Author: admin

Introduction to Voltage Glitching and Android Secure Boot

Voltage glitching, a potent form of fault injection, has emerged as a critical threat to the integrity of embedded systems, including Android devices. This hardware-level attack exploits transient power anomalies to induce computational errors within a processor, potentially altering execution flow or data values. For Android bootloaders, the primary goal of such an attack is to bypass the secure boot mechanism, enabling unauthorized code execution, custom firmware loading, or extraction of sensitive intellectual property and cryptographic keys.

Android’s secure boot process is a meticulously designed chain of trust, commencing from an immutable hardware root of trust and extending through various bootloader stages to the operating system kernel. Each stage cryptographically verifies the authenticity and integrity of the subsequent stage before passing control. Voltage glitching seeks to disrupt these critical verification steps, forcing the processor to misinterpret instructions or jump to unintended code paths, thereby circumventing security checks.

Understanding the Android Secure Boot Chain

A successful voltage glitching attack necessitates a deep understanding of the target’s secure boot implementation. The Android secure boot process typically involves several stages, each with specific responsibilities:

Immutable Boot ROM (iROM)

The iROM is the first code executed on an Android SoC. It is hardcoded during manufacturing and serves as the hardware root of trust. Its primary function is to initialize basic hardware and cryptographically verify the integrity and authenticity of the Primary Bootloader (PBL). Due to its immutable nature and tight integration with hardware security modules, glitching the iROM is extremely challenging but not impossible for highly sophisticated attackers.

Primary Bootloader (PBL)

Also known as the Initial Program Loader (IPL), the PBL is typically loaded from internal ROM or eMMC/UFS storage by the iROM. It’s responsible for more complex hardware initialization and verifying the Secondary Bootloader (SBL) or Little Kernel (LK). The PBL often contains crucial security logic, including public keys or hashes used for verification. This stage is a prime target for glitching as a bypass here can compromise the entire chain.

Secondary Bootloader (SBL/LK)

The SBL, often based on Qualcomm’s Little Kernel (LK) or U-Boot, is loaded and verified by the PBL. This stage performs extensive hardware configuration, initializes the display, memory, and peripherals, and most critically, verifies the integrity and authenticity of the boot.img (containing the kernel and ramdisk). The SBL’s larger codebase offers more potential targets for fault injection, particularly within its cryptographic verification routines.

boot.img Verification

This final crucial step involves the SBL cryptographically verifying the boot.img. This verification typically includes:

• Cryptographic Signature Verification: Using algorithms like RSA or ECDSA with public keys stored within the bootloader.
• Hashing: Computing a hash (e.g., SHA256) of the kernel and ramdisk to ensure integrity.
• Memory Integrity Checks: Ensuring that critical bootloader regions in RAM have not been tampered with.

These verification steps often contain conditional logic that, if glitched, can be bypassed.

Tools and Techniques for Bootloader Reverse Engineering

Before launching a physical attack, extensive reverse engineering is required to pinpoint vulnerable code sections.

Firmware Acquisition

Accessing the bootloader firmware is the first step. Methods include:

• JTAG/SWD: If debug ports are enabled, these interfaces allow direct memory reads, live debugging, and firmware dumping.
• UART: Boot logs via UART can reveal bootloader versions, memory maps, and potentially sensitive debugging information.
• eMMC/NAND Direct Access (Chip-off): Desoldering the flash memory chip and reading its contents directly using a specialized programmer. This provides a full, unencrypted firmware dump.
• Exploiting Software Vulnerabilities: Sometimes, an existing software vulnerability (e.g., in a fastboot command handler) can be leveraged to dump portions of the bootloader.

For rooted devices, a partial dump might be possible directly from the filesystem:

adb shellsu# dd if=/dev/block/platform/soc/11120000.ufs/by-name/bootloader of=/sdcard/bootloader.binexitadb pull /sdcard/bootloader.bin .

Disassembly and Static Analysis

Once acquired, the bootloader firmware is loaded into disassemblers like IDA Pro or Ghidra. These tools allow us to:

• Identify Architecture: Most Android devices use ARM or ARM64 instruction sets.
• Locate Entry Points: Determine the initial execution address and interrupt vectors.
• Map Memory Regions: Understand how code, data, and peripherals are organized.
• Identify Critical Functions: Search for cryptographic primitives (e.g., `SHA256_Init`, `RSA_verify`), memory copy functions (`memcpy`), and conditional branching instructions related to verification results. Look for patterns like `verify_signature`, `check_hash`, `authentication_status`.

A typical signature verification function might look like this in pseudocode:

int verify_boot_image_signature(unsigned char *image_ptr, unsigned int image_size, unsigned char *signature_ptr) {    unsigned char hash[32];    int ret;    // Calculate image hash    calculate_sha256(image_ptr, image_size, hash);    // Verify signature using public key    ret = rsa_verify_signature(hash, signature_ptr, public_key_struct);    if (ret == 0) { // Signature valid        return 0;    } else { // Signature invalid        return -1;    }}

Dynamic Analysis (When Possible)

If JTAG/SWD is active, dynamic analysis allows setting breakpoints, single-stepping through code, and observing register and memory states during the secure boot process. This helps confirm findings from static analysis and narrow down the exact instructions to target.

Identifying Glitch-Susceptible Code Paths

The core of a voltage glitching attack lies in identifying specific instruction sequences that, when perturbed, yield a security bypass.

Conditional Jumps and Branches

The most common targets are conditional branch instructions that control the flow based on a security check’s outcome. For example, a bootloader might have code similar to:

CMP R0, #0       ; Compare result (R0) with 0 (success)BNE signature_fail ; Branch if Not Equal (if R0 != 0, fail)BL boot_kernel   ; Call kernel boot if R0 == 0signature_fail:BL handle_error    ; Handle failure

By glitching the `BNE` (Branch if Not Equal) instruction, we aim to flip its condition, causing the processor to execute `BL boot_kernel` even if `R0` indicates a failure. Other common targets include `BEQ` (Branch if Equal), `BGT` (Branch if Greater Than), etc.

Cryptographic Comparisons and Hashes

Code sections that compare computed cryptographic hashes or decrypted signatures are also vulnerable. If the comparison operation (`memcmp` or a series of `CMP` instructions) can be glitched, it might lead to a false positive match. For instance, if an attacker can cause a single byte comparison to fail to register its difference, a spoofed hash might appear valid.

Memory Write Protections

Bootloaders often configure Memory Protection Units (MPUs) or Memory Management Units (MMUs) to protect critical code and data regions from unauthorized writes. Glitching the instructions that set up these protections could temporarily disable them, allowing an attacker to modify sensitive memory contents.

Counter Decrements/Loop Controls

While less direct for secure boot bypass, glitching loop counter decrements could allow an attacker to skip iterations of a verification loop, potentially reducing the number of bytes checked in a hash or signature verification process.

Voltage Glitching Methodology and Execution

Once potential targets are identified, the physical attack can commence.

Hardware Setup

• Glitching Board: Devices like the ChipWhisperer-Lite or custom FPGA-based rigs are used to generate precise voltage pulses.
• Target Device: The Android phone’s SoC is the target. This often requires decapsulation to expose the CPU’s power rails. Test points or power input pins (e.g., VCORE, VDDA) are ideal injection points.
• Power Supply: A stable, programmable power supply for the target device is essential.
• Oscilloscope: To monitor the voltage rail during glitch injection, ensuring the pulse is delivered as expected.

Injection Points

The CPU’s VCORE (core voltage) power rail is the most effective injection point, as it directly affects processor operation. Glitching this rail causes a momentary voltage drop, which can starve the CPU of power, leading to instruction skip, data corruption, or incorrect logic evaluation.

Parameter Tuning (Iterative Process)

Voltage glitching is a highly iterative process of tuning parameters:

• Delay: The time offset from a known event (e.g., power-on reset, bootloader UART output) to the glitch injection. This synchronization is critical for targeting specific instructions.
• Width: The duration of the voltage drop (e.g., from a few nanoseconds to several microseconds).
• Offset: For synchronous glitches, the position of the glitch pulse within a clock cycle.
• Repetitions: Some attacks benefit from multiple, closely spaced glitches.
• Amplitude: The depth of the voltage drop.

Automated platforms like ChipWhisperer provide APIs and GUIs to sweep through these parameters, automating the search for a successful glitch.

Detection of Success

Success can be observed in various ways:

• UART output showing unexpected boot messages (e.g., skipping