Skip to content
LiteInjector

LiteInjector

Emulate fault injection attacks on your LiteX SoC, directly on FPGA. Bit-accurate, cycle-accurate, and up to 210× faster than RTL simulation.
Get startedTry a tutorialView on GitHub

Why LiteInjector

Section titled “Why LiteInjector”

Evaluating countermeasures against fault injection attacks usually means long RTL simulation campaigns, or physical attack benches. LiteInjector instruments your design instead: the faults are emulated in the FPGA, on the real SoC running real software, and every attack parameter can be changed at runtime from the host.

Any signal of your SoC

Probe any Migen signal, or any instrumented signal of a Verilog IP, with a few lines added to a LiteX SoC.

Precise triggers

Trigger on values bits, rising and falling edges, then delay the fault by a number of clock cycles.

Five fault models, combinable

Bit set, bit reset, bit flip, random bit flip and value replacement, on one or several signals in the same cycle, for one or more cycles.

Multi-fault attacks

Chain triggers to fault the same execution several times, without rebuilding the bitstream.

Campaigns built in

Sweep bits, offsets or addresses, observe the target over UART, and get a CSV report of every run.

Light and open

Small FPGA footprint, BSD-2-Clause license, written in Python with Migen like LiteX itself.

How it works

Section titled “How it works”

  1. Add LiteInjector to your SoC and choose the signals to probe: the instruction bus, a security flag, a protection signal…

    self.submodules.injector = LiteInjector([ibus.adr, ibus.dat_r], depth=16, csr_csv="injector.csv")
    self.add_uartbone("liteinjector")

  2. Describe the attack from the host: when to inject, and which fault to apply.

    Terminal window
    $ liteinjector_cli run --when ibus_adr=0x0000037A --offset 1 \
          --fault bit-value:ibus_dat_r=0x00050C63 --wait 5

  3. Observe the result, or let a campaign sweep the parameters and classify every run.

    Terminal window
    $ liteinjector_cli campaign campaign.toml
    Campaign 'bios-unlock-bitflip': 32 run(s).
    [1/32] {'bit': 0} -> <outcome>
    ...
    Results written to bios_unlock_results.csv

Proven on real attacks

Section titled “Proven on real attacks”

A single instruction is replaced on the instruction bus of a VexRiscv CPU, and the BIOS accepts a wrong password.

LiteX BIOS console: unlock refused without fault, granted with fault.
Bypass a BIOS passwordReplace one instruction on the CPU instruction bus.
Bypass PMP memory protectionFrom the instruction bus, or inside the CPU.
VerifyPIN on LinuxFault a program running on a VexRiscv SMP Linux.
Run a campaignSweep every bit of an instruction and get a report.

Research

Section titled “Research”

LiteInjector is developed by the ARCAD team of the Lab-STICC laboratory in Lorient, France, and was presented at the 28th Euromicro Conference on Digital System Design (DSD 2025). If you use it in your work, please cite it.