We study the security and correctness of the lower levels of computing. We find vulnerabilities deep in hardware and systems, and build the defenses that protect against them.
Four small games, one per research theme, with levels, a shop, and a daily chip. Sound is on, and the button turns it off.
Fuzzing & validation
Information-flow tracking
Formal verification
DRAM & Rowhammer
Bugs crawl out of the chip and come down the board. The harness fires on its own: steer it, chain kills for a multiplier, and catch what the bugs drop. A chip is fuzzed once its clock runs out and its errata boss is dead. Every chip brings a new floorplan, a new kind of bug, and a shop where points buy harness upgrades. Bugs that get past you cost points, and every fifth one a life.
Bugs foundComboChipTimeLivesFind the bugs before tape-out.Steer with the arrow keys or by dragging. Space for a power cycle.Drag to steer the harness. Tap Power cycle in the frame to clear the board.Harness crashed.EscapedWave {n} of {m}Errata fixedSpread shotShield upRapid firePower cycleDrone strafe+1 power cycle{n} bugs squashed on this chipErrata shipped unfixed: −1 lifeEscaped: −150{name} breached: −{n}Blocks kept clean: {n} of {m} · {p}% off the shopClean chipHarness crashedChip {n} of {m} fuzzedTape-out! Chip signed off.8 chips to tape-outChip {n} of {m}Shipped with bugs: −1 lifeNew bug: glitches dart and jumpNew bug: Rowhammers sweep and drop faultsNew bug: Spectres fade in and outNew bug: worms take five hitsNew bug: mimics pose as chocolateOverclockChocolate wingsNeedleMagnetSpare coreReset buttonBoot shieldSidekickErrata sheetSalvoCoolantAfterburnerVacuumTurretDebuggerSeeker roundsTwin barrelsUnderclockHeavy roundsReflowSpare dieCryo bombSelf-testLoot senseSteady handsBandolierCoverage bonusSpare die: one more lifeShots come faster.Three shots in a fan, always.Shots go through one more bug.Pickups nearby drift to you.One more life.One more bomb on every chip.Every chip starts with a shield.A drone that fires beside you.Bosses take half again as much damage.Every fourth volley fans out.Brown-outs and thrashing last half as long.Move a quarter faster.Every pickup drifts to you.A turret fires from the bottom edge.Armored bugs take double damage.Shots steer toward the nearest bug.Two shots side by side.Bugs crawl fifteen percent slower.One more damage to tough bugs.A broken shield grows back in twenty seconds.Once per run, the last life comes back.A bomb freezes the survivors for two seconds.A life back at the end of each chip.Pickups drop twice as often.The combo survives an escape.A bomb for every fifteen bugs found.Thirty percent more points per bug.FirepowerHarnessCrewClock gatingBrown-outBug stormThe hydra splitsTitan slamVoltage spike: rapid fireDebug window: bugs slowed and revealedCache thrash: bugs speed upSilicon lotteryFault injectionA golden bug!Golden bug squashedArmoredExposedErrata bossHydra bugHeisenbugRowhammer titanRace conditionBuffer overflowThe bug that shippedCut one, two growThere when you don't lookSlams the dieTwo threads, one lockOne byte too manyYou'll find me in the sheet. Page 40.Every fix is two more bugs.Attach a debugger and I vanish.Every row I hit flips.First to the lock wins. I'm both.0xFF, and one more.Filed under fixed.No heads left to grow.Observed. Collapsed.Refreshed for good.Serialised.Bounds checked.CrossingBuffer fullIt opens up right after every volley: fire thenIts spawn keeps it safe: squash the worms firstIt can only be hit while it is thereIt is soft only while it turns at the edgesIt opens up as its two runners cross: shoot the crossingHit it while its buffer is full, before it spillsSteady handsThick skinQuick feetLong fuseBargainTaped outPost-siliconProbeNetFetcherIt marks a bug every few seconds: a marked bug is worth doubleIt catches a bug about to escape, then needs a momentIt brings in the pickups you cannot reach{name} joins the harnessMarked ×2NettedFetchedSilicon is back from the fab. Let's see what crawls out.Steer under the beetles. The harness fires on its own.Bugs drop parts. Run over them.Every wave comes faster. The bar at the top is the chip's clock.First bug squashed. Chain kills for a multiplier.One got past. Five escapes ship a bug.Something big stirs under the die.The errata. Watch for the moment it opens up.Errata sheet updated. Ship it, then respin.Respin. New floorplan, new bugs, and I called in help.Beetles spit faults from this chip on. Dodge the crosses.Halfway to tape-out. Armored bugs from here: the hexagon means wait.Mimics look like chocolate. Shoot what moves.Last chip. Tape-out is one errata away.Taped out. Go celebrate.
Values leave the core and travel the wires of the die to its ports. Some are secret. Pick a tower from the bar at the top and tap the board to place it: trackers and sniffers tag tainted values in range but hold only a few tags before you tap them to flush, scrubbers take one value outright and recharge, beacons slow values, and flushers refill the towers around them. Each wave starts with a build phase. Tainted values steer for thin coverage, come in packs, and later jam the trackers around them. A few hand scrubs are there for emergencies. Every wave brings more, and opens a shop.
CaughtComboWaveLeaks leftValues leftGuard the ports.Pick a tower on the bar, tap the board to place it. Tap a tainted value to scrub it by hand. Tap a tower for its menu.Pick a tower on the bar, press the board to place it. Tap a tainted value to scrub it. Drag towers during the build phase.Leaked.LeakedWave {n} of {m} heldDie secured.10 waves to secure the dieWave {n} of {m}Tracker placedTracker fullNot enough pointsOn a wireToo close to a towerKeep clear of the core and the portsOff the edgePlace hereDrop hereTap where it should standRank upSellMoveSold: +{n}MovedMoved: tap to flushDrag towers to move them for freeScrubbed by handNo hand scrub leftFlushedEmpty: tap to flushLeak!Taint spreadSplit!Lucky pingHand scrubsAll clear{n} caught in a row+1 hand scrubDispatch droneNew: armored values take three tags, tanks sixNew: cloaked values and mimics, seen only near a tracker or snifferNew: splitters, swarms, and dashersNew: carriers, phantoms, and encrypted values a sniffer must openNew: jammers freeze towers, leeches drain themNew: healers undo the tags around themNew: bombers drain the towers around themRootkit scrubbedTrojan revealedWorm scrubbedTrojan scrubbedSpectre scrubbedKeylogger scrubbedRecordingPower glitch: buffers dropFirmware update: towers flushedLeak alarm: tainted values rushAudit: hand scrubs refilledFog: values look alikeWormTrojanSpectreRootkitKeyloggerSegment by segmentLooks clean until it doesn'tNever on the wire you thinkOwns the dieRecords every tapTag my tail all you like.Wave me through. I'm clean.Which wire? Wrong one.I was here before your towers.I saw that tap. And that one.Cut at the head.Unmasked at the port.Pinned down.Evicted from ring 0.Log wiped.Scrub the head first: the segments are armored while it livesIt slows down once revealed: pile on thenIt is solid right after a jump: tag it thenIt heals from its swarm: scrub the swarm firstIt jumps to where you tap and records for a moment: tap near your towersRootkit heals from its swarmDecryptedBlast: towers drainedRanked upTop rank alreadyVeteran+{n} bitsMaster key: every tower flushedPatrol droneDeep buffersBoot campExtra gloveQuick flushSpare portBulk orderLucky pingPort guardOverclockSelf-flushCold handsBountyVaultAntennaVault: no life lostDrillSniper doctrineFlush shockGatling doctrineQuick handsTollFull refundSeed moneyJam proofDeep tagFree relocationAlarm dampenerA drone that patrols, tags and flushes.Towers hold one more tag.Towers reach farther.One more scrub charge.A flush is instant.One more life.Towers cost a quarter less.More loot, and a gift every ten seconds.A guard at each port scrubs one value per wave.Towers tag a quarter faster.An empty tower flushes itself after six seconds.A scrub slows the values around it.Loot drops twice as often.The first leak of a wave costs no life.All towers reach a little farther.Towers become veterans sooner.Long reach, slower tagging.A flush slows the tainted values nearby.Fast tagging, shorter reach.Charges come back faster.A quarter more points per catch.Selling a tower returns its full price.Points at the start of every wave.Jammers cannot jam your towers.Armored values need one tag less.Moving a tower keeps its tags.Alarms are over in half the time.Port guard caught itTowersHandCrewValues in {n} sKeen eyeDeep pocketsBig buffersSteady handBargainHoundAuditorCourierIt runs the wires and barks at cloaked and disguised values, which slows themIt refills the emptiest tower every so oftenIt collects the loot for you{name} joins the patrolWoof: revealedAudited: refilled
The trace runs through the state space one state per cycle and never stops. Switch lanes to reach the assertions and to dodge unreachable states, bound walls, and the counterexamples that hunt the trace; hop to skip a state. The solver budget runs down and every assertion tops it up; a timeout costs a trace. Enough assertions prove a bound and open a shop; every bound runs faster and brings a new trick.
AssertionsComboBoundTraces leftBudgetUnroll the trace.Arrow keys or a tap beside the trace change lane. Space or a tap on the trace hops. Hold Down to brake.Tap beside the trace to change lane, tap the trace to hop. Hold Brake in the frame to slow down.Out of traces.Traces lostBound {n} of {m}Unreachable stateCounterexample squashedBound {n} of {m} provedAll bounds proved.10 bounds to proveNew: wormholesNew: bound walls with one gapNew: spurious counterexamples, harmlessNew: state explosionsSolver timeout: −1 traceCaught by a counterexampleSpuriousLemma: shield upCover pointWormhole jumpHopBrakeNext+{n} sState explosionSolver hint: the safe lane glowsDeadline: budget drains fastLemma rainCounterexampleLoopRival solverAbstractionState explosionHop into its lunge to hurt itHop through the ring as it sweeps byProve what it is about to steal, right under itCross it while it is abstract, or hop throughEvery assertion proved contains itTwinsFrenzyFour statesDouble loopLeaves a trailCalls counterexamplesWider, with a gapCollapseChain reactionMeltdown{name} joins the run{name} level {n}RebootingProvedDecoy: counterexample squashedOracle: solver thinksCounterexample refutedLoop brokenRival outrunAbstraction refinedExplosion containedThe trace that failsRound and roundFaster on every assertionThree lanes, no statesTwo to the NOne path is all I need.Every cycle, the same states.I'll prove it first.Too coarse to catch, too wide to pass.More states than you have cycles.No path left.Broken for good.Proved first.Refined away.Bounded.Weak spotStolenOutrunLunge!NondeterminismNondeterministic turnNew: counterexamples hunt the traceGhost passPrunedPrune nowSpare traceClock dividerGhost passPruner botLong hopMagnetSolver budgetLemma libraryProverDecoy traceOracleWitnessInvariantCheckpointCover bountyLensQuick hopTenacityCheckpoint: budget restoredQuick turnsDeep boundShallow boundStorm anchorProof hammerRallyWide trimQuick trimLucky rowsOne more life.The trace runs slower.The hop carries farther.Nearby assertions drift into your lane.Five more seconds of budget.A shield, kept between bounds.One crash forgiven per bound.A trim that clears the lane ahead.A prover that collects assertions ahead.A decoy two lanes over that squashes bugs.An oracle that slows time when danger comes.A witness behind you that gathers lemmas and cover.A shield of its own every twenty seconds.The first timeout of a bound is forgiven.Cover points are worth double.See through nondeterminism.The hop recharges faster.The combo survives a crash.Lane changes are quicker.Assertions worth half again, but faster.Slower, but assertions are worth less.State explosions are over in half the time.Bosses take half again as much damage.Companions reboot twice as fast.The trim clears the lanes beside too.The trim recharges faster.Rows carry more assertions and lemmas.Invariant: shield upSolverTracePartyGoldenGolden assertion proved+1 ghost passSlow clockSpare traceSharp turnsLuckyBargain
Aggressors hammer rows of a DRAM bank and heat the rows beside them until their bits flip. Refresh a row before it gets too hot. You hold three refreshes, and each comes back after a second. Hold a bank for forty seconds to clear it and open the shop.
RefreshesClose callsBankTimeFlips leftHold the rows.Tap a row or press its number to refresh it. Out of refreshes, a tap queues the row. Space for a burst refresh.Tap a row to refresh it. Out of refreshes, a tap queues the row. Burst refresh is in the frame.Bits flipped.Close callsRefreshedBit flip!Close call{n} close calls this bank+1 ECC correctionBurst refreshNew aggressor: {name}HammerSprinterCrabPairStealth hammerHops at randomQuick hops, light blowsWalks row to row, hits hardHammers one row from both sidesHides after every hopFanCanarySentinelIt cools the hottest rowIt sings when a row runs hot and pecks the stealth off hammersHammers that land beside it bounce off{name} joins the bankBank expands: +{n} rowsNext: {name} · {s} sMore rowsGolden rowChirp!BouncedRechargingNo refresh leftQueued {n}UnqueuedBank {n} of {m} heldMemory held.10 banks to holdBank {n} of {m}New: double-sided hammeringNew: the heat reaches two rows awayNew: aggressors hide after hoppingECC correctedTRR bot refreshed a rowHammer King evictedThe Press evictedPhantom evictedThermal spikeCooling burst: tokens refilledVoltage droop: refreshes cost twoECC scrub: +1 correctionRow remap: two rows swappedGolden row: keep it coolGolden row kept coolGolden row lostHammer KingThe PressPhantomHammers hardestThree rows at a timeSeen only when it strikesEvery row is mine to hammer.Why hit one row when I can hit three.Refresh what you cannot see.Dethroned.Pressed flat.Made visible.ShieldedIt is open right after it lands: refresh a row beside it thenIt rests after each slam: refresh a row under it thenIt shows when it strikes: refresh a row beside it thenBot sweepExtra tokenFast chargerECCTurbo burstSpare bankTRR botSensorCoolerScrubberLong queueOverdriveArmored rowsHeat shieldHeat sinksDroop proofHot handsStun hammerSlow burnDeep chillSink powerEarly warningGolden noseQuick sweepTwin sweepBoss brakeSpeed limitChain refreshOne more token.Tokens come back faster.One more bit flip absorbed per bank.The burst recharges faster.One more life.A TRR bot that cools the hottest row.See where the hammers land next.Rows heat ten percent slower.An ECC charge every fifteen seconds.Queue up to five rows.The burst freezes the hammers for two seconds.Weak rows take a little more heat.Thermal spikes are half as hot.A heat sink already installed.A droop no longer doubles the cost.Fast tokens, but rows heat a little faster.A refresh under a hammer stuns it.Rows heat slower, but tokens come back slower.A refresh cools the neighbours twice as much.Heat sinks cut heat to a third.Rows warn earlier.Golden rows are worth double.The bot sweeps more often.The bot cools one more row per sweep.Bosses hop slower.Hammers hop slower.Quick successive refreshes pay extra.ControllerMemoryBotsHeat sink installedCool handsThick wallsSpare fuseQuick burstBargain
Score0
Bugs found0
Combo×1
Chip1
Lives3
Time0:40
Best0
LevelLv 1
Paused
Competence tree
Score
New best!Campaign complete{name} is coming{name} ahead{name} after this wave{name} is enragedStage {n}: {name}Stage {n} of 3{name} level {n}Tap to skipLockedMaxedNeeds {name}Tap a link to see it. The traces light up as you buy.Level {n} of {m}Instead of {name}Halfway there{n} values left{n} assertions to go{name} got you. {hint}Resume · {level}Start overRun resumedBest: level {n} of {m} · {b} bosses beatenGame {n} of 4 · {name}Yes, this is a game. Press Play and I'll explain as we go.Four games, one per research theme. Start with this one.Bugs, taint, proofs, and DRAM. Pick a tab, press Play.Spend points below, then press Continue · {n}Tap one perk to keep going · {n}FarthestNice chainOn fireUnstoppable{n} pointsPoints: {n}{n} pointsLv {n}Level up!Level {n}Pick a perkPoints well spent are points well fuzzed.Reviewer 2 says the harness looks fine. Reviewer 2 is wrong.Everything here is peer reviewed. By me.No refunds. Tape-out is final.Excellent choice. Probably.Sold. Do not read the errata sheet.That one is my favourite. So is the other one.Pleasure doing business. Mind the bite.The chip shipped anyway. They always do.That was a counterexample. Write it up.Bugs happen. Ask any errata sheet.Silicon is unforgiving. Coffee helps.Promoted. The paperwork is on your desk.Level up. Still no tenure.Stronger already. Pick wisely.InternPhD studentPostdocProfessorEmeritusLab rank: {rank} · {xp} XP · {n}/4 games past level 5Unlocked: {name}Fuzzing grantTracker sidekickProof of coolingChocolate traceSecret unlockedTap the big chip at the top of the page seven timesChocolate modeChocolate mode offDaily chip · {date}Named afterArcadePlay at ChocoLab, NUS Computing