Hardware & systems security · NUS Computing
We study the security and correctness of the lower levels of computing. We find vulnerabilities deep in hardware and systems, and build the defenses that protect against them.
People
Join us-

Assistant Professor
Flavien Solt
Hardware security and correctness, with fuzzing and formal verification.
-

Postdoctoral Researcher
Liu Chang
Microarchitectural attacks and the security of trusted execution environments.
-

-

PhD Student
Peng Xuanyao
Hardware security and confidential computing, including secure and efficient AI systems.
-

-

-

Visiting PhD Student
Chen Decheng
Side-channel attacks and the security of trusted computing systems.
-

News
All news
Bugs found
Combo
Chip
Time
Lives
Find the bugs before tape-out.
Steer with the arrow keys or by dragging. Space for a power cycle.
Drag to steer the harness. Tap Power cycle in the frame to clear the board.
Harness crashed.
Escaped
Wave {n} of {m}
Errata fixed
Spread shot
Shield up
Rapid fire
Power cycle
Drone strafe
+1 power cycle
{n} bugs squashed on this chip
Errata shipped unfixed: −1 life
Escaped: −150
{name} breached: −{n}
Blocks kept clean: {n} of {m} · {p}% off the shop
Clean chip
Harness crashed
Chip {n} of {m} fuzzed
Tape-out! Chip signed off.
8 chips to tape-out
Chip {n} of {m}
Shipped with bugs: −1 life
New bug: glitches dart and jump
New bug: Rowhammers sweep and drop faults
New bug: Spectres fade in and out
New bug: worms take five hits
New bug: mimics pose as chocolate
Overclock
Chocolate wings
Needle
Magnet
Spare core
Reset button
Boot shield
Sidekick
Errata sheet
Salvo
Coolant
Afterburner
Vacuum
Turret
Debugger
Seeker rounds
Twin barrels
Underclock
Heavy rounds
Reflow
Spare die
Cryo bomb
Self-test
Loot sense
Steady hands
Bandolier
Coverage bonus
Spare die: one more life
Shots come faster.
Three shots in a fan, always.
Shots go through one more bug.
Pickups nearby drift to you.
One more life.
One more bomb on every chip.
Every chip starts with a shield.
A drone that fires beside you.
Bosses take half again as much damage.
Every fourth volley fans out.
Brown-outs and thrashing last half as long.
Move a quarter faster.
Every pickup drifts to you.
A turret fires from the bottom edge.
Armored bugs take double damage.
Shots steer toward the nearest bug.
Two shots side by side.
Bugs crawl fifteen percent slower.
One more damage to tough bugs.
A broken shield grows back in twenty seconds.
Once per run, the last life comes back.
A bomb freezes the survivors for two seconds.
A life back at the end of each chip.
Pickups drop twice as often.
The combo survives an escape.
A bomb for every fifteen bugs found.
Thirty percent more points per bug.
Firepower
Harness
Crew
Clock gating
Brown-out
Bug storm
The hydra splits
Titan slam
Voltage spike: rapid fire
Debug window: bugs slowed and revealed
Cache thrash: bugs speed up
Silicon lottery
Fault injection
A golden bug!
Golden bug squashed
Armored
Exposed
Errata boss
Hydra bug
Heisenbug
Rowhammer titan
Race condition
Buffer overflow
The bug that shipped
Cut one, two grow
There when you don't look
Slams the die
Two threads, one lock
One byte too many
You'll find me in the sheet. Page 40.
Every fix is two more bugs.
Attach a debugger and I vanish.
Every row I hit flips.
First to the lock wins. I'm both.
0xFF, and one more.
Filed under fixed.
No heads left to grow.
Observed. Collapsed.
Refreshed for good.
Serialised.
Bounds checked.
Crossing
Buffer full
It opens up right after every volley: fire then
Its spawn keeps it safe: squash the worms first
It can only be hit while it is there
It is soft only while it turns at the edges
It opens up as its two runners cross: shoot the crossing
Hit it while its buffer is full, before it spills
Steady hands
Thick skin
Quick feet
Long fuse
Bargain
Shots come faster.
One more life.
Move a little faster.
5 more seconds on every chip.
The shop costs 10% less.
New bug: swarms rush out in packs
New bug: splitters break in two
Squash it for a big bonus
Beetle
Glitch
Rowhammer
Spectre
Worm
Mimic
Swarm
Splitter
Taped out
Post-silicon
Probe
Net
Fetcher
It marks a bug every few seconds: a marked bug is worth double
It catches a bug about to escape, then needs a moment
It brings in the pickups you cannot reach
{name} joins the harness
Marked ×2
Netted
Fetched
Silicon is back from the fab. Let's see what crawls out.
Steer under the beetles. The harness fires on its own.
Bugs drop parts. Run over them.
Every wave comes faster. The bar at the top is the chip's clock.
First bug squashed. Chain kills for a multiplier.
One got past. Five escapes ship a bug.
Something big stirs under the die.
The errata. Watch for the moment it opens up.
Errata sheet updated. Ship it, then respin.
Respin. New floorplan, new bugs, and I called in help.
Beetles spit faults from this chip on. Dodge the crosses.
Halfway to tape-out. Armored bugs from here: the hexagon means wait.
Mimics look like chocolate. Shoot what moves.
Last chip. Tape-out is one errata away.
Taped out. Go celebrate.
Caught
Combo
Wave
Leaks left
Values left
Guard the ports.
Pick a tower on the bar, tap the board to place it. Tap a tainted value to scrub it by hand. Tap a tower for its menu.
Pick a tower on the bar, press the board to place it. Tap a tainted value to scrub it. Drag towers during the build phase.
Leaked.
Leaked
Wave {n} of {m} held
Die secured.
10 waves to secure the die
Wave {n} of {m}
Tracker placed
Tracker full
Not enough points
On a wire
Too close to a tower
Keep clear of the core and the ports
Off the edge
Place here
Drop here
Tap where it should stand
Rank up
Sell
Move
Sold: +{n}
Moved
Moved: tap to flush
Drag towers to move them for free
Scrubbed by hand
No hand scrub left
Flushed
Empty: tap to flush
Leak!
Taint spread
Split!
Lucky ping
Hand scrubs
All clear
{n} caught in a row
+1 hand scrub
Dispatch drone
New: armored values take three tags, tanks six
New: cloaked values and mimics, seen only near a tracker or sniffer
New: splitters, swarms, and dashers
New: carriers, phantoms, and encrypted values a sniffer must open
New: jammers freeze towers, leeches drain them
New: healers undo the tags around them
New: bombers drain the towers around them
Rootkit scrubbed
Trojan revealed
Worm scrubbed
Trojan scrubbed
Spectre scrubbed
Keylogger scrubbed
Recording
Power glitch: buffers drop
Firmware update: towers flushed
Leak alarm: tainted values rush
Audit: hand scrubs refilled
Fog: values look alike
Worm
Trojan
Spectre
Rootkit
Keylogger
Segment by segment
Looks clean until it doesn't
Never on the wire you think
Owns the die
Records every tap
Tag my tail all you like.
Wave me through. I'm clean.
Which wire? Wrong one.
I was here before your towers.
I saw that tap. And that one.
Cut at the head.
Unmasked at the port.
Pinned down.
Evicted from ring 0.
Log wiped.
Scrub the head first: the segments are armored while it lives
It slows down once revealed: pile on then
It is solid right after a jump: tag it then
It heals from its swarm: scrub the swarm first
It jumps to where you tap and records for a moment: tap near your towers
Rootkit heals from its swarm
Decrypted
Blast: towers drained
Ranked up
Top rank already
Veteran
+{n} bits
Master key: every tower flushed
Patrol drone
Deep buffers
Boot camp
Extra glove
Quick flush
Spare port
Bulk order
Lucky ping
Port guard
Overclock
Self-flush
Cold hands
Bounty
Vault
Antenna
Vault: no life lost
Drill
Sniper doctrine
Flush shock
Gatling doctrine
Quick hands
Toll
Full refund
Seed money
Jam proof
Deep tag
Free relocation
Alarm dampener
A drone that patrols, tags and flushes.
Towers hold one more tag.
Towers reach farther.
One more scrub charge.
A flush is instant.
One more life.
Towers cost a quarter less.
More loot, and a gift every ten seconds.
A guard at each port scrubs one value per wave.
Towers tag a quarter faster.
An empty tower flushes itself after six seconds.
A scrub slows the values around it.
Loot drops twice as often.
The first leak of a wave costs no life.
All towers reach a little farther.
Towers become veterans sooner.
Long reach, slower tagging.
A flush slows the tainted values nearby.
Fast tagging, shorter reach.
Charges come back faster.
A quarter more points per catch.
Selling a tower returns its full price.
Points at the start of every wave.
Jammers cannot jam your towers.
Armored values need one tag less.
Moving a tower keeps its tags.
Alarms are over in half the time.
Port guard caught it
Towers
Hand
Crew
Values in {n} s
Keen eye
Deep pockets
Big buffers
Steady hand
Bargain
All towers reach a little farther.
150 points, right away.
Towers hold one more tag.
Charges come back faster.
The shop costs 10% less.
Golden value: tap it
Golden value caught
Armored value
Tank
Cloaked value
Mimic
Splitter
Swarm
Dasher
Carrier
Phantom
Encrypted value
Healer
Jammer
Leech
Bomber
Hound
Auditor
Courier
It runs the wires and barks at cloaked and disguised values, which slows them
It refills the emptiest tower every so often
It collects the loot for you
{name} joins the patrol
Woof: revealed
Audited: refilled
Assertions
Combo
Bound
Traces left
Budget
Unroll the trace.
Arrow keys or a tap beside the trace change lane. Space or a tap on the trace hops. Hold Down to brake.
Tap beside the trace to change lane, tap the trace to hop. Hold Brake in the frame to slow down.
Out of traces.
Traces lost
Bound {n} of {m}
Unreachable state
Counterexample squashed
Bound {n} of {m} proved
All bounds proved.
10 bounds to prove
New: wormholes
New: bound walls with one gap
New: spurious counterexamples, harmless
New: state explosions
Solver timeout: −1 trace
Caught by a counterexample
Spurious
Lemma: shield up
Cover point
Wormhole jump
Hop
Brake
Next
+{n} s
State explosion
Solver hint: the safe lane glows
Deadline: budget drains fast
Lemma rain
Counterexample
Loop
Rival solver
Abstraction
State explosion
Hop into its lunge to hurt it
Hop through the ring as it sweeps by
Prove what it is about to steal, right under it
Cross it while it is abstract, or hop through
Every assertion proved contains it
Twins
Frenzy
Four states
Double loop
Leaves a trail
Calls counterexamples
Wider, with a gap
Collapse
Chain reaction
Meltdown
{name} joins the run
{name} level {n}
Rebooting
Proved
Decoy: counterexample squashed
Oracle: solver thinks
Counterexample refuted
Loop broken
Rival outrun
Abstraction refined
Explosion contained
The trace that fails
Round and round
Faster on every assertion
Three lanes, no states
Two to the N
One path is all I need.
Every cycle, the same states.
I'll prove it first.
Too coarse to catch, too wide to pass.
More states than you have cycles.
No path left.
Broken for good.
Proved first.
Refined away.
Bounded.
Weak spot
Stolen
Outrun
Lunge!
Nondeterminism
Nondeterministic turn
New: counterexamples hunt the trace
Ghost pass
Pruned
Prune now
Spare trace
Clock divider
Ghost pass
Pruner bot
Long hop
Magnet
Solver budget
Lemma library
Prover
Decoy trace
Oracle
Witness
Invariant
Checkpoint
Cover bounty
Lens
Quick hop
Tenacity
Checkpoint: budget restored
Quick turns
Deep bound
Shallow bound
Storm anchor
Proof hammer
Rally
Wide trim
Quick trim
Lucky rows
One more life.
The trace runs slower.
The hop carries farther.
Nearby assertions drift into your lane.
Five more seconds of budget.
A shield, kept between bounds.
One crash forgiven per bound.
A trim that clears the lane ahead.
A prover that collects assertions ahead.
A decoy two lanes over that squashes bugs.
An oracle that slows time when danger comes.
A witness behind you that gathers lemmas and cover.
A shield of its own every twenty seconds.
The first timeout of a bound is forgiven.
Cover points are worth double.
See through nondeterminism.
The hop recharges faster.
The combo survives a crash.
Lane changes are quicker.
Assertions worth half again, but faster.
Slower, but assertions are worth less.
State explosions are over in half the time.
Bosses take half again as much damage.
Companions reboot twice as fast.
The trim clears the lanes beside too.
The trim recharges faster.
Golden assertions come more often.
Invariant: shield up
Solver
Trace
Party
Golden
Golden assertion proved
+1 ghost pass
Slow clock
Spare trace
Sharp turns
Lucky
Bargain
The trace runs slower.
One more life.
Lane changes are quicker.
Golden assertions come more often.
The shop costs 10% less.
New: flickering states, safe when hollow
New: walls whose gap moves one lane
New: fast sliders sweep two lanes
New: double walls, thread both gaps
Sliding state
A golden assertion!
Refreshes
Close calls
Bank
Time
Flips left
Hold the rows.
Tap a row or press its number to refresh it. Out of refreshes, a tap queues the row. Space for a burst refresh.
Tap a row to refresh it. Out of refreshes, a tap queues the row. Burst refresh is in the frame.
Bits flipped.
Close calls
Refreshed
Bit flip!
Close call
{n} close calls this bank
+1 ECC correction
Burst refresh
New aggressor: {name}
Hammer
Sprinter
Crab
Pair
Stealth hammer
Hops at random
Quick hops, light blows
Walks row to row, hits hard
Hammers one row from both sides
Hides after every hop
Fan
Canary
Sentinel
It cools the hottest row
It sings when a row runs hot and pecks the stealth off hammers
Hammers that land beside it bounce off
{name} joins the bank
Bank expands: +{n} rows
Next: {name} · {s} s
More rows
Golden row
Chirp!
Bounced
Recharging
No refresh left
Queued {n}
Unqueued
Bank {n} of {m} held
Memory held.
10 banks to hold
Bank {n} of {m}
New: double-sided hammering
New: the heat reaches two rows away
New: aggressors hide after hopping
ECC corrected
TRR bot refreshed a row
Hammer King evicted
The Press evicted
Phantom evicted
Thermal spike
Cooling burst: tokens refilled
Voltage droop: refreshes cost two
ECC scrub: +1 correction
Row remap: two rows swapped
Golden row: keep it cool
Golden row kept cool
Golden row lost
Hammer King
The Press
Phantom
Hammers hardest
Three rows at a time
Seen only when it strikes
Every row is mine to hammer.
Why hit one row when I can hit three.
Refresh what you cannot see.
Dethroned.
Pressed flat.
Made visible.
Shielded
It is open right after it lands: refresh a row beside it then
It rests after each slam: refresh a row under it then
It shows when it strikes: refresh a row beside it then
Bot sweep
Extra token
Fast charger
ECC
Turbo burst
Spare bank
TRR bot
Sensor
Cooler
Scrubber
Long queue
Overdrive
Armored rows
Heat shield
Heat sinks
Droop proof
Hot hands
Stun hammer
Slow burn
Deep chill
Sink power
Early warning
Golden nose
Quick sweep
Twin sweep
Boss brake
Speed limit
Chain refresh
One more token.
Tokens come back faster.
One more bit flip absorbed per bank.
The burst recharges faster.
One more life.
A TRR bot that cools the hottest row.
See where the hammers land next.
Rows heat ten percent slower.
An ECC charge every fifteen seconds.
Queue up to five rows.
The burst freezes the hammers for two seconds.
Weak rows take a little more heat.
Thermal spikes are half as hot.
A heat sink already installed.
A droop no longer doubles the cost.
Fast tokens, but rows heat a little faster.
A refresh under a hammer stuns it.
Rows heat slower, but tokens come back slower.
A refresh cools the neighbours twice as much.
Heat sinks cut heat to a third.
Rows warn earlier.
Golden rows are worth double.
The bot sweeps more often.
The bot cools one more row per sweep.
Bosses hop slower.
Hammers hop slower.
Quick successive refreshes pay extra.
Controller
Memory
Bots
Heat sink installed
Cool hands
Thick walls
Spare fuse
Quick burst
Bargain
Tokens come back faster.
Rows take a little more hammering.
One more life.
The burst recharges faster.
The shop costs 10% less.
New: a hot spot heats its row
New: drifters glide from row to row
New: refresh storms make refreshes free
New: twin hammers strike in lockstep
Drifter
Glides row to row, refresh its row to turn it back
Twins
Strike as one, a refresh between them stuns both
Refresh storm
Refresh storm: refreshes are free
A golden row!
Fuzzing & validation
Information-flow tracking
Formal verification
DRAM & Rowhammer
Score0
Bugs found0
Combo×1
Chip1
Lives3
Time0:40
Best0
LevelLv 1
New best!
Campaign complete
{name} is coming
{name} ahead
{name} after this wave
{name} is enraged
Stage {n}: {name}
Stage {n} of 3
{name} level {n}
Tap to skip
Locked
Maxed
Needs {name}
Tap a link to see it. The traces light up as you buy.
Level {n} of {m}
Instead of {name}
Halfway there
{n} values left
{n} assertions to go
{name} got you. {hint}
Resume · {level}
Start over
Run resumed
Best: level {n} of {m} · {b} bosses beaten
Yes, this is a game. Press Play and I'll explain as we go.
Four games, one per research theme. Start with this one.
Bugs, taint, proofs, and DRAM. Pick a tab, press Play.
Spend points below, then press Continue · {n}
Tap one perk to keep going · {n}
Farthest
Nice chain
On fire
Unstoppable
{n} points
Points: {n}
{n} points
Lv {n}
Level up!
Level {n}
Pick a perk
Points well spent are points well fuzzed.
Reviewer 2 says the harness looks fine. Reviewer 2 is wrong.
Everything here is peer reviewed. By me.
No refunds. Tape-out is final.
Excellent choice. Probably.
Sold. Do not read the errata sheet.
That one is my favourite. So is the other one.
Pleasure doing business. Mind the bite.
The chip shipped anyway. They always do.
That was a counterexample. Write it up.
Bugs happen. Ask any errata sheet.
Silicon is unforgiving. Coffee helps.
Promoted. The paperwork is on your desk.
Level up. Still no tenure.
Stronger already. Pick wisely.
Intern
PhD student
Postdoc
Professor
Emeritus
Lab rank
{n}/4 games past level 5
Unlocked: {name}
Fuzzing grant
Tracker sidekick
Proof of cooling
Chocolate trace
Secret unlocked
Tap the big chip at the top of the page seven times
Chocolate mode
Chocolate mode off
Daily chip · {date}
Named after
Arcade
Play at ChocoLab, NUS Computing
Next: {level} · {list}
{name} appears
{name} joins
Boss: {name}
{n} of {m} levels cleared
Goal
No life lost
{n} points
Combo ×{n}
Goal met +{n}
Goal met: +{n} points
Goal missed
Overclocked: 50% more points
Overclock bonus: +{n} points
New in your collection: {name} ({n}/{m})
Paper collection: {n} of {m}
Every level is named after a ChocoLab paper. Clear it to collect the paper.
{game}, {level}
{name} had {p}% left
{n} points short of your best
Farthest yet: {level}
Today: {twist}
double experience
the shop costs 20% less
one more life to start
300 points to start
{n} days in a row
{rank}: {reward}
Next: {name} at {xp} XP, {reward}
the shop costs 10% less
one more life to start
25% more experience
a perk after the first points
Start at {level}
Head start: {level}
Spend these points, then press Continue
Chip caught that one
Defeated