PicoEMP is a compact, low-cost open-source Electromagnetic Fault Injection (EMFI) tool developed by Colin O’Flynn, aimed at researchers, makers, enthusiasts, and educators for experimentation and research in the field of hardware security.
To operate correctly, this open-source electromagnetic fault injector requires a custom tip and a protective cover to ensure safe usage. Under the safety cover, it looks like this:
Github Repository:
https://github.com/newaetech/chipshouter-picoemp
The schematics, Gerber files, and firmware are open-sourced.
PicoEMP is a community-driven project with the following main contributors:
-
Colin O’Flynn (original hardware design, simple Python demonstration)
-
stacksmashing (C firmware for complete PIO functionality)
-
Lennert Wouters (C language improvements, first real demonstration)
-
@nilswiersma (trigger/C improvements)
Schematics:
Core Features:
-
Microcontroller: Raspberry Pi Pico (RP2040 dual-core Arm Cortex-M0+, up to 133 MHz)
-
Purpose: For testing the electromagnetic fault injection (EMFI) security of embedded systems
-
Components: High-voltage pulse generation circuit transformer (originally used for charging camera flash), low ESR high-capacitance ceramic capacitors for energy storage, user-provided EMFI probes (typically hand-wound coils)
-
USB Interface: Serial USB interface for triggering and control
-
Pulse Control: Adjustable charging rate (faster than the original PicoEMP)
-
Probes: 4.7µH large coil probe for broader electromagnetic fields, 6µH small coil probe for localized attacks (as shown below)
-
High Voltage System: 220–230V voltage stored in a 4.7µF high-voltage capacitor, designed for rapid energy release
-
Power Supply: Powered via micro USB (cable not included)
-
Dimensions: 116 mm x 40 mm
Design Background
ChipSHOUTER is a high-end electromagnetic fault injection (EMFI) tool designed by Colin (working at NewAE Technology). Although ChipSHOUTER is not the first commercial EMFI tool, it is the first “easy to purchase” (albeit expensive) tool with extensive open documentation. This tool is not open-source, but it does include various detailed descriptions of the design and architecture in the user manual. ChipSHOUTER’s design optimizations are roughly focused on (1) safety, (2) high performance, (3) usability, and finally (4) cost. This leads to the tool covering many use cases, but it may be a bit overkill for many and too costly. Additionally, obtaining safety testing/certification is not cheap and must be factored into the product’s selling price.
PicoEMP attempts to fill the gap left by ChipSHOUTER at the lower end of the spectrum. This PicoEMP project is not the opposite of ChipSHOUTER; it aims to provide a “bare-bones” tool whose design optimizations are roughly focused on (1) safety, (2) cost, (3) usability, and (4) performance. Despite the emphasis on safety and low cost, it performs surprisingly well. It is also not sold as a complete product – you are responsible for building it and ensuring it meets any relevant safety requirements/certifications, and the developer takes no responsibility for what happens next. Use it only where you build and control the PicoEMP.
The image below shows the electromagnetic fault injection (EMFI) testing using the PicoEMP device on a Raspberry Pi SBC.
Follow the public account “Embedded Talk” for more interesting embedded information. Thank you for your likes and support.