CAPABILITIES

Product Overview

Pattern Detector
Pattern Dettector image 2
Built for smartcard campaigns

Designed specifically to remove the setup difficulties of working with smartcard targets in side-channel or fault injection testing.

Flexible probe and sample setup

XYZ motorised CNC stage lets you position EM probes around the DUT and accommodate different form factors.

Repeatable, micron-level positioning

1 µm XYZ resolution and ±5 µm XY repeatability let you return to the exact same point on the DUT across multiple injection attempts.

esDynamic native

Integrates directly with esDynamic as a Python device for scripted configuration, control, and acquisition workflows.

Improved acquisition consistency

Detects specific events on power or EM signals, ensuring more accurate and repeatable fault injection and side-channel acquisitions over time.

Accurate power measurement

Precisely measures the power consumption of contact smartcard DUTs for side-channel analysis.

esDynamic native

Integrates directly with esDynamic as a Python device for scripted configuration, control, and acquisition workflows.

esDynamic native

Integrates directly with esDynamic as a Python device for scripted configuration, control, and acquisition workflows.

Fully motorised XYZ control

Unlike manual Z-axis setups, every axis here is motorised, so the entire probe position can be driven by joystick or script without manual readjustment.

Built for PQC and asymmetric crypto

Up to 500 Mpts channel memory, with extensions offered by default to handle memory-demanding asymmetric and post-quantum cryptography workloads (removable upon request).

Built-in signal amplification

The RF3 set ships with a dedicated 30 dB pre-amplifier (PA 303); the ICR probe has its amplifier integrated directly into the housing, powered by a bias tee, for clean signal capture without extra setup.

Shielded for accurate measurement

Electrically shielded against electric field coupling, so what you measure is the magnetic field you're after, not stray interference.

Frontside and backside access

The daughter board extension exposes both sides of the smartcard, simplifying probe positioning for EM acquisition or laser fault injection.

Probe from both sides

Magnetic legs hold the DUT firmly while you probe, with the design supporting access to both sides for more injection points.

Sub-millimeter resolution

Both probe types resolve magnetic fields at under 1 mm, letting you isolate leakage from individual components rather than picking up surrounding noise.

Precise timing control

Lets you define exact on/off timings for the power cycle, fitting the needs of your test setup.

Compatible probe holder

Designed for eShard EMFI probes, Langer EMA probes, and fixation for high-end Langer ICR probes.

Custom resolutions available

Better resolutions or different bandwidths available on request, for specialized measurement needs.

Magnified DUT view

Digital microscope with articulated camera holder for a zoomed, magnified view of the DUT.

Fine probe alignment

The ICR probe includes adjustment screws for manual alignment of the probe tip, letting you fine-tune positioning precisely over the target.

Proven on real SoC targets

Selected through practical experimentation on System-on-Chip devices, not generic specs, so you start with probes already validated against modern SoCs.

Covers positive and negative pulses

Two anti-bounce devices are included, one for each pulse polarity, so you're equipped for both without extra purchases.

Manual and programmatic control

Gamepad-based joystick for manual alignment or full programmatic control via esDynamic, delivering an XYZ resolution of 0.05 mm.

High-resolution acquisition

12-bit resolution captures the fine signal detail needed for side-channel leakage analysis.

Documented probe characteristics

eShard provides notebooks (or a PDF for non-esDynamic users) detailing each probe's characteristics, so you know exactly what you're working with.

Ready to mount

Comes with a probe holder and SMA/SMA connectors, so the kit is usable out of the box.

Cleaner, more repeatable faults

The included anti-bounce devices filter out signal reflections in the EM pulse, giving you sharper, more controllable, and more repeatable fault injection.

High bandwidth and sampling rate

4 GHz bandwidth and up to 20 GS/s sampling rate, suitable for SoC and FPGA targets.

Dual-pulse option for two-pulse attacks

The dual pulse version adds a second, independently delayed pulse (1 ns to 1 μs after the first), for attacks that require two coordinated fault events.

Fine control at the fault boundary

500 ps rise time and delay adjustment steps down to 100 ps let you dial in on the exact threshold where fault effects start, without overshooting into device damage.

High peak power where it matters

Up to 3000 V peak voltage at 50 Ω load.

Countermeasure bypass

Detects the execution of fault injection countermeasures, such as kill cards, and triggers a response (e.g. powering off the DUT) before the countermeasure takes full effect.

Built-in triggering, no extra equipment needed

Internal and external triggers, single-pulse command, and finely tunable delay are integrated into the generator, so most setups don't need a separate trigger controller.

Flexible control interfaces

Manages the DUT power source through USB and/or jack ports.

esDynamic native

Integrates directly with esDynamic as a Python device for scripted configuration, control, and acquisition workflows.

Precise triggering

Real-time pattern detection up to 500 MHz with <3.1 ns 1 ns trigger-out jitter, for tightly synchronized acquisitions and pulses.

esDynamic native

Integrates directly with esDynamic as a Python device for scripted configuration, control, and acquisition workflows.

Protected integration

eShard provides matched cables and an attenuator, so connecting the generator to other equipment, like your oscilloscope, doesn't risk damaging it.

Automated recovery

Power-cycles the DUT automatically when it crashes, keeping fault injection campaigns running without manual intervention.

under the hood

Technical Specifications

Property Value
Resolution 8 bits
Sampling Rate 1 GS/s
Bandwidth 500MHz
Inputs DC coupled, 50 Ω input impedance
Samples patterns 2 x 1024 samples patterns or 1 x 2048 samples patterns
Memory 100MS when used with pattern matching trigger
Why us

Built by experts, not vendors.

With over 10 years running physical attacks against real targets, our hands-on experience shapes every device we qualify for our catalog, the same hardware we put to work on our own attacks before it ever reaches you.

FAQ

Frequently Asked Questions

We are always here to help you and answer your questions.

We are always here to help you and answer your questions.

Do I need specific software to use this hardware? 

Lorem ipsum dolor sit amet

Can I use my existing equipment with eShard's hardware?

Lorem ipsum dolor sit amet

What does support and maintenance look like?

Lorem ipsum dolor sit amet

Do you offer services for building a complete lab?

Lorem ipsum dolor sit amet