Faulty Cat

Firmware and host tools have moved

This repository now holds the hardware design only. The firmware (v2, a from-scratch rewrite for the existing FaultyCat v2.x hardware) has moved to FaultyCat-Firmware, and the Python host CLI/TUI (faultycmd) has moved to faultycat-TUI. See the Firmware Repository and Python Tools Repository sections below.

Faulty Cat is a low-cost Electromagnetic Fault Injection (EMFI) tool, designed specifically for self-study and hobbiest research.

Also available at distributors:

Faulty Cat is a high-end Electromagnetic Fault Injection (EMFI) tool a remix of the project ChipSHOUTER PicoEMP design optimization focused in rough order on (1) safe operation, (2) high performance, (3) usability, and finally (4) cost. This results in a tool that covers many use-cases, but may be overkill (and expensive) for many.

How the glitching works. Firmware v3 ships two physical fault-injection techniques — EMFI (electromagnetic) and Crowbar (voltage glitching) — each available as direct single-shot fires or as parameter-swept Campaigns. For the full breakdown of what each engine does, the parameter matrix that differentiates them, and how the four combinations are driven from the host tool, see docs/GLITCHING.md in the firmware repository.

We have created this project in KiCad and looking for alternatives to some components, we have left aside the Raspberry Pico board to use the RP2040 directly in the design. Tested in our laboratory before going on sale, even so, it is a product that must be handled with care, read the instructions for use.

Please only use Faulty Cat when you have purchased it from us and control it yourself, with full knowledge of the operation and risks. It is not designed for use in professional or educational environments, where tools are expected to meet safety certifications.

IMPORTANT: The plastic shield is critical for safe operation. While the output itself is isolated from the input connections, you will still easily shock yourself on the exposed high-voltage capacitor and circuitry. NEVER operate the device without the shield.

As an open-source project and as a remix of the project ChipSHOUTER PicoEMP, it also collects inputs from various community members, and welcomes your contributions!

NEW FEATURES AVAILABLE ON V2.1⚡😼

• Voltage glitching.
• Trigger using dedicated pins, available in the new pinout.
• Trigger voltage reference, for more accurate response every time a voltage glitch is attempted to be sent.
• Analog input to monitor the target device’s status during the glitching process.
• JTAG/SWD scanner. (Firmware v3.0 status: scan swd is the only scanner verb publicly exposed. JTAG scan, direct JTAG verbs, and direct SWD verbs are gated as WIP for v3.1 — see docs/JTAG_INTERNALS.md in the firmware repository for the details.)

Two attack engines (EMFI and Crowbar)

Firmware v3 exposes two physical fault-injection techniques (EMFI and Crowbar voltage glitching) and two operational modes (direct single-shot fires and Campaign parameter sweeps over delay/width/ power). They compose freely — both engines work in both modes. The full matrix, wire-protocol routing, and host-CLI map live in docs/GLITCHING.md in the firmware repository.

Thanks / Contributors

Faulty Cat based in PicoEMP is a community-focused project, with major contributions from:

• Colin O'Flynn (original HW design, simple Python demo)
• stacksmashing (C firmware for full PIO feature set)
• Lennert Wouters (C improvements, first real demo)
• @nilswiersma (Triggering/C improvements)

Firmware Repository

The FaultyCat firmware has been moved to a different repository, to have a better version control, and issue tracking you will find it here:

https://github.com/ElectronicCats/FaultyCat-Firmware

That repository covers building and flashing the firmware (BOOTSEL button and magic-baud remote BOOTSEL paths), the release scheme, and the full architecture / safety / glitching-engine documentation (docs/ARCHITECTURE.md, docs/SAFETY.md, docs/GLITCHING.md, docs/JTAG_INTERNALS.md, docs/RELEASES.md, etc.).

Python Tools Repository

The faultycmd host CLI/TUI has been moved to a different repository, to have a better version control, and issue tracking you will find it here:

https://github.com/ElectronicCats/faultycat-TUI/

That repository covers installing and using faultycmd (venv setup on Linux, Windows, macOS, hotkeys, trigger polarity, trigger timeout).

Useful References

If you don't know where to start with Electromagnetic Fault Injection (EMFI), you may find a couple of chapters of the Hardware Hacking Handbook useful.

You can see a demo of PicoEMP being used on a real attack in this TI CC SimpleLink attack demo.

WARNING: The high voltage will be applied across the SMA connector. If an injection tip (coil) is present, it will absorb most of the power. If you leave the SMA connector open, you will present a high voltage pulse across this SMA and could shock yourself. Do NOT touch the output SMA tip as a general "best practice", and treat the output as if it has a high voltage present.

How to contribute

Contributions are welcome!

Please read the document Contribution Manual which will show you how to contribute your changes to the project.

✨ Thanks to all our contributors! ✨

See Electronic Cats CLA for more information.

See the community code of conduct for a vision of the community we want to build and what we expect from it.

License

This project FaultyCat is adapted from ChipSHOUTER PicoEMP by Colin O'Flynn is licensed under CC BY-SA 3.0, "FaultyCat" contains modifications such as: porting the project to Kicad, modifying BOM and dimensions is licensed under CC BY-SA 3.0 by ElectronicCats.

Electronic Cats invests time and resources in providing this open-source design. Please support Electronic Cats and open-source hardware by purchasing products from Electronic Cats!