IMC 2026Live demo · 01 of 02
Entra × IIT Dharwad

Secure boot, link by link

Before the tyre sensor runs a single instruction, silicon decrypts and measures the bootloader, and the bootloader proves the application was signed by the factory. Pick an attack and watch where the chain stops it.

Core
RISC-V RV32IMC
Clock
3.39 MHz
Process
GF 130 nm BCD
Cipher
AES-128-CBC
Measure
SHA-256
Signature
Ed25519
In the tyre SENSOR MODULE QSPI flash BOOT · AES · SHA RISC-Vcore SRAM TPMS SoC TPMS ECU WAITING 433 MHz RX Valve-stem sensor module In the vehicle

Choose a boot image

  • Checking now
  • Passed
  • Rejected
  • Fault
  • Not reached
  • Radio to ECU
Silicon: hardware boot controllerruns with the CPU held in reset
    CPU reset line: held
    Firmware: measured bootloader (FSBL)first code the RISC-V core executes
      Verdict
      Waiting for power
      Select a boot image, then press Power on.
      Boot narrator · UART 115200secure boot enabled
      TPMS SoC · press Power on  

      Byte inspector

      QSPI flash layout

      8 Mbit NOR
      0x000000Root of trust · "TRT1" · 136 B · CRC-32
      0x001000Boot header · magic 0xB0075EC0 · IV · CRC
      + headerFSBL · encrypted · hash pinned in RoT
      + FSBLApp blob · "APP\0" · version · key · signature
      Root of trust and boot image both sit in partition P0 (0x000000–0x07FFFF), which the flash controller write-protects against firmware.