Fault-Injection might be a useful tool to bypass security features that may obstruct the work of forensic experts. For instance, injecting a fault could modify the target controlflow and compromise its security. When the attacker knowledge is limited about the target software implementation and hardware architecture, discovering a Fault-Injection vulnerability becomes a serious challenge. Another issue is identifying when the targeted vulnerability is executed. To the best of our knowledge, this paper proposes a new methodology to solve these problems for the first time on System-on-Chip (SoC). The first step is to improve the knowledge of security feature implementations. Deviations in the control flow induced by forged inputs can be combined with Side-Channel observations to identify vulnerabilities. The next step is to define a trigger as close as possible in time and prior to these vulnerabilities. At this stage, Electromagnetic Fault-Injection (EMFI) can be put in practice to bypass the targeted security feature. As a proof of concept, we bypassed the Secure-Boot of a Smartphone grade SoC. Three theoretical vulnerabilities in the Secure-Boot architecture of our target are identified using this new methodology and successfully exploited by EMFI.