CW308T-STM32X7

CW308T-STM32X7
Target Device	ST STM32F
Target Architecture	Cortex M7, H7
Hardware Crypto	Possible
Design Files	GITHub Link
Status	Beta

THIS IS CURRENTLY A DRAFT, FURTHER READING NOT ADVISED

Supported Devices

The STM32X7 board supports several STM32X7 devices in the UFBGA-176 package. The devices have the same pinout. Various header jumpers can be set different positions to select appropriate power supply for the different power dominans of the device, and different measurements points. The devices in the following table shows two compatible devices:

STM32X7 Series	Package	Device	Hardware AES	TRNG	Tested	Process node	Flash	SRAM	OTP
F7	UFBGA-176	STM32F746IEK6	No	Yes	Yes	90 nm	1MB	320KB	1KB
H7	UFBGA-176	STM32H743IIK6	No	Yes	Yes	40 nm	1MB	320KB	1KB

There are other flavors of the devices with the same pinout, which makes them compatible with this target board.

Power supply

The device must be supplied 3v3, since the device's I/O logic uses 3v3. The logic core uses 1v2.

Internal regulators

The device contains an internal regulator regulating the input voltage down to 1v2. This can however be bypassed by supplying a slightly higher voltage to the target board's 1v2 pin.

Measuring power consumption

The target board contains headers which lets the hacker select where to measure. It is possible to select to measure power on the 3v3 input and the 1v2 input/decoupling. VCAP1 and VCAP2 should be shorted, an only one shunt resistor should be used. It seems that the VCAP pins are from the same power domain, namely the digital core logic domain.

Hardware cryptography

Some flavors of the STM32X7 supports hardware cryptography . The tested devices in the above table do not support hardware cryptography, hence there are no firmware which supports the hardware cryptography yet.

Programming Connection

The target board supports using both JTAG and SWD for programming. An external programmer is needed, e.g. a SEGGER Jlink or a ST-Link.

Example Projects

STM32F7

SimpleSerial builds for the STM32F7 devices using the ChipWhisperer build system. Each device is a separate HAL. These HAL modules have been copied from ST's HAL.

STM32H7

SimpleSerial builds for the STM32H7 devices using Arm Keil uVision. This project could easily be ported to support the ChipWhisperer build system. The Keil-project is also included in the repo. Keil IDE also supports debugging, which is helpful for working out all the kinks in your firmware.

Building ST Example on Command Line

The regular firmware build process works with the STM32 devices. For example, to build `simpleserial-aes`, navigate to the folder `chipwhisperer\hardware\victims\firmware\simpleserial-aes` and run the following command on the command line:

make PLATFORM=CW308_STM32F7 CRYPTO_TARGET=TINYAES128C

Program the device using your preferred method. SEGGER JFlash is a great tool for that. After this, you're ready to go - you can use the ChipWhisperer terminal to talk to your target. You might need to reset the target before you do anything else.

Schematic

Rev -01 Schematic

The current revision of the target is -01. The following shows this schematic:

Hardware

Old Hardware (see RTFM.NEWAE.COM for new)

3rd Party Targets	SAKURA-G Target • SASEBO-W Target
Test Equipment	PicoScope (USB Scope) • VISA Connected Oscilloscope
Obsolete	CW1002 ChipWhisperer Capture Rev2 • CW301 Multi-Target