Home
The Faulty Cat is a high-end electromagnetic fault injection (EMFI) tool. EMFI is a well-known method used to alter a chip's behavior in order to compromise its security. Most of these attacks are conducted against basic microcontrollers.
Its design optimization is centered on, roughly speaking: safe operation, cost, usability, and performance. Despite the emphasis on safety and affordability, it functions surprisingly well.
Faulty Cat is powered by a Raspberry RP2040 MCU, running two ARM Cortex M0+ cores at 133MHz; energized, and re-programmed via USB. Out-of-the-box, the board can use 3 external AA alkaline batteries (1.5V) as a power supply and is ready for glitching by just using two buttons: ARMING (to charge energy, up to 240V) and PULSE (to discharge and execute the glitch).
Moreover, glitching sequences can be customized by the end user, according to their necessities. An external trigger using the designated GPIO pins can execute the discharge instead of the PULSE button. This board is compatible with MicroPython and can run Python scripts.
For advanced testing, two tools are available: FaultyCMD and the Serial interface. Both help change operation parameters such as: pulse time, pulse power, and pulse count.
- Voltage glitching.
- Trigger using dedicated pins, available in the new pinout.
- Trigger voltage reference, for more accurate response every time a voltage glitch is attempted to be sent.
- Analog input to monitor the target device’s status during the glitching process.
- JTAG/SWD Scanner.
Warning
This board has a HIGH VOLTAGE section. The plastic shield is critical for safe operation. While the output itself is isolated from the input connections, you will still easily shock yourself on the exposed high-voltage capacitor and circuitry. NEVER operate the device without the shield.
Important
The microcontroller on this board runs at 3.3V, which means that you must never apply more than 3.3V to its Digital I/O pins.
| Board | |||
|---|---|---|---|
| Name | Faulty Cat | ||
| Microcontroller | |||
| RP2040 | |||
| USB connector | |||
| USB-C | |||
| Pins | |||
| High Voltage LED Pin | 9 | ||
| Status LED Pin | 10 | ||
| Charged LED Pin | 27 | ||
| JTAG/SWD pins | 8 (GP0 - GP7) | ||
| Trigger Input | 2 pins, same channel | ||
| Trigger Voltage Reference | 2 pins, same channel | ||
| Voltage Glitch Output | 2 pins, same channel | ||
| Analog Input | 2 pins, same channel | ||
| Power | |||
| High Voltage | ~240V | ||
| I/O Voltage | 3.3V | ||
| Supported battery | Alkaline, 1.5V, 3 pieces | ||
| Battery connector | J6 pin connector | ||
| Clock speed | |||
| Main Processor | RP2040 dual-core ARM Cortex M0+, 133 MHz | ||
| Memory | |||
| RP2040 | 264kB on-chip SRAM | ||
| W25Q16JV | 16M-bit Flash | ||
| Dimensions | |||
| Width | 51.32 mm | ||
| Length | 134.62 mm | ||
| Schematics |
Thank you for reading our Wiki!