Behold the graveyard of Baochips!
Security testing is hard, after the chips are locked the only recourse is to desolder and replace them when a test goes wrong or an attack sensor is tripped.
On the upside, I'm getting really good at reworking CSPs.
Security testing is hard, after the chips are locked the only recourse is to desolder and replace them when a test goes wrong or an attack sensor is tripped.
On the upside, I'm getting really good at reworking CSPs.
January 23, 2026 at 7:54 AM
Behold the graveyard of Baochips!
Security testing is hard, after the chips are locked the only recourse is to desolder and replace them when a test goes wrong or an attack sensor is tripped.
On the upside, I'm getting really good at reworking CSPs.
Security testing is hard, after the chips are locked the only recourse is to desolder and replace them when a test goes wrong or an attack sensor is tripped.
On the upside, I'm getting really good at reworking CSPs.
Woo hoo! just in time: tape & reel packaged Dabao for #39c3. They will be at the #fail0verflow assembly with @bunnie.org .
Also come see our talk on Day 2 23:00 in Room 1: "Xous: A Pure-Rust Rethink of the Embedded Operating System", where bunnie & xobs will co-present on Xous running on Baochip!
Also come see our talk on Day 2 23:00 in Room 1: "Xous: A Pure-Rust Rethink of the Embedded Operating System", where bunnie & xobs will co-present on Xous running on Baochip!
December 21, 2025 at 5:29 AM
Woo hoo! just in time: tape & reel packaged Dabao for #39c3. They will be at the #fail0verflow assembly with @bunnie.org .
Also come see our talk on Day 2 23:00 in Room 1: "Xous: A Pure-Rust Rethink of the Embedded Operating System", where bunnie & xobs will co-present on Xous running on Baochip!
Also come see our talk on Day 2 23:00 in Room 1: "Xous: A Pure-Rust Rethink of the Embedded Operating System", where bunnie & xobs will co-present on Xous running on Baochip!
The basic dev board is in! Meet the "Dabao", a simple breakout board for the Baochip-1x.
If you're interested in one and will be at #39C3, come find @bunnie.org at the fail0verflow assembly. He'll have a limited number of Alpha-1 release boards to give away!
Source at github.com/baochip/dabao
If you're interested in one and will be at #39C3, come find @bunnie.org at the fail0verflow assembly. He'll have a limited number of Alpha-1 release boards to give away!
Source at github.com/baochip/dabao
December 14, 2025 at 7:00 AM
The basic dev board is in! Meet the "Dabao", a simple breakout board for the Baochip-1x.
If you're interested in one and will be at #39C3, come find @bunnie.org at the fail0verflow assembly. He'll have a limited number of Alpha-1 release boards to give away!
Source at github.com/baochip/dabao
If you're interested in one and will be at #39C3, come find @bunnie.org at the fail0verflow assembly. He'll have a limited number of Alpha-1 release boards to give away!
Source at github.com/baochip/dabao
The first cut of the code missed a branch delay slot, and so the two paths were different by three cycles.
Open source means you can simulate code running on your chip, and be sure you got it right!
Open source means you can simulate code running on your chip, and be sure you got it right!
December 1, 2025 at 4:38 PM
The first cut of the code missed a branch delay slot, and so the two paths were different by three cycles.
Open source means you can simulate code running on your chip, and be sure you got it right!
Open source means you can simulate code running on your chip, and be sure you got it right!
It's nice to be able to simulate your constant-time code and prove to yourself that you got it right.
Pictured is a simulation of AES chaffing, where fake and real data are computed in a random order. The timing of fake->real and real->fake has to be identical in order to mask power side channels.
Pictured is a simulation of AES chaffing, where fake and real data are computed in a random order. The timing of fake->real and real->fake has to be identical in order to mask power side channels.
December 1, 2025 at 4:38 PM
It's nice to be able to simulate your constant-time code and prove to yourself that you got it right.
Pictured is a simulation of AES chaffing, where fake and real data are computed in a random order. The timing of fake->real and real->fake has to be identical in order to mask power side channels.
Pictured is a simulation of AES chaffing, where fake and real data are computed in a random order. The timing of fake->real and real->fake has to be identical in order to mask power side channels.
Block diagram of the chip now up on the bao1x repo!
November 25, 2025 at 10:50 AM
Block diagram of the chip now up on the bao1x repo!
Backside IR image of the chip!
The Baochip-1x is packaged specifically to enable you to verify that you've got the correct chip, and not a fake or a substitute part (see bunnie.org/iris for how).
The final chip will have part numbering that overlaps the memory array on the lower third of the chip.
The Baochip-1x is packaged specifically to enable you to verify that you've got the correct chip, and not a fake or a substitute part (see bunnie.org/iris for how).
The final chip will have part numbering that overlaps the memory array on the lower third of the chip.
November 17, 2025 at 4:19 AM
Backside IR image of the chip!
The Baochip-1x is packaged specifically to enable you to verify that you've got the correct chip, and not a fake or a substitute part (see bunnie.org/iris for how).
The final chip will have part numbering that overlaps the memory array on the lower third of the chip.
The Baochip-1x is packaged specifically to enable you to verify that you've got the correct chip, and not a fake or a substitute part (see bunnie.org/iris for how).
The final chip will have part numbering that overlaps the memory array on the lower third of the chip.
Closeup view of the back side of the chip itself!
November 12, 2025 at 4:48 AM
Closeup view of the back side of the chip itself!
CHIIIIIIPS!!!
12" wafer of CSP bumped chips, hot off the line (solder balls are face-up in this photo, with a couple die already removed for testing).
12" wafer of CSP bumped chips, hot off the line (solder balls are face-up in this photo, with a couple die already removed for testing).
November 10, 2025 at 10:16 PM
CHIIIIIIPS!!!
12" wafer of CSP bumped chips, hot off the line (solder balls are face-up in this photo, with a couple die already removed for testing).
12" wafer of CSP bumped chips, hot off the line (solder balls are face-up in this photo, with a couple die already removed for testing).
A killer app for SoC source code is debugging your code with RTL simulation. Simulation gets you cycle-accurate views into what's happening throughout the system - the program counter, registers, state machines.
Learn more on how to simulate the Baochip-1x here: baochip.github.io/baochip-1x/c...
Learn more on how to simulate the Baochip-1x here: baochip.github.io/baochip-1x/c...
November 8, 2025 at 7:19 PM
A killer app for SoC source code is debugging your code with RTL simulation. Simulation gets you cycle-accurate views into what's happening throughout the system - the program counter, registers, state machines.
Learn more on how to simulate the Baochip-1x here: baochip.github.io/baochip-1x/c...
Learn more on how to simulate the Baochip-1x here: baochip.github.io/baochip-1x/c...