AI agent finds single 2-byte instruction skip that bypasses secure boot in ARM router chip, analyzing 25 million instructions to defeat firmware protections including RSA-2048 signature verification.

From 25 million instructions to one faulty skip: AI-driven fault analysis of a secure boot

In part 1, we argued that the walls around firmware analysis are coming down when an AI agent drives the right instruments: esFirmware to run, trace and fault firmware, and Epoch to turn an execution into a time-travel trace. This post opens the case behind that claim.The target is the boot ROM of a widely deployed ARM-based router SoC. It loads a second-stage bootloader (BL2) from flash and checks its authenticity and integrity before running it. We gave it a tampered BL2, which it correctly re...