitching CPU) seem stable with minimal noise. The CPU-integrated USB2 PHY also retains its connection even during the CPU glitch. A connected Linux workstation will not log any USB connection or disconnection events. And a CDC serial connection will remain open. The power levels to the stepper driver chips also remain stable during the glitch.

So to me, it looks like the glitching happens exclusively inside the CPU. It appears that I’m randomly experiencing the exact same issue that the PicoEMP in the original article can induce.

nicman23•7mo ago

are you sure it is not just the nemas causing a under voltage situation?

fxtentacle•7mo ago

Yes.

1. Stepper and CPU use separate power supplies and are optically decoupled.

2. I’ve monitored min max voltage on the CPU caps and they are fine the entire time, even during glitches.

nicman23•7mo ago

optical decoupled uart?

fxtentacle•7mo ago

No UART at all: Control flow is through USB directly into the CPU, so the serial interface there is purely virtual. And then from CPU to stepper drivers it's Enable, Direction, and Step pins, all of them optically decoupled. The stepper drivers then have their own power supply and caps so that they can't interfere with the CPU power circuitry.

ddeck•7mo ago

Just a reminder to ensure that you have brownout detection enabled on the CPU/MCU (assuming it's available) and are checking for it in your firmware. Supply drops can be very brief.

colechristensen•7mo ago

Next steps: EMI (near field) probes for your scope.

https://www.rohde-schwarz.com/us/products/test-and-measureme...

fxtentacle•7mo ago

My scope is a SDS1204X-E and I don't believe there are any EMI probes that will work with it out of the box. The scopes that can do EMI (in addition to all the other stuff) are $5000+ which is why I was wondering if there are any more affordable single-purpose EMI measurement devices. Amazon is full with devices claiming to measure EMI, but since they usually advertise with people wearing tinfoil hats, 5G shielding burkas, and copper capes, I don't think those are useful for science.

ranger_danger•7mo ago

Can you only run one stepper at a time and see if a specific one(s) is causing the issue? Maybe it's physically closer or has a better line of sight to the CPU? Can you shield the board the CPU is on?

fxtentacle•7mo ago

In the end, I acquired an EMI probe. The DC +48V cable from power supply to spindle was emitting lots of interference. I had not really considered it because usually EMI is generated by changing voltage and in theory that line should remain at the same voltage. But it seems like tiny sparks in the spindle (or something like that) will momentarily drag down the power supply line, thereby causing HF emissions.

mdaniel•7mo ago

https://www.bunniestudios.com/blog/2023/infra-red-in-situ-ir... (and https://www.youtube.com/live/8aLW4UEuJ_c ) is related, although I don't believe it is glitch specific but the positioning machinery seems like what you're after

BitBangingBytes•7mo ago

I used this to EMP pulse a locked processor to gain access and extract flash memory from it.

Gave a talk at hardwear.io this year on it. YouTube live stream here: https://youtube.com/live/0tkdst3JE0g

Study confirms experience beats youthful enthusiasm

The Big Hunger by Walter J Miller, Jr. (1952)

The Genus Amanita

We have broken SHA-1 in practice

Ask HN: Was my first management job bad, or is this what management is like?

Ask HN: How to Reduce Time Spent Crimping?

KV Cache Transform Coding for Compact Storage in LLM Inference

A quantitative, multimodal wearable bioelectronic device for stress assessment

Why Big Tech Is Throwing Cash into India in Quest for AI Supremacy

How to shoot yourself in the foot – 2026 edition

Eight More Months of Agents

From Human Thought to Machine Coordination

The new X API pricing must be a joke

Show HN: RMA Dashboard fast SAST results for monorepos (SARIF and triage)

Show HN: Source code graphRAG for Java/Kotlin development based on jQAssistant

Python Only Has One Real Competitor

Tmux to Zellij (and Back)

Ask HN: How are you using specialized agents to accelerate your work?

Passing user_id through 6 services? OTel Baggage fixes this

DavMail Pop/IMAP/SMTP/Caldav/Carddav/LDAP Exchange Gateway

Visual data modelling in the browser (open source)

Show HN: Tharos – CLI to find and autofix security bugs using local LLMs

Oddly Simple GUI Programs

The New Playbook for Leaders [pdf]

Interactive Unboxing of J Dilla's Donuts

OneCourt helps blind and low-vision fans to track Super Bowl live

Rudolf Vrba

Autism Incidence in Girls and Boys May Be Nearly Equal, Study Suggests

Wellness Hotels Discovery Application

NASA delays moon rocket launch by a month after fuel leaks during test

Study confirms experience beats youthful enthusiasm

The Big Hunger by Walter J Miller, Jr. (1952)

The Genus Amanita

We have broken SHA-1 in practice

Ask HN: Was my first management job bad, or is this what management is like?

Ask HN: How to Reduce Time Spent Crimping?

KV Cache Transform Coding for Compact Storage in LLM Inference

A quantitative, multimodal wearable bioelectronic device for stress assessment

Why Big Tech Is Throwing Cash into India in Quest for AI Supremacy

How to shoot yourself in the foot – 2026 edition

Eight More Months of Agents

From Human Thought to Machine Coordination

The new X API pricing must be a joke

Show HN: RMA Dashboard fast SAST results for monorepos (SARIF and triage)

Show HN: Source code graphRAG for Java/Kotlin development based on jQAssistant

Python Only Has One Real Competitor

Tmux to Zellij (and Back)

Ask HN: How are you using specialized agents to accelerate your work?

Passing user_id through 6 services? OTel Baggage fixes this

DavMail Pop/IMAP/SMTP/Caldav/Carddav/LDAP Exchange Gateway

Visual data modelling in the browser (open source)

Show HN: Tharos – CLI to find and autofix security bugs using local LLMs

Oddly Simple GUI Programs

The New Playbook for Leaders [pdf]

Interactive Unboxing of J Dilla's Donuts

OneCourt helps blind and low-vision fans to track Super Bowl live

Rudolf Vrba

Autism Incidence in Girls and Boys May Be Nearly Equal, Study Suggests

Wellness Hotels Discovery Application

NASA delays moon rocket launch by a month after fuel leaks during test

PicoEMP – A low-cost Electromagnetic Fault Injection (EMFI) tool

Comments