Wiki / Hardware

Oscillator & Crystal

The clock source that paces the chip. A passive crystal or an active oscillator sets the beat every instruction marches to, which makes it a prime target for glitching and fault injection.

Oscillator & Crystal
Crystal wired across the MCU oscillator pins
MCU Crystal XTAL1 / OSC_IN XTAL2 / OSC_OUT Pin 1 Pin 2
A passive crystal needs two load capacitors (typically 12-22 pF), one from each pin to ground, chosen to match the crystal's specified load capacitance. An active oscillator (XO) skips this: it is a powered can with a single clock output you feed straight into the MCU's clock input.

A crystal or oscillator supplies the reference clock that paces everything a chip does. A crystal (XTAL) is a passive quartz resonator: it does not produce a signal on its own but, wired across the MCU's two oscillator pins with a pair of load capacitors, it forms a very stable tuned circuit that the chip's internal amplifier keeps ringing. An oscillator (XO) is the active version: a self-contained, powered module (often a four-pin metal can) that outputs a finished clock signal you feed straight in.

What it is

On a board you spot a crystal as a small, shiny metal can with two legs, marked with a frequency such as 8.000MHz, 16.000MHz, or 26MHz (the low-profile 32.768kHz watch crystal in a tiny cylinder is common for real-time clocks). The photo shows the classic HC-49 style cans next to a matchstick for scale. Related parts:

Component Pins Note
Crystal (XTAL) 2 Passive, needs external load caps
Ceramic resonator 3 Load caps integrated, less precise
Oscillator (XO) 4 Active, powered, clock output built in

Why it matters

The clock is timing, and timing is attackable. Every instruction, every comparison, every branch of a security check happens on a clock edge. If you can disturb that clock at exactly the right instant, you can make the CPU skip or misexecute a single instruction, which is the basis of clock glitching, a fault-injection technique. Skip the instruction that branches on a failed password compare, or the one that enforces a secure-boot signature result, and a check that should have blocked you passes. The crystal is also a quick liveness probe: a running clock means the chip is powered and executing.

How you attack it

  1. Locate the clock. Find the crystal next to the MCU and identify its two oscillator pins (or the single output of an XO).
  2. Confirm it is running. Put an oscilloscope on the pin; you should see a clean sine (crystal) or square wave (XO) at the marked frequency.
  3. Take over the clock. For controlled glitching, remove or override the on-board source and feed the MCU an external clock you command, for example from a ChipWhisperer.
  4. Inject at the right moment. Introduce a brief perturbation (a shortened or extra clock cycle) timed to land on the target instruction, typically around a password check, an authentication branch, or secure-boot verification.

Pitfalls

  • Load capacitance matters. A crystal only oscillates cleanly with the right load caps; wrong values give an off-frequency or dead clock. This is a real board-bring-up bug, not just an attack detail.
  • Crystal vs oscillator. Do not treat a passive crystal like an active XO. A crystal produces nothing without the MCU's amplifier and its caps; an XO drives a clock on its own.
  • Glitching is destructive and finicky. Fault injection can corrupt or brick the target and needs precise timing; expect many attempts and use a board you can afford to lose.
  • Internal oscillators exist. Many modern MCUs can run from an internal RC oscillator with no external crystal at all, so the absence of a crystal does not mean the chip is dead, and glitching the (missing) external clock will do nothing.

Further reading