Photon-Emission-Guided Laser Fault Injection Enables RP2350 Secure Debug

Photon-emission microscopy (PEM) was used to locate a specific register within the raspberry pi microcontroller. By directing laser pulses at two adjacent positions, the debugger access was restored to the chip's secure world, allowing researchers to recover a secret stored in one-time-programmable memory. This attack required physical access, destructive preparation, and expensive laboratory equipment.

The RP2350 microcontroller, used in Raspberry Pi devices, contains hardware security features including one-time-programmable memory for storing the permanent security configuration and boot public key fingerprints. These bits can only be flipped once, ensuring the security remains intact throughout the chip's lifetime.