As of August 2020 the site you are on (wiki.newae.com) is deprecated, and content is now at rtfm.newae.com.

Changes

Jump to: navigation, search

Tutorial A3 VCC Glitch Attacks

3,853 bytes removed, 14:58, 12 April 2018
partial save of complete update of page for cw4.0
<li>
<p>Select the <code>connect_simpleserial.py</code> script</p>
<p>[[File:connect_script.png|400px500px]]</p>
</li>
<li>
<p>Run the <code>connect_simpleserial.py</code> script, by pressing the <b>Run</b> button</p>
<p>[[File:connect_script_preview.png|400px500px]]</p>
</li>
<li>
<p>Setup up the settings by running the appropriate setup script for your device</p>
<p>[[File:setup_script_xmega.png|400px500px]]</p>
</li>
<li>
<p>Run the setup script by pressing the run button, if you want to see what parameters the script changes, inspect the preview</p>
<p>[[File:setup_preview_xmega.png|400px500px]]</p>
</li>
<li>
<p>Open the appropriate programmer from top main menu ''Tools'', and in the dialog press ''Check Signature'' to verify you can connect to the target</p>
<p>[[File:xmega_programmer.png|400px300px]]</p>
</li>
<li>
<p>Find the correct firmware file, previously compiled for the target you are using, and press the ''Erase/Program/Verify FLASH''</p>
<p>[[File:xmega_programmer_press_program.png|400px300px]]</p>
</li>
<li>
<p>Time to setup the voltage glitching parameters. Start with the ''Glitch Module'' section under the ''Scope Settings'' tab</p>
<ol> <li> <p>For the ChipWhisperer-Lite (CW1173/CW1180), set ''Target HS IO-Out'' option to ''CLKGEN''.</p> </li> <li> <p>Set the ''Clock Source'' as ''CLKGEN'':</p> </li> <li> <p>Setup the Glitch Module to NOT output anything by default '''VERY IMPORTANT TO AVOID DAMAGE'''</p> <p>Set the ''Output Mode'' as ''Glitch Only'', this is the step that insures '''you do not cause constant glitches''':</p> </li> <li> <p>Set the ''Glitch Trigger'' to ''Ext Trigger:Single-Shot''</p> </li> </ol> <p>[[File:glitch_setup.png|500px]]</p> </li> <li> <p>Now activate the lower power glitch module, by enabling the ''HS-Glitch Out Enable (Low Power)'' toggle under ''Trigger Pins'' section in the ''Scope Settings'' tab</p> <p>[[File:low_power_glitch_enable.png|500px]]</p> </li> <li> <p> Navigate to the ''Target Settings'' tab and remove all the text in the ''Load Key Command'', ''Go Command'', and ''Output Format'' fields</p> <p> Set the ''Output Format'' field to ''r$GLITCH$\n''</p> <p>[[File:target_output_setting.png|500px]]</p> </li>
<ol>
<li><p>Setup the CLKGEN Module to Generate a 7.37 MHz clock and route it through the Glitch Generator</p>
<blockquote><ol style="list-style-type: decimal;">
<li>Switch the ''Freq Counter Src'' to the ''CLKGEN Output''</li>
<li>Set the ''Desired Frequency'' to 7.37 MHz. Note you should only adjust the 'frequency' portion of this, if you highlight the entire field you may not be able to type the frequency into the system.</li>
<li>Confirm the ''DCM Locked'' checkbox is checked, if not hit the ''Reset CLKGEN DCM'' box. Check the ''Freq Counter'' to ensure the system is correctly generating about a 7.37 MHz clock.</li>
<li><p>Under the ''Glitch Module'' set the ''Clock Source'' as ''CLKGEN'':</p>
<p>[[File:glitchgen-clkgen.png|image]]</p></li>
<li><p>Set the ''Target HS IO-Out'' appropriately. This depends on the hardware in use:</p>
<blockquote><ol style="list-style-type: lower-alpha;">
<li>For the ChipWhisperer-Lite (CW1173/CW1180), set ''Target HS IO-Out'' option to ''CLKGEN''.</li>
 
<li><p>Connect the Serial Port</p>
<blockquote><ol style="list-style-type: decimal;">
<li>For the XMEGA Target (including the CW-Lite integrated target), perform the following:
<ol style="list-style-type: lower-alpha;">
<li>Switch to the ''Scope Settings'' tab, and scroll down to ''Target IOn Pins''</li>
<li>Switch the ''Target IO1'' to be ''Serial RXD''</li>
<li>Switch the ''Target IO2'' to be ''Serial TXD''</li></ol>
</li>
<li><p>From the ''Tools'' menu select ''Open Terminal'', and press ''Connect'' on the terminal:</p>
<blockquote><p>[[File:termconn.png|image]]</p></blockquote></li>
<li>The baud rate for this system is 38400, which should be the default for the ChipWhisperer serial port.</li></ol>
</blockquote></li>
<li><p>Program the <code>.hex</code> file into the target. When programming the AVR, it needs a working clock source before the programming will succeed. Now that this is enabled, you can use the appropriate programmer (such as the AVR or XMEGA programming from the ''Tools'' menu if using a CW-Lite) to program the hex file.</p>
<p>You should see the &quot;Hello&quot; message printed on the terminal emulator window.</p>
<blockquote><p>'''warning'''</p>
<p>Releases of the ChipWhisperer-Capture software prior to 0.13 had a bug in the AVR reset logic, which never released the device from reset. You must update your ChipWhisperer-Capture release in order to complete this tutorial.</p></blockquote></li>
<li><p>Setup the Glitch Module to NOT output anything by default '''VERY IMPORTANT TO AVOID DAMAGE'''</p>
<blockquote><ol style="list-style-type: decimal;">
<li><p>Under the ''Glitch Module'' set the ''Output Mode'' as ''Glitch Only'', this is the step that insurances '''you do not cause constant glitches''':</p>
<blockquote><p>[[File:glitchexample-capsetup1.png|image]]</p></blockquote></li>
<li><p>For the ChipWhisperer-Lite (CW1173 or CW1180):</p>
<blockquote><ol style="list-style-type: lower-alpha;">
<li><p>Under the ''Glitch Module'' set the ''Clock Source'' as ''CLKGEN''</p>
<blockquote><p>[[File:glitchexample-capsetupclkgen.png|image]]</p></blockquote></li>
<li><p>Check the box marked ''HS-Glitch Out Enable (Low Power)'':</p>
<blockquote><p>[[File:glitchexample-capsetup2B.png|image]]</p></blockquote></li></ol>
</blockquote></li>
<li><p>For the ChipWhisperer-Capture Rev 2 (CW1002):</p>
<blockquote><ol style="list-style-type: lower-alpha;">
<li><p>Under the ''Glitch Module'' set the ''Clock Source'' as ''TargetIO-IN'':</p>
<blockquote><p>[[File:glitchexample-capsetup2.png|image]]</p></blockquote></li>
<li><p>Under the ''Target HS IO-Out'' option select the ''Glitch Module'', ensuring you've already set the ''Output Mode'' as ''Glitch Only'' under ''Glitch Module'':</p>
<p>[[File:targioout.png|image]]</p></li></ol>
</blockquote></li></ol>
</blockquote></li>
<li><p>Switch the ''Glitch Trigger'' mode to ''Ext Trigger:Single-Shot'':</p>
<p>[[File:singleshot.png|image]]</p></li>
<li><p>Switch to the ''General Settings'' tab, and select the appropriate &quot;Auxiliary Module&quot;:</p>
<ol style="list-style-type: lower-alpha;">
<li>For ChipWhisperer-Lite (CW1173/CW1180), select &quot;Reset AVR/XMEGA via CW-Lite&quot;</li>
<li>For ChipWhisperer-Capture Rev 2, select &quot;Reset AVR via ISP-MKII&quot;</li></ol>
 
<p>[[File:glitching_aux_1.png|image]]</p></li>
<li>Switch to the ''Aux Settings'' tab. Depending on your module you will see different settings here, for example the ChipWhisperer-Lite lets you select between AVR and XMEGA targets. This normally defaults to the &quot;XMEGA&quot; device, so be sure to switch this to the &quot;AVR&quot; device if using the NOTDuino or Multi-Target boards!</li>
<li><p>Press the ''Test Reset'' button in the ''Aux Settings'' tab. This should reset the AVR target. Confirm this by monitoring the terminal emulator window, and check the startup message (of &quot;hello&quot;) is printed again.</p><p>You can also use the &quot;Reset&quot; button on the NOTDuino to confirm the startup message is printed.</p></li><li>Switch to the ''Target Settings'' tab, and remove all the text in the ''Load Key Command'', ''Go Command'', and ''Output Format'' fields.</li></ol>
Optionally, you can also configure the power measurement setup too:

Navigation menu