Side-Channel Analysis with ChipWhisperer
ChipWhisperer is an open-source toolchain for hardware security research — a capture board that measures a target chip's power consumption (or electromagnetic emissions) with enough precision to pull out information the chip never meant to leak, plus a Python API for driving captures and analyzing the resulting traces. I'm working through NewAE's course material against real target boards, not a simulator.
Power analysis
The SCA101 labs start from first principles: a microcontroller's instantaneous power draw depends on what it's doing, down to the Hamming weight of the data moving through its registers. Capture enough power traces while an AES implementation runs, line them up against a key-dependent hypothesis, and the correct key byte stands out statistically from the wrong ones — a correlation power analysis (CPA) attack. No access to firmware source is needed, only the ability to watch the chip work.
Fault injection
The fault101 labs come at it from the other direction: instead of passively reading the chip, glitch it. A precisely-timed clock or voltage glitch during a specific instruction can corrupt a comparison, skip a branch, or flip a bit in a way that bypasses a password check or dumps memory that was never supposed to be readable — without needing to break anything cryptographically. Getting the glitch timing right is most of the work.
Target hardware
Target boards include CW308 "UFO" targets running different firmware, letting the same capture setup attack different architectures and implementations — useful for seeing which parts of an attack are generic (the statistical method) versus target-specific (timing, trigger points, trace alignment).
This is coursework, not a finished result — I'm not claiming extracted keys or novel attacks here. The interesting part so far has been how much of "hardware security" turns out to be signal processing and statistics applied to something most software engineers never think to look at.