Type “fault injection” into a search bar and most of what comes back is conference slides and research papers, not store pages. People look this up to understand an attack before they ever buy hardware for it — and that’s exactly how we ended up building a tool for it ourselves.
What is fault injection?
Fault injection means deliberately disturbing a running chip — a jolt of electromagnetic energy, a quick short on its power line — to see whether it skips an instruction, crashes, or takes a wrong branch it shouldn’t. Researchers use it to check whether a microcontroller actually enforces what its datasheet promises, like a locked bootloader.
That’s the whole idea: break the chip’s timing on purpose, on hardware you own or are allowed to test, and watch what breaks with it.
What does a fault injection tool actually do?
A fault injection tool like our own Faulty Cat gives you two separate ways to cause that disturbance, plus a way to automate the search for the setting that works.
- Electromagnetic fault injection (EMFI) charges a capacitor to around 250 volts and discharges it into a coil you hold near the chip, fast enough to glitch a single instruction without opening the board.
- Voltage glitching — we call it Crowbar — briefly shorts the chip’s own power line to ground instead. It’s roughly a thousand times faster than EMFI, and skips the high-voltage capacitor entirely.
Either technique can fire once (Direct mode) or sweep through hundreds of timing and power combinations on its own (Campaign mode), keeping the last 256 results on the board so you don’t lose a run.
So which one is actually better? Neither, really — EMFI is gentler and more precise, voltage glitching is faster and simpler. Most of the researchers we’ve talked to end up using both.
EMFI, voltage glitching, and a logic analyzer — not the same thing
These terms get mixed together a lot, so here’s the short version. EMFI and voltage glitching are both fault injection; they just disturb the chip through different physics, electromagnetic versus electrical. A logic analyzer doesn’t disturb anything — it just watches.
Faulty Cat’s scanner header doubles as an 8-channel logic analyzer, so once you’ve caused a fault, you can also watch the target’s debug pins on the same board, decoded on your computer with the free tool PulseView.
Finding those debug pins in the first place is its own problem on an unmarked board. Faulty Cat’s pinout scanner brute-forces the usual candidates for SWD, the debug interface most ARM chips expose, instead of you probing pin by pin with a multimeter.
Who actually buys one of these?
Mostly four kinds of people, going by who’s bought a Faulty Cat so far: hardware security researchers, firmware developers stress-testing their own protections, reverse engineers mapping an undocumented debug port, and hardware pentesters assessing a client’s device.
Don’t fit any of those yet? Every workshop we’ve run starts with the same question — “wait, you can really make a chip skip an instruction?” — and the honest answer is yes, on hardware you’re allowed to open up.
Why does it cost more than a bare-bones alternative?
Faulty Cat is our build of Colin O’Flynn’s open-source PicoEMP design, with Crowbar, Campaign sweeps, and the scanner and logic analyzer added on top of it. It runs roughly twice the price of a bare PicoEMP — a gap people have asked about directly, and we don’t spell it out on the store page. The real comparison lives on the project wiki: benchmarked against both PicoEMP and the lab-grade ChipSHOUTER, Faulty Cat comes out the lower-cost, faster-recovery pick of the three — the price difference with PicoEMP is exactly the Crowbar, Campaign, scanner and logic-analyzer hardware above.
Authorized use only
Fault injection breaks things on purpose. Point Faulty Cat, or any fault injection tool, only at hardware you own or have explicit permission to test — Electronic Cats and PWNLab hold no responsibility for anything else.
A few questions people ask us
Do I need to flash firmware before I can use it?
No. A basic EMFI test needs no flashing at all: arm it, wait for the charge light, and pulse.
Is the hardware design actually open?
Yes — the schematics and bill of materials are public under CC BY-SA 3.0, the same license as the PicoEMP design Faulty Cat is built from.
Can I point it at a chip I don’t own?
No. Only use it on hardware you own or are explicitly authorized to test.
We’ll see you in the workshop — bring your own target board.
