Penthertz
What we test

Embedded hardware and firmware

We open the box: debug ports, firmware, secure boot, and the chip itself under side-channel analysis and fault injection.

Work with us Our research on it
Close-up of a bladeRF SDR circuit board
A software-defined radio board, up close

What an attacker could do

We check it before they do, with the same equipment.

Pull the firmware

Read firmware and secrets through a debug port or flash.

Break secure boot

Defeat unsigned or badly checked updates and boot chains.

Extract keys

Recover keys with side-channel analysis (power, EM).

Glitch it

Skip a security check with fault injection.

What we test

  • Debug ports and external interfaces
  • Firmware, secure boot and update mechanisms
  • Secrets at rest in flash and in the chip
  • Side-channel analysis and fault injection
  • The protocol stacks behind each interface (USB, serial, debug): we hunt for the bugs an attacker with the device in hand could use to take it over

How to work with us

Security auditA review of your architecture and implementation against radio and embedded attacks, including the security requirements of the… CRA & RED readinessFor manufacturers of radio and connected products: we test your product against the cybersecurity requirements of the Radio… Vulnerability researchIn-depth research on a target you choose: protocol fuzzing, baseband analysis and CVE-grade findings, fully documented and disclosed…

Our contributions and posts

Talks, articles and CVEs on this subject.

All publications
2026Blog

The evolution of RH850 hacking: from a DIY to the Pico Glitcher v3
2026Blog

How to Hack Any Micro-controller with a Raspberry Pi Pico: Easy Fault Injection by Traffic Mocking
2026Blog

Unitree Robots Under Fire
2026Blog

3D hardware simulation tool in your browser (LEDs only for now)
2021Trend Micro blog

Protecting LoRaWAN Hardware from Attacks in the Wild
2020OWASP Czech Meetup 2020

Deep dive into LoRa(WAN) RF and Hardware Security

Trainings on this subject

All trainings

No public course on hardware attacks yet: we build a tailored training for your team on debug ports, firmware, side-channel analysis and fault injection.

Private and tailored trainings
Tailored
Tailored Scoped with you
Private and tailored trainings

Built around your stack: baseband fuzzing, Wi-Fi protocol stacks, advanced RFID and NFC with SDR, hardware attacks on embedded systems, and other technologies.

Quote per group Course outline
Private and tailored trainings

Talk to us about your project

We scope the work in a first call, then send a fixed-price proposal: intrusion tests, vulnerability research, fuzzing, test benches, trainings. Offices near Paris, Monday to Friday, 9:00 to 19:00.

Work with us