Hacking Question Can someone post a photo of Efuses?

[Supercool330]

Yes, and these are not made of alloys meant to flow at low temperatures, like solder, either. Solder is designed to have an extremely low melting point.

This is an excellent point, the material these components are made out of aren't designed to melt. Thinking of them like you would think of the macro level circuitry we work with doesn't really make any sense.

Not to mention that heat isn’t what actually blows the fuse. It’s electromigration

Again, this point is spot on. The efuse isn't burned, it has its resistance increase through electromigration.

Also, sure, if someone was willing to invest tens of millions of dollars just to bypass the eFuses in the Switch, it might be possible.

Probably not. Anything you would do to bypass the eFuses would almost certainly destroy the rest of the IC.

So again probably largely theoretical at this point but the techniques I would look to are well established and have operated at the levels necessary. I agree it is unproven, and hideously expensive/impractical, however I reckon with the above stuff in place it is a far cry from physics says no which was what I took issue with.

Possibly, but a lot of these exploits are due to design flaws in the IC. Modern chips tend to have much better eFuse design, where it may be possible to bypass, but it is becoming less likely.

Another thing that is important to remember is that many computer components are actually orders of magnitude smaller than this, and they all work just fine (plus or minus some weird quantum effects that screw things up sometimes). When things get this small, a lot of the stuff that makes sense at the macro level falls apart.

 

[Dinzy]

http://switchbrew.org/index.php?title=Fuses
In short, you’re not going to find a way to unset these fuses without violating laws of physics, but with very, very extensive knowledge of critical internals it MAY be possible to skip them from being checked in the first place, or to prevent them from mattering.

I am not familiar with where these things are on this chip, but the article below shows Intel and TSMC were using efuses at M1. Drilling down to M1 is ridiculous. It would almost make more sense to drill in from the transistor side for any ridiculous hypothetical repair work.
http://www.eetimes.com/author.asp?section_id=36&doc_id=1328184

 

[Deleted User]

If you had enough access to downgrade, couldn't you say manipulate the amount of eFuses required to be burnt in the downgrade process? So, instead of requiring 2 fuses to be burnt, require whatever the amount of burnt fuses are to be burnt before downgrading? That would provide a solution given it works.

 

[FAST6191]

The fuse level required will doubtless be in the signed range of the firmware though. It is the same reason you can't just write totally a version higher than before in the firmware to downgrade on a more conventional device.

If you have the private keys, a dodge for them or have otherwise broken the crypto then yes I imagine you could alter all the checks to be whatever you like but at that point it does not really matter.

 

[nightking]

Since we are on topic of fuses, here is a big ass fuse

https://i.imgur.com/FDKb1Gh.jpg

 

[cybrian]

Since we are on topic of fuses, here is a big ass fuse

https://i.imgur.com/FDKb1Gh.jpg

How many jiggawatts does that thing take to blow?

 

[guyman70718]

Since we are on topic of fuses, here is a big ass fuse

https://i.imgur.com/FDKb1Gh.jpg

where did you get a replacement switch fuse

/s

 

[SnAQ]

What's wrong with Google?

Skickat från min F8331 via Tapatalk

 

[cybrian]

where did you get a replacement switch fuse

/s

That’s no switch fuse.

THIS is a switch fuse:

 

[planetarian]

TIL switch fuses are a thing, despite the fact that I've used them myself on numerous occasions at work