Approved_users, administrator
366
edits
| As of August 2020 the site you are on (wiki.newae.com) is deprecated, and content is now at rtfm.newae.com. |
Changes
no edit summary
self.api = api
</syntaxhighlight>Add 2 methods, one for setting the reset pin low, and one for setting the reset pin high. Having two methods will help make triggering off the glitch more precise:<syntaxhighlight lang="python">
def turn_offrst_low(self, scope, target, project): self.apiscope.setParameter([io.nrst = 'CW Extra Settingslow', 'Target IOn GPIO Mode', 'nRST: GPIO', 'Low']) def turn_onrst_high(self, scope, target, project): self.apiscope.setParameter([io.nrst = 'CW Extra Settingshigh', 'Target IOn GPIO Mode', 'nRST: GPIO', 'High'])
</syntaxhighlight>Add a method to update the glitch parameters and tell the glitch explorer window about them. In this case, we care about the repeat (will determine how wide the glitch is) and the offset of the glitch from the trigger (how long after resetting the glitch happens). The following method covers a wide range, so you'll probably want to narrow things down a bit. Glitches between 5100 and 5300 with a repeat around 10 (on the board we used, glitching at 5211 with a repeat of 10 produced a lot of successes, while another worked better at 5181/11) seem to bypass the bootloader the best:<syntaxhighlight lang="python">
def update_parameters(self, scope,taret,project):
self.ge_window.add_data("Glitch Offset", scope.glitch.ext_offset)
self.ge_window.add_data("Glitch Repeat", scope.glitch.repeat)
</syntaxhighlight>Create a method that checks the read protect status of the device. In this case, we'll need to setup the bootloader as described earlier and try a read. We can tell if the glitch is successful based on what is returned when we try to do a read command. To get access to the CW-Lite's UART, we'll need to use the target's serial driver via self.api.getTarget()target.ser.
Note that the delays are used to allow time for the device to respond. If you wanted to make this communication more reliable, you could read what is sent back and check it against what you expect:<syntaxhighlight lang="python">
def check_read_protect(self, scope, target, project):
driver = self.api.getTarget()target.ser driver.terminal_flushflush() driver.terminal_writewrite("?")
time.sleep(0.05)
driver.terminal_writewrite("Synchronized\r\n")
time.sleep(0.05)
driver.terminal_writewrite("12000\r\n")
time.sleep(0.05)
driver.terminal_writewrite("R 0 4\r\n")
</syntaxhighlight>Finally, you'll need to create your class and register its methods with the aux module. In this case, we're want to update the glitch parameters before the trace is taken, set the reset pin low before we arm, set it high after we arm, and check the read protect after we do the glitch:<syntaxhighlight lang="python">
glitcher = LPC_glitch(self.glitch_explorer, self.api)
def check_read_protect(self, scope, target, project):
driver = self.api.getTarget()target.ser driver.terminal_flushflush() driver.terminal_writewrite("?")
time.sleep(0.05)
driver.terminal_writewrite("Synchronized\r\n")
time.sleep(0.05)
driver.terminal_writewrite("12000\r\n")
time.sleep(0.05)
driver.terminal_writewrite("R 0 4\r\n")
def do_glitchrst_low(self, scope, target, project): self.apiscope.setParameter(['CW Extra Settings', 'Target Power State', False]) timeio.sleep(0.01) self.api.setParameter([nrst = 'CW Extra Settingslow', 'Target Power State', True]) scope.glitch
def turn_offrst_high(self, scope, target, project): self.api.setParameter(['CW Extra Settings', 'Target IOn GPIO Mode', 'nRST: GPIO', 'Low']) def turn_on(self, scope, target, project): self.apiio.setParameter([nrst = 'CW Extra Settingshigh', 'Target IOn GPIO Mode', 'nRST: GPIO', 'High'])
scope.clock.adc_src = "clkgen_x1"
scope.trigger.triggers = "tio3"
scope.io.hs2 = None
