// TOM'S HARDWARE US — HARDWARE & GADGET
Techie uses voltage glitching hack to turn $2,500 Nvidia 8GB cryptomining GPU into a full-fat $20,000 A100 with 80GB of VRAM
The most dangerous thing in the world is a bored engineer with a screwdriver. If you see a soldering iron, run for the hills.
When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works.
Enterprising techies looking to build their own local AI cluster have far more interesting options than buying DGX Sparks or Apple Mac Studios. Used data center GPUs are everywhere, and a server rack's garbage is an enthusiast's treasure. This option has become even more popular with CMPunlocker, a soft-mod for Nvidia CMP-170HX cards that unlocks abilities well beyond stock. Now, a techie has taken it a step further, blasting through the remaining limitations with voltage glitching and creating a card faster than the actual $20,000 Nvidia A100 GPU with 80GB of VRAM... but from an $2,500 8GB CMP-170HX mining card.
The volt-mod was done by Kate (GitHub link here), who got her starting point from a paper that described how one could exploit GA100 cards' microcode. She turned her attention to the normally protected onboard fuse controller. Although it's rarely discussed, a "fuse box" has been integral in most any CPU and GPU for a while — though it's normally used once at the factory to break physical connections in chips to parts that have tested poorly, thus disabling them so they can be sold as a lower-end model.
If you're wondering how people are getting 80-40GB of VRAM out of 8-10GB, the explanation is simple: the GA100 silicon actually includes all the corresponding HBM2e VRAM dies within; but they get disabled at the factory like the shader modules. The smaller version is more desirable, as it's based on the variant of GA100 with 80GB of HBM2e within, while the 10GB cards spawn from the 40GB GA100.
The Nvidia cards in question have quite an elaborate eFuse controller (16,384 in a 512 x 32 array) — which can be read to obtain the card's current configuration. Most every part of the card has related fuses: VRAM sections, individual shader modules, PCIe 4.0 and NVLink, and even video codec hardware. However, as Kate succinctly put it: Nvidia's design is insecure, as popping fuses can grant access to more features, not fewer.
Under normal conditions, these fuses can't be popped, or "written to," by the user — but a geek armed with a soldering iron isn't a normal user. Kate had GPT-6 Astra design a simple circuit board based on an $8 STM32G4 microcontroller to tap into the power signals on the card's PCB.
The voltage regulators (VRMs) on the card "speak" PWMVID, an Nvidia standard, and Kate's board intercepted the PWM signals sent into the VRM controller, forcing it to produce voltage glitches on the line feeding the GPU, where the fuse controller lies.
Remember when we said the fuse controller was read-only? With the voltage glitches, many fuse-status reads in a tight loop, and she managed to set the controller to a state in which its security bit flags allowed writes through. From that point, it was "easy" to reconfigure her card. She was careful to force-disable any shader modules previously marked as defective, because these are physical fuses — there's no "undo" button.
Get Tom's Hardware's best news and in-depth reviews, straight to your inbox.