Y
Yifan Lu
yifan.lu · Personal blog · on HN since 2011
Yifan Lu writes about hardware and console hacking, including the PS Vita, 3DS crypto, voltage glitching, AES fault attacks and Kindle jailbreaks.
What HN saysHN commenters link it for the differential fault analysis write-up on attacking hardware AES and for voltage glitching background, though one finds it dense.
19HN people shared it
5linked it in comments
16stories submitted
591story points
3 months agolast shared
2011people per year2026
Most-shared posts
- 1Attacking Hardware AES with DFA (2019)6 people · 23 points · first shared 2019 · 1 comments on HN
- 2The 3DS Cryptosystem2 people · 122 points · first shared 2016 · 49 comments on HN
- 3Injecting Software Vulnerabilities with Voltage Glitching [pdf]2 people · 49 points · first shared 2019 · 2 comments on HN
- 4Glitching a $20k Piece of History2 people · 3 points · first shared 2019 · discussion on HN
- 5Kindle Touch jail broken via ID3 Tag1 people · 187 points · first shared 2011 · 35 comments on HN
- 6PlayStation Vita Exploit Reverse Engineering Challenge1 people · 113 points · first shared 2016 · 11 comments on HN
- 7Hacking the PS Vita1 people · 86 points · first shared 2015 · 35 comments on HN
- 8Docsis Modem Cloning for Fun (But Not Profit)1 people · 2 points · first shared 2019 · discussion on HN
- 9T-Mobile Proxy Trick1 people · 2 points · first shared 2020 · discussion on HN
- 10HENkaku: Vita homebrew for everyone1 people · 2 points · first shared 2016 · discussion on HN
- 11PS Vita HDMI Mod Attempt1 people · 1 points · first shared 2018 · discussion on HN
- 12Yes, it's a kernel exploit1 people · 1 points · first shared 2016 · discussion on HN
- 13The first f00d exploit1 people · first shared 2026
What HN people wrote when they linked it
ThatPlayer · 2022-10-03
It's a different exploit. The original exploit is an issue with the Tegra's recovery mode (RCM), requiring a USB payload to be sent to the Switch at boot every time.
I believe the hardmod is a voltage glitching exploit, as described for the Vita here: https://yifan.lu/images/2019/01/Injecting_Software_Vulnerabilities_wit… . It is able to inject code through the onboard memory then load a payload from a memory card rather than USB.
nemothekid · 2021-11-23
That's covered in the referenced article, https://yifan.lu/2019/02/22/attacking-hardware-aes-with-dfa/, in the `Extracting keys` section
bonzini · 2021-11-23
nkurz · 2021-11-23
Maybe, or maybe not. Presumably that "more detailed write-up" would be something like the third footnote: https://yifan.lu/2019/02/22/attacking-hardware-aes-with-dfa/. Despite being much more detailed, I still felt just about as dumb! :)
smukherjee19 · 2026-08-01
I tried reading and gave up at the "Headline"...
Quoting from the bug analysis:
>Headline. The crash is real and reproducible. With musl instrumentation we pin the in-process mechanism precisely: a thread's own store to a freshly- faulted anonymous page becomes invisible to that same thread's reload ~10 instructions later, because the page's backing is replaced mid-function. A pagemap read at the instant of the fault shows the backing is the kernel's zero page. A captured core dump confirms the crash site with matched virtual addresses. The mechanism localizes to the interaction between the per-VMA-lock anonymous-fault fast path and a concurrent munmap's TLB shootdown. A source-level review of Linux 7.0.12 identifies a specific race in that interaction, and a git comparison across v6.19/v7.0/v7.1/mainline identifies the v7.0-introduced change on the munmap-teardown side that widens it.
"a thread's own store to a freshly- faulted anonymous page becomes invisible to that same thread's reload ~10 instructions later, because the page's backing is replaced mid-function."
-> ??? What's a "backing" of a page? Freshly-faulted? Fresh fries?
"~10 instructions later"?
"A pagemap read at the instant of the fault shows the backing is the kernel's zero page."
-> Backing?
"The mechanism localizes to the interaction between the per-VMA-lock anonymous-fault fast path and a concurrent munmap's TLB shootdown."
-> How can a mechanism "localize"?
And more.
This is... words strung…