Hardware Security on a Shoestring: Why PwnPad Changes Embedded Penetration Testing

Most software security engineers hit a brick wall the moment an attack surface drops below the operating system layer. Silicon does not care about memory safety abstractions if an attacker can drop a voltage rail at the exact instruction boundary or sniff an unencrypted bus during boot. The real problem has never been a lack of curiosity; it has been the high cost of entry. Dedicated training rigs, breakout boards, and proprietary glitching hardware regularly run into hundreds or thousands of dollars.

PwnPad shatters that economic moat. Built by Georgios Roumeliotis at TwelveSec, this open-source platform packs a complete, 15-stage hardware exploitation lab onto a custom board that costs under $20 to fabricate and assemble. Paired with roughly $50 of ubiquitous lab gear, it provides a comprehensive progression from basic signal decoding to silicon-level physical attacks.

Architectural Simplicity: The Hardware Selector

A common friction point in physical security training platforms is the constant cycle of flashing, erasing, and debugging microcontrollers between exercises. PwnPad bypasses this entirely using an onboard hardware multiplexing model.

The core firmware (PwnPad.ino) houses the logic for every scenario inside a centralized switch block. Instead of modifying source code or reflashing memory banks, the user configures a 5-pin binary jumper array directly on the board. Pin 1 acts as the Least Significant Bit (LSB) and Pin 5 acts as the Most Significant Bit (MSB).

Setting a challenge requires nothing more than grounding or pulling high the appropriate binary combination and hitting the hardware reset switch.

For instance, addressing Challenge 3 translates to binary 00011:

Pin 1 (LSB) --> 1
Pin 2       --> 1
Pin 3       --> 0
Pin 4       --> 0
Pin 5 (MSB) --> 0

The microcontroller samples these pins on boot, instantly branching execution directly to the designated target routine without needing an active host connection to reload flash memory.

The Minimum Viable Hardware Stack

Replicating an enterprise embedded penetration testing environment on this board does not require specialized industrial scopes. The complete validation environment relies entirely on standard bench equipment:

Multimeter: Essential for initial continuity checks, probing line states, and identifying ground planes.
Arduino UNO: Configured as an in-system programmer (ISP) to interface directly with target chip architectures.
Logic Analyzer: Used to sample, trigger, and decode protocol transitions across physical traces.
Jumper Wires: Breadboard-grade interconnects for pin routing.
Raspberry Pi Pico & MOSFET: The dedicated trigger and switching subsystem for precise voltage fault injection.

+------------------+         +---------------------+
| Logic Analyzer / | <-----> |   PwnPad Hardware   |
|   Arduino UNO    |  Traces | (Target Controller) |
+------------------+         +----------+----------+
                                        ^
                                        | Power / Glitch Rail
                             +----------+----------+
                             | Raspberry Pi Pico + |
                             |       MOSFET        |
                             +---------------------+

Assembly documentation, schematics, PCB Gerbers, and 3D printable enclosures are located entirely within the repository's open design files (hardware/, modules/, and docs/PwnPad_building_instruction.pdf).

Repository Layout and Local Infrastructure

The project structure cleanly isolates firmware routines, target documentation, hardware models, and local flag submission infrastructure.

Directory	Purpose and Contents
`firmware/`	Challenge implementations, core state machine, and challenge binaries
`hardware/`	Schematics, BOM (Bill of Materials), Gerber layouts, and 3D files
`challenges/`	Markdown-based technical briefs, target parameters, and flag objectives
`tools/`	Automated build, flashing scripts, and local challenge engine
`docs/`	Hardware build manual and reference schematics
`modules/`	Schematics and fabrication files for modular add-on boards

To run the local gamified scoring platform and validate flag captures, launch the included dashboard service:

bash
bash ./tools/webapp/start.sh

Point any local browser to http://127.0.0.1:12530 to access the challenge control pane, submit recovered tokens, and monitor objective progression across the lab curriculum.

The Attack Syllabus: 15 Exploitation Vectors

Except for storage extraction exercises (Challenge 5 and Challenge 6), all flags across the platform are exfiltrated interactively through UART or I2C serial busses once target states are manipulated.

ID	Title	Target Vector	Technical Objective
1	Serial Snitch	#UART	Identify floating UART pins, resolve baud rate, and gain CLI access.
2	Echo Chamber	#UART	Intercept data streams obfuscated via non-standard formatting.
3	Bus Whisperer	#I2C	Attach to I2C traces, sniff bus transmissions, and decode payload data.
4	Invisible Wires	#I2C	Exploit dynamic transactions where the slave device is absent.
5	Code Heist	#SPI #ISP #Flash #UART	Dump and reconstruct raw binary images from external Flash storage.
6	Hard Leak	#SPI #ISP #EEPROM	Interface via ISP to extract raw data structures directly from internal EEPROM.
7	Power Trip	#FaultInjection #UART	Drop target voltage rails to skip critical control flow checks and dead code.
8	Glitch Storm	#FaultInjection #UART	Time precision transient power cuts to bypass password verification branches.
9	Clock Spy	#SideChannel #UART	Measure instruction execution times to expose internal secret comparisons.
10	Tempo Leak	#SideChannel #UART	Exploit secondary timing variance attack vectors across verification routines.
11	Chaos Chain: Glitchgate	#FaultInjection #UART	Chain hardware voltage glitching with UART manipulation to reach deep target code.
12	Chaos Chain: Timebomb	#UART #SideChannel	Correlate timing side channels over serial channels to compromise the device.
13	Pizza Order	#SPA #SideChannel	Analyze power traces via Simple Power Analysis to reconstruct authorization keys.
14	Ladybirds	#SWD #Reversing STM32	Attach hardware debuggers over SWD to inspect and patch active memory limits.
15	Ladybird I Am Your Father	#JTAG #Reversing STM32	Extract firmware over JTAG interfaces and patch runtime structures.

Expanding the Attack Surface

Because PwnPad is licensed under the GNU General Public License v3.0, extending the core engine is straightforward. Adding a new module requires defining a new challenge header, assigning its handler inside PwnPad.ino's switch structure, and documenting its pinout state in challenges/.

The active TwelveSec roadmap focuses on expanding physical layer interactions. Upcoming revisions will introduce:

Integrated DIP switch arrays to replace loose selection jumpers for fault injection tasks.
Dedicated Simple Power Analysis (SPA) and Differential Power Analysis (DPA) scenarios.
Modular expansion headers delivering backward-compatible support for External Storage, Bluetooth Low Energy (BLE), and Sub-GHz RF boards.

PwnPad eliminates the excuse that physical security requires massive lab budgets. By anchoring firmware reverse engineering, serial bus sniffing, debug port hijacking, and power glitching to an accessible $20 target, it delivers a direct, practical route straight to the silicon.

Reference

Repository: https://github.com/twelvesec/PwnPad