Oscillator & Crystal
The clock source that paces the chip. A passive crystal or an active oscillator sets the beat every instruction marches to, which makes it a prime target for glitching and fault injection.
A crystal or oscillator supplies the reference clock that paces everything a chip does. A crystal (XTAL) is a passive quartz resonator: it does not produce a signal on its own but, wired across the MCU's two oscillator pins with a pair of load capacitors, it forms a very stable tuned circuit that the chip's internal amplifier keeps ringing. An oscillator (XO) is the active version: a self-contained, powered module (often a four-pin metal can) that outputs a finished clock signal you feed straight in.
What it is
On a board you spot a crystal as a small, shiny metal can with two legs, marked with a frequency such as 8.000MHz, 16.000MHz, or 26MHz (the low-profile 32.768kHz watch crystal in a tiny cylinder is common for real-time clocks). The photo shows the classic HC-49 style cans next to a matchstick for scale. Related parts:
| Component | Pins | Note |
|---|---|---|
| Crystal (XTAL) | 2 | Passive, needs external load caps |
| Ceramic resonator | 3 | Load caps integrated, less precise |
| Oscillator (XO) | 4 | Active, powered, clock output built in |
Why it matters
The clock is timing, and timing is attackable. Every instruction, every comparison, every branch of a security check happens on a clock edge. If you can disturb that clock at exactly the right instant, you can make the CPU skip or misexecute a single instruction, which is the basis of clock glitching, a fault-injection technique. Skip the instruction that branches on a failed password compare, or the one that enforces a secure-boot signature result, and a check that should have blocked you passes. The crystal is also a quick liveness probe: a running clock means the chip is powered and executing.
How you attack it
- Locate the clock. Find the crystal next to the MCU and identify its two oscillator pins (or the single output of an XO).
- Confirm it is running. Put an oscilloscope on the pin; you should see a clean sine (crystal) or square wave (XO) at the marked frequency.
- Take over the clock. For controlled glitching, remove or override the on-board source and feed the MCU an external clock you command, for example from a
ChipWhisperer. - Inject at the right moment. Introduce a brief perturbation (a shortened or extra clock cycle) timed to land on the target instruction, typically around a password check, an authentication branch, or secure-boot verification.
Pitfalls
- Load capacitance matters. A crystal only oscillates cleanly with the right load caps; wrong values give an off-frequency or dead clock. This is a real board-bring-up bug, not just an attack detail.
- Crystal vs oscillator. Do not treat a passive crystal like an active XO. A crystal produces nothing without the MCU's amplifier and its caps; an XO drives a clock on its own.
- Glitching is destructive and finicky. Fault injection can corrupt or brick the target and needs precise timing; expect many attempts and use a board you can afford to lose.
- Internal oscillators exist. Many modern MCUs can run from an internal RC oscillator with no external crystal at all, so the absence of a crystal does not mean the chip is dead, and glitching the (missing) external clock will do nothing.