AI
Hardware Hacker’s Skepticism About AI
Adam Laurie came in skeptical. Hardware hacking needs a lab, scopes, oscilloscopes, FPGAs, an EM pulse generator, and cables everywhere. Until AI can “come up and start plugging things in,” he saw nothing it could do for him. He used it to look up datasheets and identify mystery components. That was it.
Asking AI the Right Three Questions for EM Fault Injection
After six weeks of scripts producing nothing, a colleague gave one piece of advice: “You’re asking the wrong questions.” For EM fault injection, three questions matter: where to put the probe, when to send the pulse, and how hard to hit it. Laurie put all three to ChatGPT, phrasing it around “EM pulse fault injection” rather than “attacking” to avoid refusals. The answers were specific: probe 7 mm from a corner along the chip’s diagonal, pulse on a defined reset event, start at 500 volts and back off until the chip crashes 50% of the time.
ChatGPT Solves in 7 Minutes What 6 Weeks of Scripts Could Not
Three questions. ChatGPT said: draw a diagonal across the chip, place the probe 7 mm from the corner, start at 500 volts and ease back until crashes hit 50%. Laurie ran the calibration, set the rig going, went downstairs for a coffee, and came back to a complete firmware dump.
“I spent 6 weeks banging, well, not me, but my Python that was banging its head against a brick wall. 7 minutes.” — Adam Laurie (Major Malfunction)
Replacing a $1,000 Lab with a $7 Pico — Claude Writes the Firmware
Laurie handed Claude his full lab inventory — SWD/JTAG debugger, logic analyzer, fault injector, power supply — and asked it to consolidate everything. Claude produced firmware for a $7 Raspberry Pi Pico. It runs 5-nanosecond glitch timing, sniffs every protocol, and multiplexes eight UARTs by flipping alternate pin configurations. Over $1,000 of equipment, replaced by one chip.
Then Claude proposed using the Pico’s ADC to measure target voltage live and fire the glitch autonomously. Laurie connected one wire. Claude wrote the code, ran it, and ADC-triggered adaptive glitch — first try dumps locked chip.
“Claude told me, ‘Connect one wire, and I’ll take care of the rest.’” — Adam Laurie (Major Malfunction)
Live Demo: Locking and Glitching a Real Chip
Laurie filled a blank STM32-class chip with an audience-supplied hex value (“boobies”), enabled read-out protection, and handed control to the Pico. He walked through Live on-stage lock and glitch of STM32-class chip live: the Pico connected over SWD, loaded a payload into flash, triggered a brownout that reset the chip without wiping flash, then remapped SRAM as flash to gain read access. One pass. Chip dumped. To show the underlying math, he ran the voltage sweep tool, and Voltage window calibration sweep output printed a table identifying a safe glitch window between 161 and 089 — wide enough that timing-based approaches were, as he put it, “so yesterday.”
Q&A
Did you ask AI to explain why it picked those specific glitch parameters? Yes — he gave ChatGPT a flash dump of the bootloader, it reverse-engineered the binary, counted instruction steps between the read command and the lock-key comparison, and calculated the exact microsecond window based on the chip’s clock speed. ▶ 20:43
Have you baked your accumulated knowledge back into Claude since that first success? Since October he has been constantly trying new targets and training Claude on processes — Claude rewrote Raiden, a project that took two X-Force engineers over a year, in 3 days. ▶ 22:13
Have you tried porting this to other target devices beyond the Pico? The Pico was chosen because it costs $7 and is disposable; for gigahertz-speed targets he’d move to a Raspberry Pi 5 and just tell Claude to port the code, estimating an hour to working state. ▶ 23:26
Notable Quotes
I spent 6 weeks banging, well, not me, but my Python that was banging its head against a brick wall. 7 minutes. Adam Laurie (Major Malfunction) · ▶ 8:22
I’m a believer. I believe this works. Adam Laurie (Major Malfunction) · ▶ 8:39
Claude told me, ‘Connect one wire, and I’ll take care of the rest.’ Adam Laurie (Major Malfunction) · ▶ 12:33
The nation state level capability just became something everybody can do. And do it 10 times better. Adam Laurie (Major Malfunction) · ▶ 28:35
Key Takeaways
- Frame AI prompts around domain-specific questions — where, when, and how hard — not generic tasks.
- A $7 Raspberry Pi Pico running Claude-written firmware replaces over $1,000 of dedicated hardware hacking equipment.
- Let AI actively control hardware timing through ADC feedback instead of searching parameter space blindly.