We study the security and correctness of the lower levels of computing. We find vulnerabilities deep in hardware and systems, and build the defenses that protect against them.
Four small games, one per research theme, with levels, a shop, and a daily chip. Sound is on, and the button turns it off.
Fuzzing & validation
Information-flow tracking
Formal verification
DRAM & Rowhammer
Bugs crawl out of the chip and come down the board. The harness fires on its own: steer it, chain kills for a multiplier, and catch what the bugs drop. A chip is fuzzed once its clock runs out and its errata boss is dead. Every chip brings a new floorplan, a new kind of bug, and a shop where points buy harness upgrades. Bugs that get past you cost points, and every fifth one a life.
Bugs foundComboChipTimeLivesFind the bugs before tape-out.Harness crashed.EscapedWave {n}Errata incomingErrata fixedSpread shotShield upRapid firePower cycleDrone strafe+1 power cycle{n} bugs squashed on this chipErrata shipped unfixed: −1 lifeEscaped: −150Harness crashedChip {n} fuzzedChip {n}Shipped with bugs: −1 lifeNew bug: glitches dart and jumpNew bug: Rowhammers sweep and drop faultsNew bug: Spectres fade in and outNew bug: worms take five hitsNew bug: mimics pose as chocolateOverclockChocolate wingsNeedleMagnetSpare coreReset buttonBoot shieldSidekickClock gatingBrown-outBug stormSteady handsThick skinQuick feetLong fuseBargainTaped outPost-siliconTape-out!Chip {n} shipped. Post-silicon starts now: the bugs get nastier and the errata bigger.
Values leave the core and travel the wires of the die to its ports. Some are secret. Pick a tower from the bar at the top and tap the board to place it: trackers and sniffers tag tainted values in range but hold only a few tags before you tap them to flush, scrubbers take one value outright and recharge, beacons slow values, and flushers refill the towers around them. Each wave starts with a build phase. Tainted values steer for thin coverage, come in packs, and later jam the trackers around them. A few hand scrubs are there for emergencies. Every wave brings more, and opens a shop.
CaughtComboWaveLeaks leftValues leftGuard the ports.Leaked.LeakedWave {n} heldWave {n}Tracker placedTracker fullNot enough pointsNot thereScrubbed by handNo hand scrub leftFlushedEmpty: tap to flushLeak!Taint spreadSplit!Lucky pingHand scrubsAll clear{n} caught in a row+1 hand scrubDispatch droneTracker: {n} pointsNew: armored values take three tags, tanks sixNew: cloaked values and mimics, seen only near a tracker or snifferNew: splitters, swarms, and dashersNew: carriers, phantoms, and encrypted values a sniffer must openNew: jammers freeze towers, leeches drain themNew: healers undo the tags around themNew: bombers drain the towers around themBoss waveRootkit incomingRootkit scrubbedDecryptedBlast: towers drainedRanked upTop rank alreadyVeteranTap a tower to rank it up+{n} bitsMaster key: every tower flushedPatrol droneDeep buffersBoot campExtra gloveQuick flushSpare portBulk orderLucky pingValues in {n} sKeen eyeDeep pocketsBig buffersSteady handBargain
The trace runs through the state space one state per cycle and never stops. Switch lanes to reach the assertions and to dodge unreachable states, bound walls, and the counterexamples that hunt the trace; hop to skip a state. The solver budget runs down and every assertion tops it up; a timeout costs a trace. Enough assertions prove a bound and open a shop; every bound runs faster and brings a new trick.
AssertionsComboBoundTraces leftBudgetUnroll the trace.Out of traces.Traces lostBound {n}Unreachable stateCounterexample squashedBound {n} provedNew: wormholesNew: bound walls with one gapNew: spurious counterexamples, harmlessNew: state explosionsSolver timeout: −1 traceCaught by a counterexampleSpuriousLemma: shield upCover pointWormhole jumpHop+{n} sState explosion{name} joins the run{name} level {n}RebootingProvedDecoy: counterexample squashedOracle: solver thinksA counterexample stalks the traceCounterexample refutedA loop circles the traceLoop brokenA rival solver races the traceRival outrunAn abstraction loomsAbstraction refinedA state explosion brewsExplosion containedWeak spotStolenOutrunLunge!NondeterminismNondeterministic turnNew: counterexamples hunt the traceGhost passPrunedPrune nowSpare traceClock dividerGhost passPruner botLong hopMagnetSolver budgetLemma libraryProverDecoy traceOracleGoldenGolden assertion proved+1 ghost passSlow clockSpare traceSharp turnsLuckyBargain
Aggressors hammer the rows of a DRAM bank, and a row that gets too hot flips its bits. Weak rows flip early. Refresh a row before that happens: you have three refreshes at a time, and each takes a second to come back. The hammered row itself stays refreshed by the hammering. Its neighbours take the heat. Hold a bank for forty seconds to clear it. Every bank adds rows, aggressors, and hammering patterns, and opens a shop selling countermeasures.
RefreshesClose callsBankTimeFlips leftHold the rows.Bits flipped.Close callsRefreshedBit flip!Close call{n} close calls this bank+1 ECC correctionBurst refreshNew aggressorRechargingNo refresh leftBank {n} heldBank {n}New: double-sided hammeringNew: the heat reaches two rows awayNew: aggressors hide after hoppingECC correctedTRR bot refreshed a rowBot sweepExtra tokenFast chargerECCTurbo burstSpare bankTRR botHeat sink installedCool handsThick wallsSpare fuseQuick burstBargain
Score0
Bugs found0
Combo×1
Chip1
Lives3
Time0:40
Best0
LevelLv 1
Paused
Shop
Score
New best!Spend points below, then press Continue · {n}Tap one perk to keep going · {n}FarthestNice chainOn fireUnstoppable{n} pointsPoints: {n}{n} pointsLv {n}Level up!Level {n}Pick a perkPoints well spent are points well fuzzed.Reviewer 2 says the harness looks fine. Reviewer 2 is wrong.Everything here is peer reviewed. By me.No refunds. Tape-out is final.Excellent choice. Probably.Sold. Do not read the errata sheet.That one is my favourite. So is the other one.Pleasure doing business. Mind the bite.The chip shipped anyway. They always do.That was a counterexample. Write it up.Bugs happen. Ask any errata sheet.Silicon is unforgiving. Coffee helps.Promoted. The paperwork is on your desk.Level up. Still no tenure.Stronger already. Pick wisely.InternPhD studentPostdocProfessorEmeritusLab rank: {rank} · {xp} XP · {n}/4 games past level 5Unlocked: {name}Fuzzing grantTracker sidekickProof of coolingChocolate traceSecret unlockedTap the big chip at the top of the page seven timesChocolate modeChocolate mode offDaily chip · {date}Named afterArcadePlay at ChocoLab, NUS Computing