https://raelize.com/tags/fault-injection/ Recent content in Fault Injection on Raelize - Embedded Device Security Testing, Consultancy & Training Hugo en-us Tue, 19 May 2026 09:00:00 +0200 https://raelize.com/blog/ai-fi-reproducing-adb-to-root-on-googles-tv-streamer-using-claude/ Tue, 19 May 2026 09:00:00 +0200 https://raelize.com/blog/ai-fi-reproducing-adb-to-root-on-googles-tv-streamer-using-claude/ We reproduce our 2025 hardwear.io research where an ElectroMagnetic (EM) glitch escalates privilege from the adb shell to root on Google’s TV Streamer 4K. This time we let Claude Code drive the whole software stack: Keysight Spider SDK, Keysight Inspector XYZ stage, YEPKIT YKUSH3, attack binaries, dashboards, wikis. We never touched any code. https://raelize.com/blog/setresuid-glitching-google-tv-streamer-from-adb-to-root/ Sun, 17 May 2026 23:00:00 +0200 https://raelize.com/blog/setresuid-glitching-google-tv-streamer-from-adb-to-root/ We attacked Google’s TV Streamer 4K with an ElectroMagnetic Fault Injection (EMFI) glitch on the Mediatek MT8696’s CPU. From an unprivileged adb shell, a single EM glitch during setresuid syscall makes the Linux kernel commit credentials with uid = 0. This is our hardwear.io NL 2025 talk in long form. https://raelize.com/blog/ai-fi-giving-claude-code-glitch-skills-for-bypassing-secure-boot/ Sun, 10 May 2026 15:00:00 +0200 https://raelize.com/blog/ai-fi-giving-claude-code-glitch-skills-for-bypassing-secure-boot/ We let an AI, namely Claude Code, orchestrate every part of a real Fault Injection (FI) attack. Driving the setup, the hardware tooling, debugging the setup, reverse engineering the ROM, building a live monitoring dashboard mid-campaign. The result: an autonomous bypass of ESP32 Secure Boot V1.