hack@ches-submission

Submission package for Hack@CHES 2026 Phase 1 - Team KattangalSec. 17 unique bugs in the competition OpenTitan RTL, organized one folder per bug in the Hack@CHES bug-submission format, with exploit + testbench artifacts and raw logs.

• Site / bug index: index.md
• Bug pages: bugs/ - bug-01 … bug-17

Numbering

New continuous numbering 01-17 (Type 1 first, then Type 2). Legacy working-set numbers are noted per page.

Range	Meaning
01-04	Type 1 - unprivileged software (PMP, CTN, KeyMgr, AES masks)
05-17	Type 2 - physical (JTAG, fault injection, side channel, environmental)

Per-bug structure

bug-XX-<slug>/
├── README.md      - submission-form format (Finding, Location, Detection, Impact,
│                     Adversary, Mitigation, CVSS, New/AI/LLM tools, …)
├── exploit/       - README.md (reproduction) + code/ + raw logs/
└── testbench/     - README.md (reproduction) + code/ + raw logs/

Status conventions

• ** demoed** - the exploit was successfully run (bugs 01, 02, 05, 10, 12, 14).
• code - exploit code present; not marked as demoed.
• attack flow - no standalone software exploit; the testbench is the attack script (Type 2 convention).

LLM-related fields

Fields for LLM use (LLM Details, Online LLM Details, LLM Prompts) are placeholders across all bug pages. They will be filled in a later pass together with LLM transcripts and context details.

Regeneration

The two scripts under tools/ are one-shot assembly helpers:

• populate_files.py - copied code/ + logs/ from the working copies (afl-bugs/, vcs-bugs/) into the per-bug exploit/ and testbench/ folders.
• gen_subreadmes.py - generated the exploit/README.md and testbench/README.md reproduction docs.

Hand-written content (the per-bug README.md submissions, index.md, this file) is not regenerated.