My coauthors and I will be presenting the paper "GlitchForge: A Complete Binary to Hardware Fault Injection Pipeline" at the IEEE International Symposium on Hardware Oriented Security and Trust (HOST'27) in May. Below is a preview of the abstract:

This paper presents GlitchForge, an end-to-end analysis workflow for fault injection that introduces a cross-layer narrowing strategy to generate attacks on real hardware in minutes. GlitchForge combines an ISA simulation that identifies target locations in a binary for a given attack model with an RTL co-simulation that determines the precise timing parameter for a specific hardware platform. Other glitch parameters require a one-time calibration that can take up 2 hours on the hardware tested. Using commercially available tools, GlitchForge then performs real clock-glitch fault injections, producing reproducible proof-of-concept (PoC) attacks. We evaluate GlitchForge on a dataset of eleven firmware targets compiled from popular open-source projects and demonstrate the feasibility of this automated approach. Across all targets, GlitchForge produces a PoC with attack timing windows as big as 103 cycles in the worst case and 2 cycles in the best, resulting in a reduction in the cycle search space of 99.3% Finally, we discuss further extensions to the pipeline that enable more sophisticated attack scenarios and support additional fault injection techniques.