ChipWhisperer Wiki - User contributions [en]

Template:Hardware

2025-03-18T17:08:14Z

Adewar:

<div id="contents-footer" class="hlist plainlinks selfreference mw-collapsible" style="font-size:100%; margin-top:5px; border:1px solid {{{1|#B8C7D9}}}; background-color:{{{2|#E6F2FF}}}; padding:1em; text-align:left">
<div style="font-size:140%; font-weight:bold">Old Hardware (see https://chipwhisperer.readthedocs.io/en/latest/ for new)</div>
<div class="mw-collapsible-content" style="font-size:100%>
{| class="wikitable"
|-
! 3rd Party Targets
| [[SAKURA-G Target]] • [[SASEBO-W Target]]
|-
! Test Equipment
| [[PicoScope (USB Scope)]] • [[VISA Connected Oscilloscope]]
|-
! Obsolete
| [[CW1002 ChipWhisperer Capture Rev2]] • [[CW301 Multi-Target]]
|}
</div></div>

Template:Hardware

2025-03-18T17:07:49Z

Adewar:

<div id="contents-footer" class="hlist plainlinks selfreference mw-collapsible" style="font-size:100%; margin-top:5px; border:1px solid {{{1|#B8C7D9}}}; background-color:{{{2|#E6F2FF}}}; padding:1em; text-align:left">
<div style="font-size:140%; font-weight:bold">Old Hardware (see https://chipwhisperer.readthedocs.io/en/latest/for new)</div>
<div class="mw-collapsible-content" style="font-size:100%>
{| class="wikitable"
|-
! 3rd Party Targets
| [[SAKURA-G Target]] • [[SASEBO-W Target]]
|-
! Test Equipment
| [[PicoScope (USB Scope)]] • [[VISA Connected Oscilloscope]]
|-
! Obsolete
| [[CW1002 ChipWhisperer Capture Rev2]] • [[CW301 Multi-Target]]
|}
</div></div>

Main Page

2025-03-18T17:07:36Z

Adewar: /* WARNING: This wiki is now deprecated, as of August 2020. Product documentation is moved to https://rtfm.newae.com */

ChipWhisperer® by NewAE Technology Inc. 



== WARNING: This wiki is now deprecated, as of August 2020. Product documentation is moved to https://chipwhisperer.readthedocs.io/en/latest/ ==

Welcome to ChipWhisperer - the complete open-source toolchain for side-channel power analysis and glitching attacks. This is the main landing page for ChipWhisperer. ChipWhisperer has been presented at conferences such as DEFCON and Blackhat, had a [https://www.kickstarter.com/projects/coflynn/chipwhisperer-lite-a-new-era-of-hardware-security successful Kickstarter (that delivered ahead of schedule)], and placed 2nd place in the first annual Hackaday Prize. ChipWhisperer has been used in a number of academic articles, and is featured in the Car Hacking Handbook. Portions of the design have even been used by [http://permalink.lanl.gov/object/tr?what=info:lanl-repo/lareport/LA-UR-15-26344 Los Alamos Labs for an electron accelerator]. You can see a full list of references on the [[Press]] page.

ChipWhisperer is maintained by [https://www.newae.com NewAE Technology Inc.], which sells a combination of open-source hardware, supporting tools, training, and consulting services. ChipWhisperer is trademark of NewAE Technology Inc., registered in the US, Europe, and China. This means only NewAE can sell official products under the ChipWhisperer name, and was done to ensure products meet [[Quality Control Guidelines]], as these fairly complex products require good testing to ensure you don't have a frustrating experience.

Beyond supporting just the ChipWhisperer project, this wiki is now growing towards the objective of offering a complete reference on embedded security.

'''NOTE1: ChipWhisperer V5 is here! CW4 tutorials are available via links on the wiki tutorial pages. CW4 info is available at [[CW4]]'''

== Getting Started ==

Confused on where to begin? If you're new to this area, see the [[V5:Getting Started]] page, which details how you can get involved in side-channel power analysis. From there you can see the hardware documentation (linked below), or take one of the [http://newae.com/training/ Training Courses].

If you're stuck, you can also get help on the [https://forum.newae.com Discussion Forum].

== Hardware Documentation ==

{{Template:Hardware}}

== Software Documentation ==

ChipWhisperer is an open-source project. All of the source code is available from the [https://github.com/newaetech/chipwhisperer Git Repository]. Documentation is available on our [https://chipwhisperer.readthedocs.io/en/latest/index.html Read the Docs page].

For more information about the software releases, see [https://github.com/newaetech/chipwhisperer/releases Releases] or the [https://chipwhisperer.readthedocs.io/en/latest/installing.html installation instructions].

== Sample Projects and Tutorials ==

Tutorials are implemented using Jupyter Notebooks, available in our [https://github.com/newaetech/chipwhisperer-jupyter chipwhisperer-jupyter submodule].

{{Template:Tutorials}}

=== Example Attacks / Other ===

While ChipWhisperer started as a side-channel power analysis platform, it has grown to be useful in other attack types. This section is designed to show you a wide variety of attacks on embedded systems, to give you an idea of what is required for building secure embedded systems. These are held on the page [[Embedded Attacks]].

In 2016, ChipWhisperer was used as part of the CHES2016 CTF challenge. See details of the event on the [[CHES2016 CTF]] page.

See what ChipWhisperer has been used for in the "real world" by reading some [[Academic Papers]] about research using ChipWhisperer.

== Recent/Upcoming Events ==

Upcomming Events:
* NewAE is not physically attending any events in 2020. As of August 2020 this wiki is deprecated, future announcements will be on [https://newae.com newae.com]

These are some past events that were attended by someone from NewAE:
* Embedded World 2020: Exhibit Booth (we were there as a hold-out even with cancellations!)
* Arm TechCon 2019: Exhibit booth!
* [http://HardwareSecurity.training HardwareSecurity.training] event in November - California 4-day training.
* Embedded World 2019: Exhibit Booth
* Black Hat USA 2018: Training, Arsenal Demo
* [http://chesworkshop.org CHES 2018]: Sponsor with exhibit booth
* [http://HardwareSecurity.training HardwareSecurity.training] event in April - Maryland 4-day training.
* Embedded World 2018: Exhibit Booth
* [http://HardwareSecurity.training HardwareSecurity.training] event on November 6-9th in San Francisco, running security training
* [http://chesworkshop.org CHES 2017]: Gold sponsor with exhibit booth
* Blackhat USA 2017 ([https://www.blackhat.com/us-17/training/advanced-hardware-hacking-hands-on-power-analysis-and-glitching-with-the-chipwhisperer.html Hands-on Power Analysis & Glitching with the ChipWhisperer])
* COSADE 2017: Gold sponsor
* Blackhat USA 2016: Training based on ChipWhisperer, 2x talks by Colin, Arsenal
* CHES 2016: Sponsor with exhibit booth
* Blackhat USA 2014: Training class
* RECON 2014: [http://recon.cx/2014/video/recon2014-24-colin-o-flynn-Power-Analysis-and-Clock-Glitching-with-the-Open-Source-ChipWhisperer-Platform.mp4 Video] and [https://www.assembla.com/spaces/chipwhisperer/documents/cnp7Ss_8Sr471aacwqjQXA/download/cnp7Ss_8Sr471aacwqjQXA Slides]
* [http://solidcon.com/solid2014 O'Reilly Solid 2014]: [http://solidcon.com/solid2014/public/schedule/detail/33655 Demo]
* [http://cosade.org/ COSADE] 2014: [http://eprint.iacr.org/2014/204.pdf Paper]
* CHES 2013: [http://www.newae.com/files/CHES2013_Tutorial.pptx Slides] and [http://www.youtube.com/watch?v=UzDx5yx3Qc4&hd=1 Video]
* Blackhat USA 2013
* iSEC Open Security Forum (April 2013)
* Design West 2013
* Blackhat EU 2013
* AtlSecCon 2013
* Blackhat Abu Dhabi 2012

== Extra Notes ==

See the page [[Thanks]] for a note about the people who made this project possible.

ChipWhisperer is a Trademark of NewAE Technology Inc., registered in the U.S, the European Union, and China.

ChipSHOUTER is a Trademark of NewAE Technology Inc., registered in the European Union.

Trademarks used with permission.

Main Page

2023-09-29T13:37:31Z

Adewar:

ChipWhisperer® by NewAE Technology Inc. 



== WARNING: This wiki is now deprecated, as of August 2020. Product documentation is moved to https://rtfm.newae.com ==

Welcome to ChipWhisperer - the complete open-source toolchain for side-channel power analysis and glitching attacks. This is the main landing page for ChipWhisperer. ChipWhisperer has been presented at conferences such as DEFCON and Blackhat, had a [https://www.kickstarter.com/projects/coflynn/chipwhisperer-lite-a-new-era-of-hardware-security successful Kickstarter (that delivered ahead of schedule)], and placed 2nd place in the first annual Hackaday Prize. ChipWhisperer has been used in a number of academic articles, and is featured in the Car Hacking Handbook. Portions of the design have even been used by [http://permalink.lanl.gov/object/tr?what=info:lanl-repo/lareport/LA-UR-15-26344 Los Alamos Labs for an electron accelerator]. You can see a full list of references on the [[Press]] page.

ChipWhisperer is maintained by [https://www.newae.com NewAE Technology Inc.], which sells a combination of open-source hardware, supporting tools, training, and consulting services. ChipWhisperer is trademark of NewAE Technology Inc., registered in the US, Europe, and China. This means only NewAE can sell official products under the ChipWhisperer name, and was done to ensure products meet [[Quality Control Guidelines]], as these fairly complex products require good testing to ensure you don't have a frustrating experience.

Beyond supporting just the ChipWhisperer project, this wiki is now growing towards the objective of offering a complete reference on embedded security.

'''NOTE1: ChipWhisperer V5 is here! CW4 tutorials are available via links on the wiki tutorial pages. CW4 info is available at [[CW4]]'''

== Getting Started ==

Confused on where to begin? If you're new to this area, see the [[V5:Getting Started]] page, which details how you can get involved in side-channel power analysis. From there you can see the hardware documentation (linked below), or take one of the [http://newae.com/training/ Training Courses].

If you're stuck, you can also get help on the [https://forum.newae.com Discussion Forum].

== Hardware Documentation ==

{{Template:Hardware}}

== Software Documentation ==

ChipWhisperer is an open-source project. All of the source code is available from the [https://github.com/newaetech/chipwhisperer Git Repository]. Documentation is available on our [https://chipwhisperer.readthedocs.io/en/latest/index.html Read the Docs page].

For more information about the software releases, see [https://github.com/newaetech/chipwhisperer/releases Releases] or the [https://chipwhisperer.readthedocs.io/en/latest/installing.html installation instructions].

== Sample Projects and Tutorials ==

Tutorials are implemented using Jupyter Notebooks, available in our [https://github.com/newaetech/chipwhisperer-jupyter chipwhisperer-jupyter submodule]. You can also find completed versions of the tutorials on [https://chipwhisperer.readthedocs.io/en/latest/tutorials.html Read the Docs].

{{Template:Tutorials}}

=== Example Attacks / Other ===

While ChipWhisperer started as a side-channel power analysis platform, it has grown to be useful in other attack types. This section is designed to show you a wide variety of attacks on embedded systems, to give you an idea of what is required for building secure embedded systems. These are held on the page [[Embedded Attacks]].

In 2016, ChipWhisperer was used as part of the CHES2016 CTF challenge. See details of the event on the [[CHES2016 CTF]] page.

See what ChipWhisperer has been used for in the "real world" by reading some [[Academic Papers]] about research using ChipWhisperer.

== Recent/Upcoming Events ==

Upcomming Events:
* NewAE is not physically attending any events in 2020. As of August 2020 this wiki is deprecated, future announcements will be on [https://newae.com newae.com]

These are some past events that were attended by someone from NewAE:
* Embedded World 2020: Exhibit Booth (we were there as a hold-out even with cancellations!)
* Arm TechCon 2019: Exhibit booth!
* [http://HardwareSecurity.training HardwareSecurity.training] event in November - California 4-day training.
* Embedded World 2019: Exhibit Booth
* Black Hat USA 2018: Training, Arsenal Demo
* [http://chesworkshop.org CHES 2018]: Sponsor with exhibit booth
* [http://HardwareSecurity.training HardwareSecurity.training] event in April - Maryland 4-day training.
* Embedded World 2018: Exhibit Booth
* [http://HardwareSecurity.training HardwareSecurity.training] event on November 6-9th in San Francisco, running security training
* [http://chesworkshop.org CHES 2017]: Gold sponsor with exhibit booth
* Blackhat USA 2017 ([https://www.blackhat.com/us-17/training/advanced-hardware-hacking-hands-on-power-analysis-and-glitching-with-the-chipwhisperer.html Hands-on Power Analysis & Glitching with the ChipWhisperer])
* COSADE 2017: Gold sponsor
* Blackhat USA 2016: Training based on ChipWhisperer, 2x talks by Colin, Arsenal
* CHES 2016: Sponsor with exhibit booth
* Blackhat USA 2014: Training class
* RECON 2014: [http://recon.cx/2014/video/recon2014-24-colin-o-flynn-Power-Analysis-and-Clock-Glitching-with-the-Open-Source-ChipWhisperer-Platform.mp4 Video] and [https://www.assembla.com/spaces/chipwhisperer/documents/cnp7Ss_8Sr471aacwqjQXA/download/cnp7Ss_8Sr471aacwqjQXA Slides]
* [http://solidcon.com/solid2014 O'Reilly Solid 2014]: [http://solidcon.com/solid2014/public/schedule/detail/33655 Demo]
* [http://cosade.org/ COSADE] 2014: [http://eprint.iacr.org/2014/204.pdf Paper]
* CHES 2013: [http://www.newae.com/files/CHES2013_Tutorial.pptx Slides] and [http://www.youtube.com/watch?v=UzDx5yx3Qc4&hd=1 Video]
* Blackhat USA 2013
* iSEC Open Security Forum (April 2013)
* Design West 2013
* Blackhat EU 2013
* AtlSecCon 2013
* Blackhat Abu Dhabi 2012

== Extra Notes ==

See the page [[Thanks]] for a note about the people who made this project possible.

ChipWhisperer is a Trademark of NewAE Technology Inc., registered in the U.S, the European Union, and China.

ChipSHOUTER is a Trademark of NewAE Technology Inc., registered in the European Union.

Trademarks used with permission.

CW-Capture Tool

2023-08-24T13:33:05Z

Adewar:

'''WARNING: THE CHIPWHISPERER CAPTURE AND ANALYZER TOOLS ARE DEPRECATED. AS SUCH, WE ARE UNABLE TO PROVIDE SUPPORT FOR THESE TOOLS OR RELEASES THAT INCLUDE THESE TOOLS.'''

This tool captures traces from scopes while is also capable of synchronize it with different targets devices.

Main features:
* View the wave form of each trace;
* Save/load/import/edit/manage the traces;
* Run custom capture scripts;
* Automated glitch exploring with a nice scatterplot widget to visualize the result;
* Convenient firmware programmer to flash files to the target board;
* Record traces using fixed/random encryption keys and fixed/random plaintext inputs;
* Serial Terminal
[[File:Screen Shot 2016-07-15 at 10.00.52 AM.png|1100px]]

== The Basics ==
The capture tool comes with a list of built-in scripts to connect to different pairs of target-scope hardwares. The easiest way to start using it is accessing the "Project"->"Example Scripts" menu and select the appropriate item in the list.

If you want more advanced setups, you will have to configure the capture environment manually using the Setting tabs, starting with the "Generic Settings":
# Select the desired "Scope Module" (e.g., ChipWhisperer/OpenADC). Leave it as None if you only want to use the target.
# Select the desired "Target Module" (e.g., Simple Serial). Leave it as None if you only want to use the scope.
# Select the desired "Trace Format" (e.g., ChipWhisperer/Native). Leave it as None if you don't need to save the traces, as often happen when executing the Glitching attack.
# Switch to the "Scope Settings" tab and setup your scope connection (e.g., selecting 'NewAE USB (CWLite/CW1200)').
# Switch to the "Target Settings" tab and setup your target connection (e.g., selecting 'NewAE USB (CWLite/CW1200)').
# Connect to the desired scope/target pair, using the toolbar buttons. The master button connects to both at the same time.
#* At this point, you may want to flash the desired firmware to the target, using the Programmer option in the Tools' menu.
# Once connected, both the "Scope Settings" and "Target Settings" list of parameters may expand, giving access to more advanced settings. You will have to set these parameters which depend on what you want to capture. It usually involves setting the following parameters:
#* Trigger Pins
#* Target IOn Pins
#* Target HS IO-Out
#* Clock Setup
#* Trigger Setup->Total Samples
#* Trigger Setup->Offset
#* Trigger Setup->Mode
#* Gain
#* Relock/reset the DCM in case it is lost.
#* TIP: check the content of the "Example Scripts" at chipwhisperer/software/chipwhisperer/capture/scripts if you are lost.
# You may want to check if everything is working properly by clicking in the "Capture 1" button and adjusting the above settings if necessary.
# Once it is working as expected, you can set the "Generic Settings"->"Acquisition Settings"->"Number of Traces" option to the desired amount (e.g. 50-100) and click the "Capture M" button in the toolbar. This time the traces will be saved to the "Trace Manager" if you specified a "Trace Format".
# In order to view the saved traces, you will have to change the "Result"->"Trace Output Plot"->"Input" from the scope channel to the "Trace Manager". You may also want to change the "X Axis" temporal sequence from Samples to Time.
# You can also import, delete, edit or select/deselect the trace segments by opening the "Trace Manager" in the Project menu.
# Don't forget to save the Project after each change in the traces. A "Consolidate" option is also available to move/copy all the trace files to the current project directory. It is useful if you imported existing traces or captured it before creating the project.
Once you master this procedure and get tired of doing it over and over again, there are two things you can do about it:
# Create your own script (based on the existing ones) and add it to the chipwhisperer/software/chipwhisperer/capture/scripts or ~/chipwhisperer_projects/chipwhisperer/capture/scripts directories. You may want to copy/paste the lines from the "Script Commands" window, once the environment is already set, in order to make it easier.
# Set your capture environment and save the parameter groups using the Save buttons in the top of the Settings tabs. Other possibility would be to use the "Project"->"Save Settings" option to save all the settings at the same time to the "settings.cwset" file inside your project directory. The '''settings are NOT loaded automatically''' when the project is opened. Instead, you should click in the Load button for each group of settings that you want to restore. It is possible to have multiple settings profiles using different settings files. The capture tool also records the settings with the traces when they are captured. If you want to configure the tool to the same environment used in a previous capture, it is possible by loading the setting file saved inside the traces directory.

== Tutorials ==
Follow the [[Tutorial B5 Breaking AES (Straightforward)|B5 tutorial]] to learn how to use it with different targets.

== Advanced ==
Click in this link to learn how to use the [[Glitch Explorer]].

CW-Analyzer Tool

2023-08-24T13:32:40Z

Adewar:

'''WARNING: THE CHIPWHISPERER CAPTURE AND ANALYZER TOOLS ARE DEPRECATED. AS SUCH, WE ARE UNABLE TO PROVIDE SUPPORT FOR THESE TOOLS OR RELEASES THAT INCLUDE THESE TOOLS.'''

The objective of this tool is to analyze the traces captured from a given scope.

Main features:
* CPA and Profiling types of attack;
* Built-in preprocessing modules (decimation, resync, digital filter, normalize and noise);
* Record preprocessed traces output;
* Execute custom analysis scripts;
* AES Key schedule calculator;
* Set of result widgets: Correlation vs Traces plot; Output vs Point plot; PGE vs Trace plot; PGE Table; Waveform Viewer.

[[File:Screen Shot 2016-07-12 at 4.02.17 PM.png|1100px]]

== Using the Analyzer ==
After loading the project, you will need to setup the analysis environment first.

In the analyzer, the settings tabs are used to automatically generate the analysis script (shown in the "Analysis Script" dock). This code can be edited by the user for a more "advanced" usage. It can also be saved and loaded through:
* the console ($python script.py);
* using the "Attack Script Generator" tab;
* copying it to the scripts folder (chipwhisperer/software/chipwhisperer/analyzer/scripts or ˜/chipwhisperer_projects/chipwhisperer/analyzer/scripts) so that it will appear in the Project->"Example Scripts" menu the next time you execute the tool.
In the "Analysis Script" dock, the constructor of the script object is called automatically every time that a new script is generated. It is done because widgets like the waveform viewer should update the trace output of the preprocessing modules when the user modify its settings. The run() method is executed only when the "Start Analysis" button in the toolbar is pressed. Custom methods can be executed by selecting it in the code and right clicking: a "Run Function" option will show up.

The "Attack Script Generator" is the main settings tab. It allows the user to set the Preprocessing modules that should be applied over the original traces and the Attack module. The Preprocessing and the Attack tabs will update accordingly.

The "Trace Explorer" tab enables a set of helper scripts needed by some of the analysis algorithms (like the POI detection in the Template attack).

== Preprocessing Modules ==
Are filters that modify the traces from a given trace source (that can be another Preprocessing Module or the Trace Manager) and works as a new trace source to the next module in the chain (called trace observer).

=== Add Noise: Amplitude ===
Add random noise to the traces. Used for testing, has no use in actual analysis.

=== Add Noise: Time Jitter ===
Add random jitter. Used for testing, has no use in actual analysis.

=== Decimation: Clock Recovery ===
Attempts to 'recover' the clock by band-pass filtering, and then uses that to decimate to only points of interest. ****CURRENTLY NOT SUPPORTED****

=== Decimation: Fixed ===
Decimate (reduce the sample rate) by a fixed factor.

=== Digital Filter ===
Frequency specific filter.

=== Normalize ===
Normalize by standard deviation.

=== Resync: Cross Correlation ===
Use cross-correlation to detect shift between a 'reference trace' and every input trace. In practice the other resync methods seem to work better.

=== Resync: Peak Detect ===
Line up traces so peak (either max positive or max negative) within some given range of points all aligns.

For each trace the following must hold or the trace is rejected:
* (1-valid limit) < (peak value from candidate trace) / (peak value from reference) < (1+valid limit)

* If 'valid limit' is 0 then this is ignored, and all traces are kept.

=== Resync: Resample based on Zero-Crossing ===
Deal with resampling 'bins' based on zero-crossing detection.

=== Resync: Sum-of-Difference ===
Minimize the 'Sum of Absolute Difference' (SAD), also known as 'Sum of Absolute Error'. Uses a portion of one of the traces as the 'reference'. This reference is then slid over the 'input window' for each trace, and the amount of shift resulting in the minimum SAD criteria is selected as the shift amount for that trace.

See [[Sum of Absolute Difference (SAD) Pre-Processing]] for more information.

Manual SAM3U Firmware Update

2023-05-05T18:14:33Z

Adewar:

'''WARNING: THE INFORMATION IN THIS PAGE IS WOEFULLY OUT OF DATE! UPDATED DOCUMENTATION IS AVAILABLE AT: https://chipwhisperer.readthedocs.io/en/latest/firmware.html'''

'''CONTINUE AT YOUR OWN RISK!'''

The SAM3U device has a ROM-resident bootloader. This means the bootloader is always present - unless the chip is damaged it can be run, making the device almost "unbrickable". If you have trouble running the instructions on this webpage it's most likely an issue with your host computer, and not an issue with the SAM3U being damaged.

==Entering Bootloader Mode==

The only way to enter the bootloader mode is to erase the FLASH memory. Before erasing the FLASH memory you should install the programmer tool and confirms it works (it won't connect to the device, but at least check the install works). See the next heading for details of the programming tool.

To erase the FLASH memory, simply short the jumper labeled "ERASE" on the ChipWhisperer-Lite. Do this while the device is connected via micro-USB. The blue LED should stop flashing at this point, and will stay either on or off (depending when you shorted the jumper). This can be accomplished by anything metallic - for example using a screwdriver or tweezers:

[[File:short_screwdriver.jpg|400px]]

[[File:short_tweezers.jpg|400px]]

Once this is accomplished, unplug and replug the micro-USB port. This will install a new driver (assuming you installed BOSSA already), and the red and blue LED should be only dimmly lit:

[[File:lights_prog.jpg|400px]]

This indicates it is in bootloader mode. The device will now attach as a serial port. If you are using Windows this may take a few minutes to happen.

If using Linux, you can use ''dmesg'' to verify the serial port was connected OK.

==Flashing Firmware Using BOSSA==

The suggested utility to program the device is BOSSA - see [http://www.shumatech.com/web/products/bossa] for details. Before proceeding, install BOSSA for your system.

Run BOSSA, and in the "File" point it to chipwhisperer\hardware\capture\chipwhisperer-lite\sam3u_fw\SAM3U_VendorExample\Debug\SAM3U_CW1173.bin from either your release or GIT. If you press the "Auto-Scan" button BOSSA should detect the ATSAM3U2 device. Note if you are using Windows it might take a few minutes to install the drivers - check the status, as until the drivers are fully loaded it won't detect the SAM3U device.

# Once this is done, press the Write button.
# Press Verify afterwards to confirm things worked.
# Press Exit to close out the program.
# Unplug & Replug the Micro-USB and you've got a working ChipWhisperer-Lite again, with the latest SAM3U firmware!

[[File:Bossa.png]]

==BOSSA Command Line==

On certain systems it may be easier to use the command-line version of BOSSA, called bossac. You can also build just this version if required (see instructions below).

You can also run the BOSSA utility at the command line, with an instruction like the following:

bossac -e -w -v -b /path/to/SAM3U_CW1173.bin

If you are on Linux, you may need to either fix permissions on the serial port, or run bossac as root/sudo. See below for details.

=== Linux-Specific Instructions ===

You may need to give yourself write permission for the serial port. This can be done on some systems easily by adding yourself to the <code>dialout</code> user group. For example, assuming your username was <code>cwuser</code>:

# <code>$ sudo usermod -a -G dialout cwuser</code>
# Log out and log back in again for changes to take effect.

You may also need to build bossac from sources, as the provided binary does not work with your system. Details of how to perform this are provided next:

To build BOSSA, it is recommended to use our simplified bossac repository, which only builds the command-line version. To build this perform these steps:

# Download [https://github.com/newaetech/BOSSA/archive/master.zip a copy of the GIT repo], or clone with <code>git clone git@github.com:newaetech/BOSSA.git</code> (see github.com/newaetech/bossa for the full repo).
# Unzip the directory if you downloaded the zip.
# Run <code>make</code>.
# The binary should be in <code>bin\bossac</code>.

Installing ChipWhisperer

2020-07-02T12:07:59Z

Adewar:

{{Warningbox|These installation instructions are out of date! The new installation instructions can be found at https://chipwhisperer.readthedocs.io/en/latest/, along with our software documentation.}}

This page describes how to install the ChipWhisperer software before release 5.1.

There are five ways to set up ChipWhisperer:
* '''VMWare Virtual Machine:''' Get a pre-prepared virtual machine image with all of the required tools already installed. ''Recommended for beginners.''
* '''Windows Installer''' Get a Windows binary that installs the ChipWhisperer repository to your computer. Does not include WinAVR compiler.
* '''ChipWhisperer Releases:''' Get a zip file with the latest stable ChipWhisperer code and run it on your own environment.
* '''PyPi Package:''' <code>pip install chipwhisperer</code>. Only includes the software - doesn't come with the hardware source files, drivers, or example firmware.
* '''Git Repository:''' Get the latest, bleeding-edge features and bugs. Recommended if you're an experienced developer and you want to contribute to ChipWhisperer.
'''NOTE TO USERS WITH AN ARM TARGET:''' To build firmware, you'll need the GNU Embedded Toolchain For ARM. This is included with the VM. Otherwise please see '''Installing ARM Toolchain''' at the bottom of the page.

 
{{Warningbox|If you are installing 64-bit Python rather than 32-bit, and the ChipWhisperer software's graph widget's axis disappear, the fix is this: ''pip uninstall pyside'' and then ''pip install https://download.qt.io/official_releases/pyside/PySide-1.2.2-cp27-none-win_amd64.whl''. This uninstalls the current pyside package and installs the official QT Pyside package.}}

 
{{Warningbox|You may need to add ''--trusted-host pypi.python.org'' to the ''pip install'' command to allow HTTP connections. This is done as follows for example: ''sudo pip install --trusted-host pypi.python.org pyusb''}}

 
{{TOC|limit=3}}

{{CollapsibleSection
|intro = === Using VMWare Virtual Machine ===
|content= Installing ChipWhisperer/Using VMWare Virtual Machine}}

{{CollapsibleSection
|intro = === Automatic Windows Installer ===
|content= Installing ChipWhisperer/Windows Installer}}

{{CollapsibleSection
|intro= === Manual Install - Windows ===
|content= Installing ChipWhisperer/Required Tools - Windows}}

{{CollapsibleSection
|intro= === Manual Install - Linux ===
|content= Installing ChipWhisperer/Required Tools - Linux}}

{{CollapsibleSection
|intro= === Manual Install - Mac OS X ===
|content= Installing ChipWhisperer/Required Tools - Mac OS X}}

{{CollapsibleSection
|intro= === Installing ChipWhisperer from Releases ===
|content= Installing ChipWhisperer/Installing ChipWhisperer from Releases}}

{{CollapsibleSection
|intro= === Installing ChipWhisperer from PyPi ===
|content= Installing ChipWhisperer/Installing ChipWhisperer from PyPi}}

{{CollapsibleSection
|intro= === Installing ChipWhisperer from Git ===
|content= Installing ChipWhisperer/Installing ChipWhisperer from Git}}

{{CollapsibleSection
|intro= === Installing ARM Toolchain ===
|content= Installing ChipWhisperer/Installing_ARM_Toolchain}}



[[Category:Introduction]]

Installing ChipWhisperer

2020-07-02T12:07:25Z

Adewar:

{{Warningbox|These installation instructions are out of date! The new installation instructions can be found at https://chipwhisperer.readthedocs.io/en/latest/, along with our software documentation.}}

This page describes how to install the ChipWhisperer software.

There are five ways to set up ChipWhisperer:
* '''VMWare Virtual Machine:''' Get a pre-prepared virtual machine image with all of the required tools already installed. ''Recommended for beginners.''
* '''Windows Installer''' Get a Windows binary that installs the ChipWhisperer repository to your computer. Does not include WinAVR compiler.
* '''ChipWhisperer Releases:''' Get a zip file with the latest stable ChipWhisperer code and run it on your own environment.
* '''PyPi Package:''' <code>pip install chipwhisperer</code>. Only includes the software - doesn't come with the hardware source files, drivers, or example firmware.
* '''Git Repository:''' Get the latest, bleeding-edge features and bugs. Recommended if you're an experienced developer and you want to contribute to ChipWhisperer.
'''NOTE TO USERS WITH AN ARM TARGET:''' To build firmware, you'll need the GNU Embedded Toolchain For ARM. This is included with the VM. Otherwise please see '''Installing ARM Toolchain''' at the bottom of the page.

 
{{Warningbox|If you are installing 64-bit Python rather than 32-bit, and the ChipWhisperer software's graph widget's axis disappear, the fix is this: ''pip uninstall pyside'' and then ''pip install https://download.qt.io/official_releases/pyside/PySide-1.2.2-cp27-none-win_amd64.whl''. This uninstalls the current pyside package and installs the official QT Pyside package.}}

 
{{Warningbox|You may need to add ''--trusted-host pypi.python.org'' to the ''pip install'' command to allow HTTP connections. This is done as follows for example: ''sudo pip install --trusted-host pypi.python.org pyusb''}}

 
{{TOC|limit=3}}

{{CollapsibleSection
|intro = === Using VMWare Virtual Machine ===
|content= Installing ChipWhisperer/Using VMWare Virtual Machine}}

{{CollapsibleSection
|intro = === Automatic Windows Installer ===
|content= Installing ChipWhisperer/Windows Installer}}

{{CollapsibleSection
|intro= === Manual Install - Windows ===
|content= Installing ChipWhisperer/Required Tools - Windows}}

{{CollapsibleSection
|intro= === Manual Install - Linux ===
|content= Installing ChipWhisperer/Required Tools - Linux}}

{{CollapsibleSection
|intro= === Manual Install - Mac OS X ===
|content= Installing ChipWhisperer/Required Tools - Mac OS X}}

{{CollapsibleSection
|intro= === Installing ChipWhisperer from Releases ===
|content= Installing ChipWhisperer/Installing ChipWhisperer from Releases}}

{{CollapsibleSection
|intro= === Installing ChipWhisperer from PyPi ===
|content= Installing ChipWhisperer/Installing ChipWhisperer from PyPi}}

{{CollapsibleSection
|intro= === Installing ChipWhisperer from Git ===
|content= Installing ChipWhisperer/Installing ChipWhisperer from Git}}

{{CollapsibleSection
|intro= === Installing ARM Toolchain ===
|content= Installing ChipWhisperer/Installing_ARM_Toolchain}}



[[Category:Introduction]]

Main Page

2020-06-01T19:08:18Z

Adewar: Fix forum link

ChipWhisperer® by NewAE Technology Inc. 



Welcome to ChipWhisperer - the complete open-source toolchain for side-channel power analysis and glitching attacks. This is the main landing page for ChipWhisperer. ChipWhisperer has been presented at conferences such as DEFCON and Blackhat, had a [https://www.kickstarter.com/projects/coflynn/chipwhisperer-lite-a-new-era-of-hardware-security successful Kickstarter (that delivered ahead of schedule)], and placed 2nd place in the first annual Hackaday Prize. ChipWhisperer has been used in a number of academic articles, and is featured in the Car Hacking Handbook. Portions of the design have even been used by [http://permalink.lanl.gov/object/tr?what=info:lanl-repo/lareport/LA-UR-15-26344 Los Alamos Labs for an electron accelerator]. You can see a full list of references on the [[Press]] page.

ChipWhisperer is maintained by [https://www.newae.com NewAE Technology Inc.], which sells a combination of open-source hardware, supporting tools, training, and consulting services. ChipWhisperer is trademark of NewAE Technology Inc., registered in the US, Europe, and China. This means only NewAE can sell official products under the ChipWhisperer name, and was done to ensure products meet [[Quality Control Guidelines]], as these fairly complex products require good testing to ensure you don't have a frustrating experience.

Beyond supporting just the ChipWhisperer project, this wiki is now growing towards the objective of offering a complete reference on embedded security.

'''NOTE: ChipWhisperer V5 is here! CW4 tutorials are available via links on the wiki tutorial pages. CW4 info is available at [[CW4]]'''

'''NOTE: Account creation is disabled on this wiki currently due to spam. Please contact us at wiki@newae.com if you would like to contribute.'''

== Getting Started ==

Confused on where to begin? If you're new to this area, see the [[V5:Getting Started]] page, which details how you can get involved in side-channel power analysis. From there you can see the hardware documentation (linked below), or take one of the [http://newae.com/training/ Training Courses].

If you're stuck, you can also get help on the [https://forum.newae.com Discussion Forum].

== Hardware Documentation ==

{{Template:Hardware}}

== Software Documentation ==

ChipWhisperer is an open-source project. All of the source code is available from the [https://github.com/newaetech/chipwhisperer Git Repository]. Documentation is available on our [https://chipwhisperer.readthedocs.io/en/latest/index.html Read the Docs page].

For more information about the software releases, see [https://github.com/newaetech/chipwhisperer/releases Releases] or the [https://chipwhisperer.readthedocs.io/en/latest/installing.html installation instructions].

== Sample Projects and Tutorials ==

Tutorials are implemented using Jupyter Notebooks, available in our [https://github.com/newaetech/chipwhisperer-jupyter chipwhisperer-jupyter submodule]. You can also find completed versions of the tutorials on [https://chipwhisperer.readthedocs.io/en/latest/tutorials.html Read the Docs].

{{Template:Tutorials}}

=== Example Attacks / Other ===

While ChipWhisperer started as a side-channel power analysis platform, it has grown to be useful in other attack types. This section is designed to show you a wide variety of attacks on embedded systems, to give you an idea of what is required for building secure embedded systems. These are held on the page [[Embedded Attacks]].

In 2016, ChipWhisperer was used as part of the CHES2016 CTF challenge. See details of the event on the [[CHES2016 CTF]] page.

See what ChipWhisperer has been used for in the "real world" by reading some [[Academic Papers]] about research using ChipWhisperer.

== Recent/Upcoming Events ==

Upcoming events with NewAE:
* Arm TechCon: Exhibit booth!
* [http://HardwareSecurity.training HardwareSecurity.training] event in November - California 4-day training.
* Embedded World 2019: Exhibit Booth

These are some past events that were attended by someone from NewAE:
* Black Hat USA 2018: Training, Arsenal Demo
* [http://chesworkshop.org CHES 2018]: Sponsor with exhibit booth
* [http://HardwareSecurity.training HardwareSecurity.training] event in April - Maryland 4-day training.
* Embedded World 2018: Exhibit Booth
* [http://HardwareSecurity.training HardwareSecurity.training] event on November 6-9th in San Francisco, running security training
* [http://chesworkshop.org CHES 2017]: Gold sponsor with exhibit booth
* Blackhat USA 2017 ([https://www.blackhat.com/us-17/training/advanced-hardware-hacking-hands-on-power-analysis-and-glitching-with-the-chipwhisperer.html Hands-on Power Analysis & Glitching with the ChipWhisperer])
* COSADE 2017: Gold sponsor
* Blackhat USA 2016: Training based on ChipWhisperer, 2x talks by Colin, Arsenal
* CHES 2016: Sponsor with exhibit booth
* Blackhat USA 2014: Training class
* RECON 2014: [http://recon.cx/2014/video/recon2014-24-colin-o-flynn-Power-Analysis-and-Clock-Glitching-with-the-Open-Source-ChipWhisperer-Platform.mp4 Video] and [https://www.assembla.com/spaces/chipwhisperer/documents/cnp7Ss_8Sr471aacwqjQXA/download/cnp7Ss_8Sr471aacwqjQXA Slides]
* [http://solidcon.com/solid2014 O'Reilly Solid 2014]: [http://solidcon.com/solid2014/public/schedule/detail/33655 Demo]
* [http://cosade.org/ COSADE] 2014: [http://eprint.iacr.org/2014/204.pdf Paper]
* CHES 2013: [http://www.newae.com/files/CHES2013_Tutorial.pptx Slides] and [http://www.youtube.com/watch?v=UzDx5yx3Qc4&hd=1 Video]
* Blackhat USA 2013
* iSEC Open Security Forum (April 2013)
* Design West 2013
* Blackhat EU 2013
* AtlSecCon 2013
* Blackhat Abu Dhabi 2012

== Extra Notes ==

See the page [[Thanks]] for a note about the people who made this project possible.

ChipWhisperer is a Trademark of NewAE Technology Inc., registered in the U.S, the European Union, and China.

ChipSHOUTER is a Trademark of NewAE Technology Inc., registered in the European Union.

Trademarks used with permission.

CW308T-STM32F/ChipWhisperer Bootloader

2020-05-07T15:03:21Z

Adewar:

{{Warningbox|These instructions have been updated for ChipWhisperer 5. If you're using and earlier version, see https://wiki.newae.com/V4:CW308T-STM32F/ChipWhisperer_Bootloader}}
The STM32Fx devices have a built-in bootloader, and the ChipWhisperer software as of 3.5.2 includes support for this bootloader.

Important notes before we begin:
* You MUST setup a clock and the serial lines for the chip. This is easily done by connecting to the scope and target, then running <code>default_setup()</code>:
<syntaxhighlight lang=python>
import chipwhisperer as cw
scope = cw.scope
target = cw.target(scope)
scope.default_setup()
</syntaxhighlight>
* On the STM32F1, you MUST adjust the clock frequency to 8MHz. The bootloader does not work with our usual 7.37 MHz clock frequency. '''This 8MHz frequency does not apply to the code that you're running on the device. Once you're done programming, you'll need to set the frequency back to F_CPU (likely 7.37MHz)''' For example:

<syntaxhighlight lang=python>
scope.default_setup()
scope.clock.clkgen_freq = 8E6
#program target...
scope.clock.clkgen_freq = 7.37E6
#reset and run as usual
</syntaxhighlight>

To access the bootloader you can perform these steps. They vary based on if you have a "Rev 02" board or a "Rev 03 or Later" board. The revision number is printed on the bottom side as part of the PCB part number (STM32F-03 is Rev -03 for example).

==== Rev -03 or Later ====

Run the following python code once you have the scope and target set up:
<syntaxhighlight lang=python>
prog = cw.programmers.STM32FProgrammer
cw.program_target(scope, prog, "<path to fw hex file>")
</syntaxhighlight>

If you get errors during the programming process:
* Retry the programming process with a lower baud rate:
<syntaxhighlight lang=python>
prog = cw.programmers.STM32FProgrammer
cw.program_target(scope, prog, "<path to fw hex file>", baud=38400)
</syntaxhighlight>
* If using a CW308 based STM, try mounting a jumper between the "SH-" and "SH+" pins at J16 (to the left of the SMA connector) on the UFO board. Retry programming with the jumper mounted.

==== Rev -02 Boards ====

The Rev -02 boards did not have all programming connections present. They require some additional steps:

# Setup the device as usual:
#:<syntaxhighlight lang=python>
scope = cw.scope()
target = cw.target(scope)
scope.default_setup()
</syntaxhighlight>
# Mount a jumper between the H1 and PDIC pins (again this is ONLY for the -02 rev).
#: [[File:STMF32F-02 programmer jumper.jpg|400px]]
# Reset the ARM device either by pressing the reset button (newer UFO boards only), or by toggling power:
#:<syntaxhighlight lang=python>
import time
scope.io.target_pwr = False
time.sleep(1)
scope.io.target_pwr = True
</syntaxhighlight>
# Program the device:
#:<syntaxhighlight lang=python>
prog = cw.programmers.STM32FProgrammer
cw.program_target(scope, prog, "<path to fw hex file>")
</syntaxhighlight>
# The device should program, it may take a moment to fully program/verify on larger devices.
# Remove the jumper between the H1/H2 pins.
# Reset the ARM device either by pressing the reset button (newer UFO boards only), or by toggling power:
#:<syntaxhighlight lang=python>
import time
scope.io.target_pwr = False
time.sleep(1)
scope.io.target_pwr = True
</syntaxhighlight>

CW308T-STM32F/ChipWhisperer Bootloader

2020-05-07T15:02:42Z

Adewar:

{{Warningbox|These instructions have been updated for ChipWhisperer 5. If you're using and earlier version, see https://wiki.newae.com/V4:CW308T-STM32F/ChipWhisperer_Bootloader}}
The STM32Fx devices have a built-in bootloader, and the ChipWhisperer software as of 3.5.2 includes support for this bootloader.

Important notes before we begin:
* You MUST setup a clock and the serial lines for the chip. This is easily done by connecting to the scope and target, then running <code>default_setup()</code>:
<syntaxhighlight lang=python>
import chipwhisperer as cw
scope = cw.scope
target = cw.target(scope)
scope.default_setup()
</syntaxhighlight>
* On the STM32F1, you MUST adjust the clock frequency to 8MHz. The bootloader does not work with our usual 7.37 MHz clock frequency. '''This 8MHz frequency does not apply to the code that you're running on the device. Once you're done programming, you'll need to set the frequency back to F_CPU (likely 7.37MHz)''' For example:

<syntaxhighlight lang=python>
scope.default_setup()
scope.clock.clkgen_freq = 8E6
#program target...
scope.clock.clkgen_freq = 7.37E6
#reset and run as usual
</syntaxhighlight>

To access the bootloader you can perform these steps. They vary based on if you have a "Rev 02" board or a "Rev 03 or Later" board. The revision number is printed on the bottom side as part of the PCB part number (STM32F-03 is Rev -03 for example).

=== Rev -03 or Later ===

Run the following python code once you have the scope and target set up:
<syntaxhighlight lang=python>
prog = cw.programmers.STM32FProgrammer
cw.program_target(scope, prog, "<path to fw hex file>")
</syntaxhighlight>

If you get errors during the programming process:
* Retry the programming process with a lower baud rate:
<syntaxhighlight lang=python>
prog = cw.programmers.STM32FProgrammer
cw.program_target(scope, prog, "<path to fw hex file>", baud=38400)
</syntaxhighlight>
* If using a CW308 based STM, try mounting a jumper between the "SH-" and "SH+" pins at J16 (to the left of the SMA connector) on the UFO board. Retry programming with the jumper mounted.

=== Rev -02 Boards ===

The Rev -02 boards did not have all programming connections present. They require some additional steps:

# Setup the device as usual:
#:<syntaxhighlight lang=python>
scope = cw.scope()
target = cw.target(scope)
scope.default_setup()
</syntaxhighlight>
# Mount a jumper between the H1 and PDIC pins (again this is ONLY for the -02 rev).
#: [[File:STMF32F-02 programmer jumper.jpg|400px]]
# Reset the ARM device either by pressing the reset button (newer UFO boards only), or by toggling power:
#:<syntaxhighlight lang=python>
import time
scope.io.target_pwr = False
time.sleep(1)
scope.io.target_pwr = True
</syntaxhighlight>
# Program the device:
#:<syntaxhighlight lang=python>
prog = cw.programmers.STM32FProgrammer
cw.program_target(scope, prog, "<path to fw hex file>")
</syntaxhighlight>
# The device should program, it may take a moment to fully program/verify on larger devices.
# Remove the jumper between the H1/H2 pins.
# Reset the ARM device either by pressing the reset button (newer UFO boards only), or by toggling power:
#:<syntaxhighlight lang=python>
import time
scope.io.target_pwr = False
time.sleep(1)
scope.io.target_pwr = True
</syntaxhighlight>

File:DPA 3 Subkey Offset.png

2020-03-20T18:59:56Z

Adewar:

CW1173 ChipWhisperer-Lite

2020-03-12T20:17:03Z

Adewar: /* Capture and Attack Quickstart */

{{Warningbox|This page has been recently updated for the ChipWhisperer 5 release. The previous version can be found here: https://wiki.newae.com/V4:CW1173_ChipWhisperer-Lite.}}



The ChipWhisperer-Lite Bare Board consists of two main parts: a multi-purpose power analysis capture instrument, and a target board. The target board is a standard microcontroller which you can implement algorithms onto. For example if you wish to evaluate an AES library, you can program that library into the target board and perform the power analysis.

[[File:cwlite_basic.png|image]]

== Quick-Start Guide ==

You can see a [http://www.youtube.com/watch?v=MJmkYqA-LeM&hd=1 Video] of the quickstart guide, which will take you through all the setup items discussed here:

[[File:cwlite_demo_video.png|link=http://www.youtube.com/watch?v=MJmkYqA-LeM&hd=1]]

== Connection Quick-Start ==
<ol>
<li>Follow the [[Installing ChipWhisperer]] instructions for the ChipWhisperer software and its prerequisites.</li>
<li>Connect ChipWhisperer-Lite, install USB Drivers:
<dl>
<dt>Windows:</dt>
<dd><ul>
<li>Plug micro-USB cable into ChipWhisperer-Lite</li>
<li>If the "New Hardware Found" wizard doesn't prompt you for drivers, go to the control panel and find the "ChipWhisperer-Lite" device, and select "Update Drivers".</li>
<li>You can find drivers in <code>c:\chipwhisperer\hardware\capture\chipwhisperer-lite\</code>. You will likely need to extract them from the <code>cwlite_usb_driver.zip</code> file. If so simply extract them somewhere (i.e. your desktop), and then point the new hardware found wizard to that location.</li></ul>
</dd>
<dt>Linux:</dt>
<dd><ul>
<li>Driver installation is not required, but if you do not update the 'udev' system, you will be unable to run ChipWhisperer-Capture as a regular user. To update the udev system, first make sure the ChipWhisperer-Lite is Make a file called <code>/etc/udev/rules.d/99-cwlite.rules</code> . The contents of this file should be:
<pre># allow users to claim the device
SUBSYSTEM=="usb", ATTRS{idVendor}=="2b3e", ATTRS{idProduct}=="ace2", MODE="0664", GROUP="plugdev"</pre></li>
<li>Add your username to the plugdev group:
<pre>$ sudo usermod -a -G plugdev YOUR-USERNAME</pre></li>
<li>And reset the udev system:
<pre>$ sudo udevadm control --reload-rules</pre></li>
<li>Finally log out & in again for the group change to take effect.</li>
<li>Connect the micro-USB cable</li></ul>
</dd>
<dt>MAC:</dt>
<dd><ul>
<li>No special installation required - must ensure you have installed libusb via homebrew (see instructions at [[MacOSX_Installation]]).</li></ul>
</dd></dl>
</li>
<li>To check for a successful installation, connect to the ChipWhisperer. This can be done from one of two ways:
<blockquote><ul>
<li>Open up a terminal and run python. Next, run <code>import chipwhisperer as cw; scope = cw.scope()</code>.</li>
<li>Open Jupyter Notebook and open PA_Intro_1-Firmware_Build_Setup.ipynb. On the toolbar, click Cell>Run All. If the tutorial completes successfully, your installation should be good to go!</li></ul></blockquote>

For more information on starting ChipWhisperer, see: https://chipwhisperer.readthedocs.io/en/latest/starting.html</ol>

== Capture and Attack Quickstart ==
See https://chipwhisperer.readthedocs.io/en/latest/tutorials.html#correlation-power-analysis for an example attack.

== Important Bugs/Caveats ==

The following includes various things that might trip you up:

# A "device has no langID" or similar error message may appear when connecting to your ChipWhisperer. This indicates that the ChipWhisperer is connected, but that we're unable to communicate with it. For example, if you're on Linux and skipped the 99-newae.rules part of the installation, you won't have the correct permissions to access the device.
# There are a few warnings/exceptions that come up (i.e. divide-by-zero). Generally just keep going and see if things are still working. A number of those are on the ''TODO'' list to fix but I didn't get around to it yet.
# By default the XMEGA device was programmed with a partial AES implementation only. This is done to avoid any crypto export issues. This does not affect your side-channel analysis, but be aware the returned value might not appear to be correct (since only the first couple rounds of AES occurred).

== Basic Usage Instructions ==

{{CollapsibleSection
|intro = === AVR Programmer ===
|content= CW1173_ChipWhisperer-Lite/AVR Programmer}}

{{CollapsibleSection
|intro = === XMEGA Programmer ===
|content= CW1173_ChipWhisperer-Lite/XMEGA Programmer}}

{{CollapsibleSection
|intro = === STM32F Programmer ===
|content= CW308T-STM32F/ChipWhisperer_Bootloader}}

{{CollapsibleSection
|intro = === Using Glitch Port ===
|content= CW1173_ChipWhisperer-Lite/Glitch Port}}

{{CollapsibleSection
|intro = === Using Measure Port ===
|content= CW1173_ChipWhisperer-Lite/Measure Port}}

{{CollapsibleSection
|intro = === 20-Pin Connector ===
|content= CW1173_ChipWhisperer-Lite/20-Pin Connector}}

{{CollapsibleSection
|intro = === 8-Pin SmartCard Connector ===
|content= CW1173_ChipWhisperer-Lite/8-Pin SmartCard Connector}}

{{CollapsibleSection
|intro = === Upgrading SAM3U Firmware ===
|content= CW1173_ChipWhisperer-Lite/Upgrading SAM3U Firmware}}

{{CollapsibleSection
|intro = === Breaking Target Section Apart ===
|content= CW1173_ChipWhisperer-Lite/Breaking Target Section Apart
}}

== Advanced Usage ==

=== Mounting Jumpers ===

Note the ChipWhisperer-Lite main board and target section contain a number of jumper options. By default these are not mounted, and solder jumper bridges on the PCB have been bridged to select the appropriate options when required. Some options are only solder jumpers, which to move the jumper requires a soldering iron to bridge or clear the appropriate connections.

The following lists jumpers on the ChipWhisperer-Lite / Target Section:

; Capture Section Jumpers
* JP4 is the "RESET" net for the SAM3U processor.
* JP2 causes the SAM3U processor flash memory to be erased. When the chip is erased a rom-resident bootloader takes over. See section XXXXX for bootloader details.
* JP5 selects the IO voltage for the FPGA bank which connects to the 20-pin target. By default SJ6 selects this to be 3.3V. It is not recommended to change this, as it is easy to damage the FPGA by feeding an out-of-range voltage in.
* SJ1 selects if the power supply comes from the Micro-USB connector (default) or an external 5V supply at the +5VIN pin.
; Target Section Jumpers:
* JP7 connects the "MEASURE" SMA to the XMEGA VCC Rail. Shorted by default with SJ4.
* JP6 connects the "GLITCH" SMA to the XMEGA VCC Rail. Shorted by default with SJ5.
* JP12 can be used to feed an external voltage into the XMEGA VCC Rail. By default SJ3 connects this to 3.3V.
* SJ2 selects if the 3.3V rail comes from the 20-pin IDC connector (i.e. ChipWhisperer-Lite board), or via an optional LDO and USB connector.



{{CollapsibleSection
|intro = === Schematic ===
[https://github.com/newaetech/chipwhisperer/blob/master/hardware/capture/chipwhisperer-lite/pcb/cw-lite-main.pdf Link to PDF]

(Expand for inline images of schematic)
|content= CW1173_ChipWhisperer-Lite/Schematic
}}
== Hardware ==
{{Template:Hardware}}

[[Category:Capture Hardware]]

CW1173 ChipWhisperer-Lite

2020-03-12T20:16:01Z

Adewar: /* Important Bugs/Caveats */

{{Warningbox|This page has been recently updated for the ChipWhisperer 5 release. The previous version can be found here: https://wiki.newae.com/V4:CW1173_ChipWhisperer-Lite.}}



The ChipWhisperer-Lite Bare Board consists of two main parts: a multi-purpose power analysis capture instrument, and a target board. The target board is a standard microcontroller which you can implement algorithms onto. For example if you wish to evaluate an AES library, you can program that library into the target board and perform the power analysis.

[[File:cwlite_basic.png|image]]

== Quick-Start Guide ==

You can see a [http://www.youtube.com/watch?v=MJmkYqA-LeM&hd=1 Video] of the quickstart guide, which will take you through all the setup items discussed here:

[[File:cwlite_demo_video.png|link=http://www.youtube.com/watch?v=MJmkYqA-LeM&hd=1]]

== Connection Quick-Start ==
<ol>
<li>Follow the [[Installing ChipWhisperer]] instructions for the ChipWhisperer software and its prerequisites.</li>
<li>Connect ChipWhisperer-Lite, install USB Drivers:
<dl>
<dt>Windows:</dt>
<dd><ul>
<li>Plug micro-USB cable into ChipWhisperer-Lite</li>
<li>If the "New Hardware Found" wizard doesn't prompt you for drivers, go to the control panel and find the "ChipWhisperer-Lite" device, and select "Update Drivers".</li>
<li>You can find drivers in <code>c:\chipwhisperer\hardware\capture\chipwhisperer-lite\</code>. You will likely need to extract them from the <code>cwlite_usb_driver.zip</code> file. If so simply extract them somewhere (i.e. your desktop), and then point the new hardware found wizard to that location.</li></ul>
</dd>
<dt>Linux:</dt>
<dd><ul>
<li>Driver installation is not required, but if you do not update the 'udev' system, you will be unable to run ChipWhisperer-Capture as a regular user. To update the udev system, first make sure the ChipWhisperer-Lite is Make a file called <code>/etc/udev/rules.d/99-cwlite.rules</code> . The contents of this file should be:
<pre># allow users to claim the device
SUBSYSTEM=="usb", ATTRS{idVendor}=="2b3e", ATTRS{idProduct}=="ace2", MODE="0664", GROUP="plugdev"</pre></li>
<li>Add your username to the plugdev group:
<pre>$ sudo usermod -a -G plugdev YOUR-USERNAME</pre></li>
<li>And reset the udev system:
<pre>$ sudo udevadm control --reload-rules</pre></li>
<li>Finally log out & in again for the group change to take effect.</li>
<li>Connect the micro-USB cable</li></ul>
</dd>
<dt>MAC:</dt>
<dd><ul>
<li>No special installation required - must ensure you have installed libusb via homebrew (see instructions at [[MacOSX_Installation]]).</li></ul>
</dd></dl>
</li>
<li>To check for a successful installation, connect to the ChipWhisperer. This can be done from one of two ways:
<blockquote><ul>
<li>Open up a terminal and run python. Next, run <code>import chipwhisperer as cw; scope = cw.scope()</code>.</li>
<li>Open Jupyter Notebook and open PA_Intro_1-Firmware_Build_Setup.ipynb. On the toolbar, click Cell>Run All. If the tutorial completes successfully, your installation should be good to go!</li></ul></blockquote>

For more information on starting ChipWhisperer, see: https://chipwhisperer.readthedocs.io/en/latest/starting.html</ol>

== Capture and Attack Quickstart ==

# See [[Tutorial_B5_Breaking_AES_(Straightforward)]]for details. Note the hardware setup is slightly different -- but you can skip to step 5.5.3, and should be able to pick up from there. Be sure to use the <code>ChipWhisperer-Lite: AES SimpleSerial on XMEGA</code> script instead of the one referenced in step 5.5.3.

== Important Bugs/Caveats ==

The following includes various things that might trip you up:

# A "device has no langID" or similar error message may appear when connecting to your ChipWhisperer. This indicates that the ChipWhisperer is connected, but that we're unable to communicate with it. For example, if you're on Linux and skipped the 99-newae.rules part of the installation, you won't have the correct permissions to access the device.
# There are a few warnings/exceptions that come up (i.e. divide-by-zero). Generally just keep going and see if things are still working. A number of those are on the ''TODO'' list to fix but I didn't get around to it yet.
# By default the XMEGA device was programmed with a partial AES implementation only. This is done to avoid any crypto export issues. This does not affect your side-channel analysis, but be aware the returned value might not appear to be correct (since only the first couple rounds of AES occurred).

== Basic Usage Instructions ==

{{CollapsibleSection
|intro = === AVR Programmer ===
|content= CW1173_ChipWhisperer-Lite/AVR Programmer}}

{{CollapsibleSection
|intro = === XMEGA Programmer ===
|content= CW1173_ChipWhisperer-Lite/XMEGA Programmer}}

{{CollapsibleSection
|intro = === STM32F Programmer ===
|content= CW308T-STM32F/ChipWhisperer_Bootloader}}

{{CollapsibleSection
|intro = === Using Glitch Port ===
|content= CW1173_ChipWhisperer-Lite/Glitch Port}}

{{CollapsibleSection
|intro = === Using Measure Port ===
|content= CW1173_ChipWhisperer-Lite/Measure Port}}

{{CollapsibleSection
|intro = === 20-Pin Connector ===
|content= CW1173_ChipWhisperer-Lite/20-Pin Connector}}

{{CollapsibleSection
|intro = === 8-Pin SmartCard Connector ===
|content= CW1173_ChipWhisperer-Lite/8-Pin SmartCard Connector}}

{{CollapsibleSection
|intro = === Upgrading SAM3U Firmware ===
|content= CW1173_ChipWhisperer-Lite/Upgrading SAM3U Firmware}}

{{CollapsibleSection
|intro = === Breaking Target Section Apart ===
|content= CW1173_ChipWhisperer-Lite/Breaking Target Section Apart
}}

== Advanced Usage ==

=== Mounting Jumpers ===

Note the ChipWhisperer-Lite main board and target section contain a number of jumper options. By default these are not mounted, and solder jumper bridges on the PCB have been bridged to select the appropriate options when required. Some options are only solder jumpers, which to move the jumper requires a soldering iron to bridge or clear the appropriate connections.

The following lists jumpers on the ChipWhisperer-Lite / Target Section:

; Capture Section Jumpers
* JP4 is the "RESET" net for the SAM3U processor.
* JP2 causes the SAM3U processor flash memory to be erased. When the chip is erased a rom-resident bootloader takes over. See section XXXXX for bootloader details.
* JP5 selects the IO voltage for the FPGA bank which connects to the 20-pin target. By default SJ6 selects this to be 3.3V. It is not recommended to change this, as it is easy to damage the FPGA by feeding an out-of-range voltage in.
* SJ1 selects if the power supply comes from the Micro-USB connector (default) or an external 5V supply at the +5VIN pin.
; Target Section Jumpers:
* JP7 connects the "MEASURE" SMA to the XMEGA VCC Rail. Shorted by default with SJ4.
* JP6 connects the "GLITCH" SMA to the XMEGA VCC Rail. Shorted by default with SJ5.
* JP12 can be used to feed an external voltage into the XMEGA VCC Rail. By default SJ3 connects this to 3.3V.
* SJ2 selects if the 3.3V rail comes from the 20-pin IDC connector (i.e. ChipWhisperer-Lite board), or via an optional LDO and USB connector.



{{CollapsibleSection
|intro = === Schematic ===
[https://github.com/newaetech/chipwhisperer/blob/master/hardware/capture/chipwhisperer-lite/pcb/cw-lite-main.pdf Link to PDF]

(Expand for inline images of schematic)
|content= CW1173_ChipWhisperer-Lite/Schematic
}}
== Hardware ==
{{Template:Hardware}}

[[Category:Capture Hardware]]

CW1173 ChipWhisperer-Lite/Upgrading SAM3U Firmware

2020-03-12T19:33:00Z

Adewar:

CW1173 ChipWhisperer-Lite/Upgrading SAM3U Firmware

2020-03-12T19:30:17Z

Adewar:

{{Warningbox|This section has been recently updated for ChipWhisperer 5. The previous version can be found here: https://wiki.newae.com/V4:CW1173_ChipWhisperer-Lite/Upgrading_SAM3U_Firmware}}

When talking about the ChipWhisperer's firmware, there is really two parts to this:

# The FPGA Bitstream file.
# The SAM3U USB interface chip firmware.

The FPGA bitstream alone is what is normally configured by the ChipWhisperer-Capture software. This bitstream is always the most up-to-date, since it's automatically reloaded by the computer every time you power cycle the ChipWhisperer-Capture. The SAM3U firmware however is not automatically updated, but it tends to change less frequently.

==== Checking Firmware Version ====

The firmware version is printed at start-up. You will see a line that looks like this indicating the version of the SAM3U Firmware:

<pre>Found CW-Lite, Serial Number = 442031204630xxxxxxxxxxx
SAM3U Firmware version = 0.11 b0
Programmed FPGA</pre>
If your firmware version is outdated, a warning will be printed. You can also see the firmware version in the ''Config CW Firmware'' dialog:

<blockquote>[[File:sam3fwver.png|image]]
</blockquote>
Note the main version is 0.11 in this example. The "b0" indicates a "build" number. Typically this will be "build 0", but special versions will use a different build number to indicate a variant of a regular version.

==== Upgrading Firmware ====

Before updating, you must put your ChipWhisperer into bootloader mode. Once put into this mode you will need to load a new firmware file. There is two ways of doing it: the ''automatic'' method, and the ''manual'' method. The automatic method is done through the GUI, and works if you have valid firmware image loaded. The ''manual'' method is always guaranteed to work.

The automatic method is:

Using ChipWhisperer-Capture GUI

# Connect to the ChipWhisperer.
# From the ''Tools'' menu select ''CW Firmware Preferences''
# Select the ''Open SAM3U Update Widget'' button.
# Press the ''Enable Bootloader Mode'' button.
# You will get an error, and the ChipWhisperer will disconnect. This is normal, and indicates the USB mode changed suddenly.
# The blue LED will stop flashing, and the device will reconnect in programmer mode (see below).

Once you are in bootloader mode, both the blue and red LED will be very dimmly lit:

[[File:lights_prog.jpg|400px]]

This indicates it is in bootloader mode. The device will now attach as a serial port. If you are using Windows this may take a few minutes to happen.

If using Linux, you can use ''dmesg'' to verify the serial port was connected OK.

If this doesn't work, see the page [[Manual SAM3U Firmware Update]] for details on how to manually enter bootloader mode. You can return to this page for the actual programming - you don't need to install/use the BOSSA utility if you follow those manual directions. You simply need to force the system into bootloader mode using those directions.

To actually program the file, we use the second part of the dialog box you already had open:

[[File:sam3uupdate.png|400px]]

Once we are in bootloader mode, you can follow these steps:

# Hit "Update List", and select the serial port the SAM3U attached as.
# To use the default firmware file, leave the "Built-in" radio-box selected. If you want a custom firmware you can select the "External" mode.
# Hit the "Run Program" button
# Once completed, unplug/replug your device and it should come to life.
# Close the update widgets, and reconnect to your ChipWhisperer.

==== Linux usbserial module Workaround ====
There is an issue in some versions of Linux, where the SAM3U is not assigned a serial port when it enters bootloader mode. Here are some steps to resolve this issue (Note. this is not a permanent fix, you must go through these steps each time you put your ChipWhisperer into bootloader mode.). These steps assume you've already put ChipWhisperer into bootloader mode.

# Unplug your ChipWhisperer (Leave unplugged until instructed otherwise)
# Reboot your computer
# Once logged in again, open a terminal session
# Run this command: <code>sudo modprobe usbserial vendor=0x3eb product=0x6124</code>
# Plug your ChipWhisperer back in
# Check that a serial port is now open using: <code>ls -l /dev/ttyUSB*</code>

[[File:ttyUSB example.png|400px]]

You should now be able to program the bootloader from ChipWhisperer Capture through the port you created

==== Manual Update ====

If the above instructions fail, there is no big problem. The SAM3U chip contains a hardware-resident bootloader. You may need to follow instructions on the [[Manual SAM3U Firmware Update]] page (including using BOSSA) if you are unable to use the automatic system that is part of ChipWhisperer-Capture.

V4:CW1173 ChipWhisperer-Lite/Upgrading SAM3U Firmware

2020-03-12T19:29:19Z

Adewar: Created page with "When talking about the ChipWhisperer's firmware, there is really two parts to this: # The FPGA Bitstream file. # The SAM3U USB interface chip firmware. The FPGA bitstream al..."

When talking about the ChipWhisperer's firmware, there is really two parts to this:

# The FPGA Bitstream file.
# The SAM3U USB interface chip firmware.

The FPGA bitstream alone is what is normally configured by the ChipWhisperer-Capture software. This bitstream is always the most up-to-date, since it's automatically reloaded by the computer every time you power cycle the ChipWhisperer-Capture. The SAM3U firmware however is not automatically updated, but it tends to change less frequently.

==== Checking Firmware Version ====

The firmware version is printed at start-up. You will see a line that looks like this indicating the version of the SAM3U Firmware:

<pre>Found CW-Lite, Serial Number = 442031204630xxxxxxxxxxx
SAM3U Firmware version = 0.11 b0
Programmed FPGA</pre>
If your firmware version is outdated, a warning will be printed. You can also see the firmware version in the ''Config CW Firmware'' dialog:

<blockquote>[[File:sam3fwver.png|image]]
</blockquote>
Note the main version is 0.11 in this example. The "b0" indicates a "build" number. Typically this will be "build 0", but special versions will use a different build number to indicate a variant of a regular version.

==== Upgrading Firmware ====

Before updating, you must put your ChipWhisperer into bootloader mode. Once put into this mode you will need to load a new firmware file. There is two ways of doing it: the ''automatic'' method, and the ''manual'' method. The automatic method is done through the GUI, and works if you have valid firmware image loaded. The ''manual'' method is always guaranteed to work.

The automatic method is:

Using ChipWhisperer-Capture GUI

# Connect to the ChipWhisperer.
# From the ''Tools'' menu select ''CW Firmware Preferences''
# Select the ''Open SAM3U Update Widget'' button.
# Press the ''Enable Bootloader Mode'' button.
# You will get an error, and the ChipWhisperer will disconnect. This is normal, and indicates the USB mode changed suddenly.
# The blue LED will stop flashing, and the device will reconnect in programmer mode (see below).

Once you are in bootloader mode, both the blue and red LED will be very dimmly lit:

[[File:lights_prog.jpg|400px]]

This indicates it is in bootloader mode. The device will now attach as a serial port. If you are using Windows this may take a few minutes to happen.

If using Linux, you can use ''dmesg'' to verify the serial port was connected OK.

If this doesn't work, see the page [[Manual SAM3U Firmware Update]] for details on how to manually enter bootloader mode. You can return to this page for the actual programming - you don't need to install/use the BOSSA utility if you follow those manual directions. You simply need to force the system into bootloader mode using those directions.

To actually program the file, we use the second part of the dialog box you already had open:

[[File:sam3uupdate.png|400px]]

Once we are in bootloader mode, you can follow these steps:

# Hit "Update List", and select the serial port the SAM3U attached as.
# To use the default firmware file, leave the "Built-in" radio-box selected. If you want a custom firmware you can select the "External" mode.
# Hit the "Run Program" button
# Once completed, unplug/replug your device and it should come to life.
# Close the update widgets, and reconnect to your ChipWhisperer.

==== Linux usbserial module Workaround ====
There is an issue in some versions of Linux, where the SAM3U is not assigned a serial port when it enters bootloader mode. Here are some steps to resolve this issue (Note. this is not a permanent fix, you must go through these steps each time you put your ChipWhisperer into bootloader mode.). These steps assume you've already put ChipWhisperer into bootloader mode.

# Unplug your ChipWhisperer (Leave unplugged until instructed otherwise)
# Reboot your computer
# Once logged in again, open a terminal session
# Run this command: <code>sudo modprobe usbserial vendor=0x3eb product=0x6124</code>
# Plug your ChipWhisperer back in
# Check that a serial port is now open using: <code>ls -l /dev/ttyUSB*</code>

[[File:ttyUSB example.png|400px]]

You should now be able to program the bootloader from ChipWhisperer Capture through the port you created

==== Manual Update ====

If the above instructions fail, there is no big problem. The SAM3U chip contains a hardware-resident bootloader. You may need to follow instructions on the [[Manual SAM3U Firmware Update]] page (including using BOSSA) if you are unable to use the automatic system that is part of ChipWhisperer-Capture.

CW1173 ChipWhisperer-Lite

2020-03-12T19:27:22Z

Adewar:

{{Warningbox|This page has been recently updated for the ChipWhisperer 5 release. The previous version can be found here: https://wiki.newae.com/V4:CW1173_ChipWhisperer-Lite.}}



The ChipWhisperer-Lite Bare Board consists of two main parts: a multi-purpose power analysis capture instrument, and a target board. The target board is a standard microcontroller which you can implement algorithms onto. For example if you wish to evaluate an AES library, you can program that library into the target board and perform the power analysis.

[[File:cwlite_basic.png|image]]

== Quick-Start Guide ==

You can see a [http://www.youtube.com/watch?v=MJmkYqA-LeM&hd=1 Video] of the quickstart guide, which will take you through all the setup items discussed here:

[[File:cwlite_demo_video.png|link=http://www.youtube.com/watch?v=MJmkYqA-LeM&hd=1]]

== Connection Quick-Start ==
<ol>
<li>Follow the [[Installing ChipWhisperer]] instructions for the ChipWhisperer software and its prerequisites.</li>
<li>Connect ChipWhisperer-Lite, install USB Drivers:
<dl>
<dt>Windows:</dt>
<dd><ul>
<li>Plug micro-USB cable into ChipWhisperer-Lite</li>
<li>If the "New Hardware Found" wizard doesn't prompt you for drivers, go to the control panel and find the "ChipWhisperer-Lite" device, and select "Update Drivers".</li>
<li>You can find drivers in <code>c:\chipwhisperer\hardware\capture\chipwhisperer-lite\</code>. You will likely need to extract them from the <code>cwlite_usb_driver.zip</code> file. If so simply extract them somewhere (i.e. your desktop), and then point the new hardware found wizard to that location.</li></ul>
</dd>
<dt>Linux:</dt>
<dd><ul>
<li>Driver installation is not required, but if you do not update the 'udev' system, you will be unable to run ChipWhisperer-Capture as a regular user. To update the udev system, first make sure the ChipWhisperer-Lite is Make a file called <code>/etc/udev/rules.d/99-cwlite.rules</code> . The contents of this file should be:
<pre># allow users to claim the device
SUBSYSTEM=="usb", ATTRS{idVendor}=="2b3e", ATTRS{idProduct}=="ace2", MODE="0664", GROUP="plugdev"</pre></li>
<li>Add your username to the plugdev group:
<pre>$ sudo usermod -a -G plugdev YOUR-USERNAME</pre></li>
<li>And reset the udev system:
<pre>$ sudo udevadm control --reload-rules</pre></li>
<li>Finally log out & in again for the group change to take effect.</li>
<li>Connect the micro-USB cable</li></ul>
</dd>
<dt>MAC:</dt>
<dd><ul>
<li>No special installation required - must ensure you have installed libusb via homebrew (see instructions at [[MacOSX_Installation]]).</li></ul>
</dd></dl>
</li>
<li>To check for a successful installation, connect to the ChipWhisperer. This can be done from one of two ways:
<blockquote><ul>
<li>Open up a terminal and run python. Next, run <code>import chipwhisperer as cw; scope = cw.scope()</code>.</li>
<li>Open Jupyter Notebook and open PA_Intro_1-Firmware_Build_Setup.ipynb. On the toolbar, click Cell>Run All. If the tutorial completes successfully, your installation should be good to go!</li></ul></blockquote>

For more information on starting ChipWhisperer, see: https://chipwhisperer.readthedocs.io/en/latest/starting.html</ol>

== Capture and Attack Quickstart ==

# See [[Tutorial_B5_Breaking_AES_(Straightforward)]]for details. Note the hardware setup is slightly different -- but you can skip to step 5.5.3, and should be able to pick up from there. Be sure to use the <code>ChipWhisperer-Lite: AES SimpleSerial on XMEGA</code> script instead of the one referenced in step 5.5.3.

== Important Bugs/Caveats ==

The following includes various things that might trip you up:

# If you save the project ''before'' running the capture, you can specify any directory. Traces will be copied to the appropriate location during capture.
# If you save the project ''after'' running the capture, you must save the project to the same directory that "default-data-dir" exists in. This is normally the folder from where you invoked the Python GUI.
# There are a few warnings/exceptions that come up (i.e. divide-by-zero). Generally just keep going and see if things are still working. A number of those are on the ''TODO'' list to fix but I didn't get around to it yet.
# The "Total Ops" window which checks for proper AES operation requires PyCrypto to be installed.
# By default the XMEGA device was programmed with a partial AES implementation only. This is done to avoid any crypto export issues. This does not affect your side-channel analysis, but be aware the returned value might not appear to be correct (since only the first couple rounds of AES occurred).

== Basic Usage Instructions ==

{{CollapsibleSection
|intro = === AVR Programmer ===
|content= CW1173_ChipWhisperer-Lite/AVR Programmer}}

{{CollapsibleSection
|intro = === XMEGA Programmer ===
|content= CW1173_ChipWhisperer-Lite/XMEGA Programmer}}

{{CollapsibleSection
|intro = === STM32F Programmer ===
|content= CW308T-STM32F/ChipWhisperer_Bootloader}}

{{CollapsibleSection
|intro = === Using Glitch Port ===
|content= CW1173_ChipWhisperer-Lite/Glitch Port}}

{{CollapsibleSection
|intro = === Using Measure Port ===
|content= CW1173_ChipWhisperer-Lite/Measure Port}}

{{CollapsibleSection
|intro = === 20-Pin Connector ===
|content= CW1173_ChipWhisperer-Lite/20-Pin Connector}}

{{CollapsibleSection
|intro = === 8-Pin SmartCard Connector ===
|content= CW1173_ChipWhisperer-Lite/8-Pin SmartCard Connector}}

{{CollapsibleSection
|intro = === Upgrading SAM3U Firmware ===
|content= CW1173_ChipWhisperer-Lite/Upgrading SAM3U Firmware}}

{{CollapsibleSection
|intro = === Breaking Target Section Apart ===
|content= CW1173_ChipWhisperer-Lite/Breaking Target Section Apart
}}

== Advanced Usage ==

=== Mounting Jumpers ===

Note the ChipWhisperer-Lite main board and target section contain a number of jumper options. By default these are not mounted, and solder jumper bridges on the PCB have been bridged to select the appropriate options when required. Some options are only solder jumpers, which to move the jumper requires a soldering iron to bridge or clear the appropriate connections.

The following lists jumpers on the ChipWhisperer-Lite / Target Section:

; Capture Section Jumpers
* JP4 is the "RESET" net for the SAM3U processor.
* JP2 causes the SAM3U processor flash memory to be erased. When the chip is erased a rom-resident bootloader takes over. See section XXXXX for bootloader details.
* JP5 selects the IO voltage for the FPGA bank which connects to the 20-pin target. By default SJ6 selects this to be 3.3V. It is not recommended to change this, as it is easy to damage the FPGA by feeding an out-of-range voltage in.
* SJ1 selects if the power supply comes from the Micro-USB connector (default) or an external 5V supply at the +5VIN pin.
; Target Section Jumpers:
* JP7 connects the "MEASURE" SMA to the XMEGA VCC Rail. Shorted by default with SJ4.
* JP6 connects the "GLITCH" SMA to the XMEGA VCC Rail. Shorted by default with SJ5.
* JP12 can be used to feed an external voltage into the XMEGA VCC Rail. By default SJ3 connects this to 3.3V.
* SJ2 selects if the 3.3V rail comes from the 20-pin IDC connector (i.e. ChipWhisperer-Lite board), or via an optional LDO and USB connector.



{{CollapsibleSection
|intro = === Schematic ===
[https://github.com/newaetech/chipwhisperer/blob/master/hardware/capture/chipwhisperer-lite/pcb/cw-lite-main.pdf Link to PDF]

(Expand for inline images of schematic)
|content= CW1173_ChipWhisperer-Lite/Schematic
}}
== Hardware ==
{{Template:Hardware}}

[[Category:Capture Hardware]]

CW1173 ChipWhisperer-Lite/Glitch Port

2020-03-12T19:24:30Z

Adewar:

{{Warningbox|This section has been recently updated for ChipWhisperer 5. The previous version can be found here: https://wiki.newae.com/V4:CW1173_ChipWhisperer-Lite/XMEGA_Programmer}}
The "GLITCH" port is used for voltage glitching. It's connected to two MOSFET elements, as the following figure shows:

<blockquote>[[File:glitch_lp_hp.png|image]]
</blockquote>
The CW1173 glitch output can be commanded to turn on either of those MOSFETs via <code>scope.io.glitch_hp</code> and <code>scope.io.glitch_lp</code> fields:

<syntaxhighlight lang=python>
scope.io.glitch_hp = True #enable high power glitch
scope.io.glitch_hp = False #disable high power glitch

scope.io.glitch_lp = True #enable low power glitch
scope.io.glitch_lp = False #disable low power glitch
</syntaxhighlight>

Be careful using this feature, as you don't want to short the MOSFETs for too long. It's also possible to damage the ChipWhisperer-Lite by burning these MOSFETs up if used incorrectly. See tutorial Fault_2 (https://chipwhisperer.readthedocs.io/en/latest/tutorials/fault_2-openadc-cwlitearm.html#tutorial-fault-2-openadc-cwlitearm) for more information.

V4:CW1173 ChipWhisperer-Lite/Glitch Port

2020-03-12T19:21:43Z

Adewar: Created page with "The "GLITCH" port is used for voltage glitching. It's connected to two MOSFET elements, as the following figure shows: <blockquote>image <..."

The "GLITCH" port is used for voltage glitching. It's connected to two MOSFET elements, as the following figure shows:

<blockquote>[[File:glitch_lp_hp.png|image]]
</blockquote>
The CW1173 glitch output can be commanded to turn on either of those MOSFETs via the "Glitch Out Enable" checkboxes:

<blockquote>[[File:glitch_gui.png|image]]
</blockquote>
Be careful using this feature, as you don't want to short the MOSFETs for too long. It's also possible to damage the ChipWhisperer-Lite by burning these MOSFETs up if used incorrectly. See tutorial #A3 for more information on using this feature.

CW308T-STM32F/ChipWhisperer Bootloader

2020-03-12T19:21:01Z

Adewar:

{{Warningbox|These instructions have been updated for ChipWhisperer 5. If you're using and earlier version, see https://wiki.newae.com/V4:CW308T-STM32F/ChipWhisperer_Bootloader}}
The STM32Fx devices have a built-in bootloader, and the ChipWhisperer software as of 3.5.2 includes support for this bootloader.

Important notes before we begin:
* You MUST setup a clock and the serial lines for the chip. This is easily done by connecting to the scope and target, then running <code>default_setup()</code>:
<syntaxhighlight lang=python>
import chipwhisperer as cw
scope = cw.scope
target = cw.target(scope)
scope.default_setup()
</syntaxhighlight>
* On the STM32F1, you MUST adjust the clock frequency to 8MHz. The bootloader does not work with our usual 7.37 MHz clock frequency. '''This 8MHz frequency does not apply to the code that you're running on the device. Once you're done programming, you'll need to set the frequency back to F_CPU (likely 7.37MHz)''' For example:

<syntaxhighlight lang=python>
scope.default_setup()
scope.clock.clkgen_freq = 8E6
#program target...
scope.clock.clkgen_freq = 7.37E6
#reset and run as usual
</syntaxhighlight>

To access the bootloader you can perform these steps. They vary based on if you have a "Rev 02" board or a "Rev 03 or Later" board. The revision number is printed on the bottom side as part of the PCB part number (STM32F-03 is Rev -03 for example).

== Rev -03 or Later ==

Run the following python code once you have the scope and target set up:
<syntaxhighlight lang=python>
prog = cw.programmers.STM32FProgrammer
cw.program_target(scope, prog, "<path to fw hex file>")
</syntaxhighlight>

If you get errors during the programming process:
* Retry the programming process with a lower baud rate:
<syntaxhighlight lang=python>
prog = cw.programmers.STM32FProgrammer
cw.program_target(scope, prog, "<path to fw hex file>", baud=38400)
</syntaxhighlight>
* If using a CW308 based STM, try mounting a jumper between the "SH-" and "SH+" pins at J16 (to the left of the SMA connector) on the UFO board. Retry programming with the jumper mounted.

== Rev -02 Boards ==

The Rev -02 boards did not have all programming connections present. They require some additional steps:

# Setup the device as usual:
#:<syntaxhighlight lang=python>
scope = cw.scope()
target = cw.target(scope)
scope.default_setup()
</syntaxhighlight>
# Mount a jumper between the H1 and PDIC pins (again this is ONLY for the -02 rev).
#: [[File:STMF32F-02 programmer jumper.jpg|400px]]
# Reset the ARM device either by pressing the reset button (newer UFO boards only), or by toggling power:
#:<syntaxhighlight lang=python>
import time
scope.io.target_pwr = False
time.sleep(1)
scope.io.target_pwr = True
</syntaxhighlight>
# Program the device:
#:<syntaxhighlight lang=python>
prog = cw.programmers.STM32FProgrammer
cw.program_target(scope, prog, "<path to fw hex file>")
</syntaxhighlight>
# The device should program, it may take a moment to fully program/verify on larger devices.
# Remove the jumper between the H1/H2 pins.
# Reset the ARM device either by pressing the reset button (newer UFO boards only), or by toggling power:
#:<syntaxhighlight lang=python>
import time
scope.io.target_pwr = False
time.sleep(1)
scope.io.target_pwr = True
</syntaxhighlight>

CW1173 ChipWhisperer-Lite/XMEGA Programmer

2020-03-12T19:12:47Z

Adewar:

{{Warningbox|This section has been recently updated for ChipWhisperer 5. The previous version can be found here: https://wiki.newae.com/V4:CW1173_ChipWhisperer-Lite/XMEGA_Programmer}}

The XMEGA device programmer requires only two connections to the target: clock (PDIC) and data (PDID). The PDIC line is usually shared with the RESET pin, and the PDID pin is a specific pin on the XMEGA device. See [[#20-Pin_Connector]] for details of XMEGA programming pin connections. Once you have the scope setup, the programmer can be accessed through <code>cw.programmers.XMEGAProgrammer</code>:

<syntaxhighlight lang=python>
prog = cw.programmers.XMEGAProgrammer
cw.program_target(scope, prog, "<path to fw hex file>")
</syntaxhighlight>

CW1173 ChipWhisperer-Lite/XMEGA Programmer

2020-03-12T19:11:15Z

Adewar:

{{Warningbox|This section has been recently updated for ChipWhisperer 5. The previous version can be found here: https://wiki.newae.com/V4:CW1173_ChipWhisperer-Lite/XMEGA_Programmer}}

The XMEGA device programmer requires only two connections to the target: clock (PDIC) and data (PDID). The PDIC line is usually shared with the RESET pin, and the PDID pin is a specific pin on the XMEGA device. See [[#20-Pin_Connector]] for details of XMEGA programming pin connections. The programmer can be accessed through <code>cw.programmers.XMEGAProgrammer</code>:

<syntaxhighlight lang=python>
prog = cw.programmers.XMEGAProgrammer
cw.program_target(scope, prog, "<path to fw hex file>")
</syntaxhighlight>

V4:CW1173 ChipWhisperer-Lite/XMEGA Programmer

2020-03-12T19:06:05Z

Adewar: Created page with " The XMEGA device programmer requires only two connections to the target: clock (PDIC) and data (PDID). The PDIC line is usually shared with the RESET pin, and the PDID pin is..."

The XMEGA device programmer requires only two connections to the target: clock (PDIC) and data (PDID). The PDIC line is usually shared with the RESET pin, and the PDID pin is a specific pin on the XMEGA device. See [[#20-Pin_Connector]] for details of XMEGA programming pin connections.

[[File:xmegaprog_main.png|image]]

CW1173 ChipWhisperer-Lite/AVR Programmer

2020-03-12T19:05:23Z

Adewar:

{{Warningbox|This section was recently updated for ChipWhisperer 5. The old version can be found here: https://wiki.newae.com/V4:CW1173_ChipWhisperer-Lite/AVR_Programmer.}}
The CW1173 and CW1200 have built-in support for programming either Atmel AVR or Atmel XMEGA device. This is designed to allow you to program our target boards (including the built-in XMEGA target).

Note this programmer is fairly simple, and ''does not'' provide all the features of a stand-alone programmer.

The AVR device programmer requires four connections to the target: RESET, MOSI, MISO, SCK. See [[#20-Pin_Connector]] for details of AVR programming pin connections.

==== Accessing the Programmer ====

First, setup the ChipWhisperer as usual:
<syntaxhighlight lang=python>
import chipwhisperer as cw
scope = cw.scope()
target = cw.target(scope)
</syntaxhighlight>

Next, the AVR programmer can be accessed through the cw.programmers.AVRProgrammer object:

<syntaxhighlight lang=python>
prog = cw.programmers.AVRProgrammer
</syntaxhighlight>
==== Programming the Flash ====

Note to use the AVR programmer you may require a valid clock source for the AVR. It is suggested to use the default ChipWhisperer setup, which will generate a 7.37MHz clock:

<syntaxhighlight lang=python>
scope.default_setup()
</syntaxhighlight>

Note that NewAE's Notduino targets have the transmit and receive pins swapped compared to the usual targets. If you're using one of these targets, swap them using the API:

<syntaxhighlight lang=python>
scope.io.tio1 = "serial_tx"
scope.io.tio2 = "serial_rx"
</syntaxhighlight>

Next, try programming the device by calling <code>cw.program_target()</code>:

<syntaxhighlight lang=python>
cw.program_target(scope, prog, "<path to hex file")
</syntaxhighlight>

The default SPI data rate for the programmer is too fast for devices which are running slower than 2 MHz. If programming a device with a clock source slower than 2 MHz, you will need to enable the "Slow Clock Mode". In "Slow Clock Mode" the entire SAM3U and FPGA clock is changed from 96 MHz to 12 MHz. Note the default fuse bytes for a virgin ATMega328P result in a 1 MHz clock, so you will need to use "slow clock mode" to program the correct fuse bytes, after which point you will not need to use "slow clock mode".

To enable slow clock mode, call <code>program_target</code> with an additional <code>slow_clock = True</code> parameter:

<syntaxhighlight lang=python>
cw.program_target(scope, prog, "<path to hex file", slow_clock=True)
</syntaxhighlight>

<blockquote>'''note'''

The 'slow clock mode' is used to provide a slower SPI clock than would otherwise be possible. When switching into 'slow clock mode' it will cause all DCM blocks in the FPGA to become unlocked. You will need to reset the DCM blocks, or simply call <code>default_setup()</code> again (this will reset the serial pins, so you'll have to swap them again if you're using a Notduino target).
</blockquote>
==== Programming the Fuses ====

By default the AVR programmer allows you to modify the LOW fuse byte only, as this byte controls the clock source selection. To change the value of the fuse byte, you'll need to manually setup the programmer:

<syntaxhighlight lang=python>
avr_programmer = prog(slow_clock=False) #call with slow_clock = True to enable the slow clock
avr_programmer.scope = scope
avr_programmer.open()
avr_programmer.find()
</syntaxhighlight>

Once that's accomplished, the readFuse() and writeFuse() methods can be used to read and write the fuse bits, respectively:

<syntaxhighlight lang=python>
fuse_vals = avr_programmer.readFuse(<value>)
avr_programmer.writeFuse(<value>, <lfuse>)
</syntaxhighlight>

with <value> corresponding to one of the following: "low", "high", or "extended".

See [http://eleccelerator.com/fusecalc/fusecalc.php?chip=atmega328p an Online Fuse Calculator] to better understand what the values mean.

<blockquote>'''tip'''

; If programming a virgin ATMega328P device, the default low-fuse value of <code>62</code> results in the internal 8 MHz oscillator being divided down to 1 MHz. Any external clock is ignored.

The low fuse byte must be changed to <code>D0</code> to use the external clock provided by the ChipWhisperer toolchain.
</blockquote>
==== Troubleshooting ====

If you run into issues when programming the AVR, try the following troubleshooting methods:

* Ensure the ChipWhisperer is outputting a clock if the target requires one.
* Ensure you have the serial pins the right way around
* Ensure the fuse bits are set correctly.

V4:CW1173 ChipWhisperer-Lite/AVR Programmer

2020-03-12T17:19:49Z

Adewar: Created page with "The CW1173 and CW1200 have built-in support for programming either Atmel AVR or Atmel XMEGA device. This is designed to allow you to program our target boards (including the b..."

The CW1173 and CW1200 have built-in support for programming either Atmel AVR or Atmel XMEGA device. This is designed to allow you to program our target boards (including the built-in XMEGA target).

Note this programmer is fairly simple, and ''does not'' provide all the features of a stand-alone programmer.

The AVR device programmer requires four connections to the target: RESET, MOSI, MISO, SCK. See [[#20-Pin_Connector]] for details of AVR programming pin connections.

==== Accessing the Programming ====

To access the AVR Programmer, select the "CW-Lite AVR Programmer" from the pull-down Tools menu:

[[File:avrprog_menu.png|image]]

Which should give you the AVR Programmer Window.

==== Clock Source Selection ====

Note to use the AVR programmer you may require a valid clock source for the AVR. It is suggested to select one of the setup scripts (such as <code>ChipWhisperer-Lite: AES Simple-Serial on ATMega328P</code>) which will generate a 7.37 MHz clock.

Check if the device is found by pressing the "Check Signature" button. The status window will show the detected device based on the signature.

[[File:avrprog_sigok.png|image]]

If this fails, double-check connections, and ensure the clock source to the AVR is suitable. Note some errors will appear as part of the main window log:

[[File:avrprog_fail.png|image]]

The default SPI data rate for the programmer is too fast for devices which are running slower than 2 MHz. If programming a device with a clock source slower than 2 MHz, you will need to enable the "Slow Clock Mode". In "Slow Clock Mode" the entire SAM3U and FPGA clock is changed from 96 MHz to 12 MHz. Note the default fuse bytes for a virgin ATMega328P result in a 1 MHz clock, so you will need to use "slow clock mode" to program the correct fuse bytes, after which point you will not need to use "slow clock mode".

<blockquote>'''note'''

The 'slow clock mode' is used to provide a slower SPI clock than would otherwise be possible. When switching into 'slow clock mode' it will cause all DCM blocks in the FPGA to become unlocked. You will need to reset the DCM blocks, or simply restart the CW-Capture software and run the setup script.
</blockquote>
==== Programming the Fuses ====

By default the AVR programmer allows you to modify the LOW fuse byte only, as this byte controls the clock source selection. To change the value of the fuse byte:

# Press the "Read Fuses" button, and the values should be populated
# Specify the new low fuse value
# Hit "Write Fuses"

See [http://eleccelerator.com/fusecalc/fusecalc.php?chip=atmega328p an Online Fuse Calculator] to better understand what the values mean.

<blockquote>'''tip'''

; If programming a virgin ATMega328P device, the default low-fuse value of <code>62</code> results in the internal 8 MHz oscillator being divided down to 1 MHz. Any external clock is ignored.

The low fuse byte must be changed to <code>D0</code> to use the external clock provided by the ChipWhisperer toolchain.
</blockquote>
==== Programming the Flash ====

Programming the flash is accomplished by selecting the new .hex file in the "Find" menu, and pressing the "Erase/Program/Verify FLASH" button. The "Status" line will show the following information:

* File programmed into device
* Time file was last modified (very useful to confirm you are using changed file when doing development)
* Status of verification, and number of bytes programmed/verified

[[File:avrprog_progok.png|image]]

CW1173 ChipWhisperer-Lite

2020-03-11T20:02:12Z

Adewar: /* Connection Quick-Start */

{{Warningbox|This page has not yet been updated for the v5 release. Some information may be outdated.}}



The ChipWhisperer-Lite Bare Board consists of two main parts: a multi-purpose power analysis capture instrument, and a target board. The target board is a standard microcontroller which you can implement algorithms onto. For example if you wish to evaluate an AES library, you can program that library into the target board and perform the power analysis.

[[File:cwlite_basic.png|image]]

== Quick-Start Guide ==

You can see a [http://www.youtube.com/watch?v=MJmkYqA-LeM&hd=1 Video] of the quickstart guide, which will take you through all the setup items discussed here:

[[File:cwlite_demo_video.png|link=http://www.youtube.com/watch?v=MJmkYqA-LeM&hd=1]]

== Connection Quick-Start ==
<ol>
<li>Follow the [[Installing ChipWhisperer]] instructions for the ChipWhisperer software and its prerequisites.</li>
<li>Connect ChipWhisperer-Lite, install USB Drivers:
<dl>
<dt>Windows:</dt>
<dd><ul>
<li>Plug micro-USB cable into ChipWhisperer-Lite</li>
<li>If the "New Hardware Found" wizard doesn't prompt you for drivers, go to the control panel and find the "ChipWhisperer-Lite" device, and select "Update Drivers".</li>
<li>You can find drivers in <code>c:\chipwhisperer\hardware\capture\chipwhisperer-lite\</code>. You will likely need to extract them from the <code>cwlite_usb_driver.zip</code> file. If so simply extract them somewhere (i.e. your desktop), and then point the new hardware found wizard to that location.</li></ul>
</dd>
<dt>Linux:</dt>
<dd><ul>
<li>Driver installation is not required, but if you do not update the 'udev' system, you will be unable to run ChipWhisperer-Capture as a regular user. To update the udev system, first make sure the ChipWhisperer-Lite is Make a file called <code>/etc/udev/rules.d/99-cwlite.rules</code> . The contents of this file should be:
<pre># allow users to claim the device
SUBSYSTEM=="usb", ATTRS{idVendor}=="2b3e", ATTRS{idProduct}=="ace2", MODE="0664", GROUP="plugdev"</pre></li>
<li>Add your username to the plugdev group:
<pre>$ sudo usermod -a -G plugdev YOUR-USERNAME</pre></li>
<li>And reset the udev system:
<pre>$ sudo udevadm control --reload-rules</pre></li>
<li>Finally log out & in again for the group change to take effect.</li>
<li>Connect the micro-USB cable</li></ul>
</dd>
<dt>MAC:</dt>
<dd><ul>
<li>No special installation required - must ensure you have installed libusb via homebrew (see instructions at [[MacOSX_Installation]]).</li></ul>
</dd></dl>
</li>
<li>To check for a successful installation, connect to the ChipWhisperer. This can be done from one of two ways:
<blockquote><ul>
<li>Open up a terminal and run python. Next, run <code>import chipwhisperer as cw; scope = cw.scope()</code>.</li>
<li>Open Jupyter Notebook and open PA_Intro_1-Firmware_Build_Setup.ipynb. On the toolbar, click Cell>Run All. If the tutorial completes successfully, your installation should be good to go!</li></ul></blockquote>

For more information on starting ChipWhisperer, see: https://chipwhisperer.readthedocs.io/en/latest/starting.html</ol>

== Capture and Attack Quickstart ==

# See [[Tutorial_B5_Breaking_AES_(Straightforward)]]for details. Note the hardware setup is slightly different -- but you can skip to step 5.5.3, and should be able to pick up from there. Be sure to use the <code>ChipWhisperer-Lite: AES SimpleSerial on XMEGA</code> script instead of the one referenced in step 5.5.3.

== Important Bugs/Caveats ==

The following includes various things that might trip you up:

# If you save the project ''before'' running the capture, you can specify any directory. Traces will be copied to the appropriate location during capture.
# If you save the project ''after'' running the capture, you must save the project to the same directory that "default-data-dir" exists in. This is normally the folder from where you invoked the Python GUI.
# There are a few warnings/exceptions that come up (i.e. divide-by-zero). Generally just keep going and see if things are still working. A number of those are on the ''TODO'' list to fix but I didn't get around to it yet.
# The "Total Ops" window which checks for proper AES operation requires PyCrypto to be installed.
# By default the XMEGA device was programmed with a partial AES implementation only. This is done to avoid any crypto export issues. This does not affect your side-channel analysis, but be aware the returned value might not appear to be correct (since only the first couple rounds of AES occurred).

== Basic Usage Instructions ==

{{CollapsibleSection
|intro = === AVR Programmer ===
|content= CW1173_ChipWhisperer-Lite/AVR Programmer}}

{{CollapsibleSection
|intro = === XMEGA Programmer ===
|content= CW1173_ChipWhisperer-Lite/XMEGA Programmer}}

{{CollapsibleSection
|intro = === Using Glitch Port ===
|content= CW1173_ChipWhisperer-Lite/Glitch Port}}

{{CollapsibleSection
|intro = === Using Measure Port ===
|content= CW1173_ChipWhisperer-Lite/Measure Port}}

{{CollapsibleSection
|intro = === 20-Pin Connector ===
|content= CW1173_ChipWhisperer-Lite/20-Pin Connector}}

{{CollapsibleSection
|intro = === 8-Pin SmartCard Connector ===
|content= CW1173_ChipWhisperer-Lite/8-Pin SmartCard Connector}}

{{CollapsibleSection
|intro = === Upgrading SAM3U Firmware ===
|content= CW1173_ChipWhisperer-Lite/Upgrading SAM3U Firmware}}

{{CollapsibleSection
|intro = === Breaking Target Section Apart ===
|content= CW1173_ChipWhisperer-Lite/Breaking Target Section Apart
}}

== Advanced Usage ==

=== Mounting Jumpers ===

Note the ChipWhisperer-Lite main board and target section contain a number of jumper options. By default these are not mounted, and solder jumper bridges on the PCB have been bridged to select the appropriate options when required. Some options are only solder jumpers, which to move the jumper requires a soldering iron to bridge or clear the appropriate connections.

The following lists jumpers on the ChipWhisperer-Lite / Target Section:

; Capture Section Jumpers
* JP4 is the "RESET" net for the SAM3U processor.
* JP2 causes the SAM3U processor flash memory to be erased. When the chip is erased a rom-resident bootloader takes over. See section XXXXX for bootloader details.
* JP5 selects the IO voltage for the FPGA bank which connects to the 20-pin target. By default SJ6 selects this to be 3.3V. It is not recommended to change this, as it is easy to damage the FPGA by feeding an out-of-range voltage in.
* SJ1 selects if the power supply comes from the Micro-USB connector (default) or an external 5V supply at the +5VIN pin.
; Target Section Jumpers:
* JP7 connects the "MEASURE" SMA to the XMEGA VCC Rail. Shorted by default with SJ4.
* JP6 connects the "GLITCH" SMA to the XMEGA VCC Rail. Shorted by default with SJ5.
* JP12 can be used to feed an external voltage into the XMEGA VCC Rail. By default SJ3 connects this to 3.3V.
* SJ2 selects if the 3.3V rail comes from the 20-pin IDC connector (i.e. ChipWhisperer-Lite board), or via an optional LDO and USB connector.



{{CollapsibleSection
|intro = === Schematic ===
[https://github.com/newaetech/chipwhisperer/blob/master/hardware/capture/chipwhisperer-lite/pcb/cw-lite-main.pdf Link to PDF]

(Expand for inline images of schematic)
|content= CW1173_ChipWhisperer-Lite/Schematic
}}
== Hardware ==
{{Template:Hardware}}

[[Category:Capture Hardware]]

CW1173 ChipWhisperer-Lite

2020-03-11T20:01:53Z

Adewar: /* Connection Quick-Start */

{{Warningbox|This page has not yet been updated for the v5 release. Some information may be outdated.}}



The ChipWhisperer-Lite Bare Board consists of two main parts: a multi-purpose power analysis capture instrument, and a target board. The target board is a standard microcontroller which you can implement algorithms onto. For example if you wish to evaluate an AES library, you can program that library into the target board and perform the power analysis.

[[File:cwlite_basic.png|image]]

== Quick-Start Guide ==

You can see a [http://www.youtube.com/watch?v=MJmkYqA-LeM&hd=1 Video] of the quickstart guide, which will take you through all the setup items discussed here:

[[File:cwlite_demo_video.png|link=http://www.youtube.com/watch?v=MJmkYqA-LeM&hd=1]]

== Connection Quick-Start ==
<ol>
<li>Follow the [[Installing ChipWhisperer]] instructions for the ChipWhisperer software and its prerequisites.</li>
<li>Connect ChipWhisperer-Lite, install USB Drivers:
<dl>
<dt>Windows:</dt>
<dd><ul>
<li>Plug micro-USB cable into ChipWhisperer-Lite</li>
<li>If the "New Hardware Found" wizard doesn't prompt you for drivers, go to the control panel and find the "ChipWhisperer-Lite" device, and select "Update Drivers".</li>
<li>You can find drivers in <code>c:\chipwhisperer\hardware\capture\chipwhisperer-lite\</code>. You will likely need to extract them from the <code>cwlite_usb_driver.zip</code> file. If so simply extract them somewhere (i.e. your desktop), and then point the new hardware found wizard to that location.</li></ul>
</dd>
<dt>Linux:</dt>
<dd><ul>
<li>Driver installation is not required, but if you do not update the 'udev' system, you will be unable to run ChipWhisperer-Capture as a regular user. To update the udev system, first make sure the ChipWhisperer-Lite is Make a file called <code>/etc/udev/rules.d/99-cwlite.rules</code> . The contents of this file should be:
<pre># allow users to claim the device
SUBSYSTEM=="usb", ATTRS{idVendor}=="2b3e", ATTRS{idProduct}=="ace2", MODE="0664", GROUP="plugdev"</pre></li>
<li>Add your username to the plugdev group:
<pre>$ sudo usermod -a -G plugdev YOUR-USERNAME</pre></li>
<li>And reset the udev system:
<pre>$ sudo udevadm control --reload-rules</pre></li>
<li>Finally log out & in again for the group change to take effect.</li>
<li>Connect the micro-USB cable</li></ul>
</dd>
<dt>MAC:</dt>
<dd><ul>
<li>No special installation required - must ensure you have installed libusb via homebrew (see instructions at [[MacOSX_Installation]]).</li></ul>
</dd></dl>
</li>
<li>To check for a successful installation, connect to the ChipWhisperer. This can be done from one of two ways:
<blockquote><ul>
<li>Open up a terminal and run python. Next, run <code>import chipwhisperer as cw; scope = cw.scope()</code>.</li>
<li>Open Jupyter Notebook and open PA_Intro_1-Firmware_Build_Setup.ipynb. On the toolbar, click Cell>Run All. If the tutorial completes successfully, your installation should be good to go!</li></ul></blockquote>

For more information on starting ChipWhisperer, see: https://chipwhisperer.readthedocs.io/en/latest/starting.html

== Capture and Attack Quickstart ==

# See [[Tutorial_B5_Breaking_AES_(Straightforward)]]for details. Note the hardware setup is slightly different -- but you can skip to step 5.5.3, and should be able to pick up from there. Be sure to use the <code>ChipWhisperer-Lite: AES SimpleSerial on XMEGA</code> script instead of the one referenced in step 5.5.3.

== Important Bugs/Caveats ==

The following includes various things that might trip you up:

# If you save the project ''before'' running the capture, you can specify any directory. Traces will be copied to the appropriate location during capture.
# If you save the project ''after'' running the capture, you must save the project to the same directory that "default-data-dir" exists in. This is normally the folder from where you invoked the Python GUI.
# There are a few warnings/exceptions that come up (i.e. divide-by-zero). Generally just keep going and see if things are still working. A number of those are on the ''TODO'' list to fix but I didn't get around to it yet.
# The "Total Ops" window which checks for proper AES operation requires PyCrypto to be installed.
# By default the XMEGA device was programmed with a partial AES implementation only. This is done to avoid any crypto export issues. This does not affect your side-channel analysis, but be aware the returned value might not appear to be correct (since only the first couple rounds of AES occurred).

== Basic Usage Instructions ==

{{CollapsibleSection
|intro = === AVR Programmer ===
|content= CW1173_ChipWhisperer-Lite/AVR Programmer}}

{{CollapsibleSection
|intro = === XMEGA Programmer ===
|content= CW1173_ChipWhisperer-Lite/XMEGA Programmer}}

{{CollapsibleSection
|intro = === Using Glitch Port ===
|content= CW1173_ChipWhisperer-Lite/Glitch Port}}

{{CollapsibleSection
|intro = === Using Measure Port ===
|content= CW1173_ChipWhisperer-Lite/Measure Port}}

{{CollapsibleSection
|intro = === 20-Pin Connector ===
|content= CW1173_ChipWhisperer-Lite/20-Pin Connector}}

{{CollapsibleSection
|intro = === 8-Pin SmartCard Connector ===
|content= CW1173_ChipWhisperer-Lite/8-Pin SmartCard Connector}}

{{CollapsibleSection
|intro = === Upgrading SAM3U Firmware ===
|content= CW1173_ChipWhisperer-Lite/Upgrading SAM3U Firmware}}

{{CollapsibleSection
|intro = === Breaking Target Section Apart ===
|content= CW1173_ChipWhisperer-Lite/Breaking Target Section Apart
}}

== Advanced Usage ==

=== Mounting Jumpers ===

Note the ChipWhisperer-Lite main board and target section contain a number of jumper options. By default these are not mounted, and solder jumper bridges on the PCB have been bridged to select the appropriate options when required. Some options are only solder jumpers, which to move the jumper requires a soldering iron to bridge or clear the appropriate connections.

The following lists jumpers on the ChipWhisperer-Lite / Target Section:

; Capture Section Jumpers
* JP4 is the "RESET" net for the SAM3U processor.
* JP2 causes the SAM3U processor flash memory to be erased. When the chip is erased a rom-resident bootloader takes over. See section XXXXX for bootloader details.
* JP5 selects the IO voltage for the FPGA bank which connects to the 20-pin target. By default SJ6 selects this to be 3.3V. It is not recommended to change this, as it is easy to damage the FPGA by feeding an out-of-range voltage in.
* SJ1 selects if the power supply comes from the Micro-USB connector (default) or an external 5V supply at the +5VIN pin.
; Target Section Jumpers:
* JP7 connects the "MEASURE" SMA to the XMEGA VCC Rail. Shorted by default with SJ4.
* JP6 connects the "GLITCH" SMA to the XMEGA VCC Rail. Shorted by default with SJ5.
* JP12 can be used to feed an external voltage into the XMEGA VCC Rail. By default SJ3 connects this to 3.3V.
* SJ2 selects if the 3.3V rail comes from the 20-pin IDC connector (i.e. ChipWhisperer-Lite board), or via an optional LDO and USB connector.



{{CollapsibleSection
|intro = === Schematic ===
[https://github.com/newaetech/chipwhisperer/blob/master/hardware/capture/chipwhisperer-lite/pcb/cw-lite-main.pdf Link to PDF]

(Expand for inline images of schematic)
|content= CW1173_ChipWhisperer-Lite/Schematic
}}
== Hardware ==
{{Template:Hardware}}

[[Category:Capture Hardware]]

CW308T-MPC5748G

2020-03-11T19:02:20Z

Adewar:

{{Warningbox|This requires a programmer for the MPC5748G to reload code. }}
{{Warningbox|This target requires special setup. An example script can be found at: https://github.com/newaetech/chipwhisperer-jupyter/blob/1ccd1b1fbd8a3295e1033efb37e53e1022d47cc5/Helper_Scripts/Setup_CW308_MPC5748G.ipynb}}

{{Infobox cw308target
|name = CW308T-MPC5748G
|image = mpc5748g_web.jpg
|caption =
|Target Device = NXP MPC5748G
|Target Architecture = PowerPC, Triple-Core
|Hardware Crypto = Possible
|Purchase Hardware =
|Design Files = [https://github.com/newaetech/chipwhisperer-target-mpc5748g Example Application]
|Supported Applications =
}}

The MPC5748G target uses the NXP MPC5748G device, which is a triple-core PowerPC microcontroller for automotive applications. This target board has a number of interesting features including:

* Two CAN interfaces, with with DB9.
* Two serial ports (usable as LIN).
* Various solder jumpers for variety of power analysis options.

=Intended Usage=

== Demo Application ==

The demo application provides examples of:
* Using serial interface (implements Simple-Serial).
* Using CAN interface.
* Enabling all three cores, and communicating between cores with shared memory.
* Running software AES on main core.
* Running password-check (XOR) on main core.
* Setup of clock network for using external clock from ChipWhisperer.
* Enabling the PASS module & passing a password to it (to allow DPA testing of PASS module).

This demo application is posted as a separate github repository at [https://github.com/newaetech/chipwhisperer-target-mpc5748g https://github.com/newaetech/chipwhisperer-target-mpc5748g]. The github link includes additional documentation.

== Offered Variants ==
The product is available in one variant:

* The "NORMAL" variant which is normally shipped (i.e., P/N NAE-CW308T-MPC5748G). This variant has the following setup:
** HSM is not programmed. We cannot provide details on this usage without a NDA.
** The four OTP password groups have been programmed with 4 known passwords you can use for experimentation.
** Device lifecycle is progressed to the "OEM Production" stage. This will prevent you from doing certain updates to the memory, but for most "normal" uses will not prevent reloading of code etc. This progression is done since it is required to use the password/censorship features.
** The demo application is loaded which includes ability to execute code loaded over the serial port and change/read memory locations (but is NOT a full bootloader).
** Device censorship is disabled (this can be turned on using an external programmer).
** The JTAG port has a known password, but is not locked (this can be turned on using an external programmer or via load functions).

== Programming ==

The device is designed to use an external programmer for reflashing, as it does not include a bootloader. The suggested programmer (scripts are provided in the GIT repo) is the PE-Micro which requires purchasing:
*PEMicro USB Multilink or USB Mulilink FX
*PEMicro PROGPPCNEXUS (Programmer SW only) or PEMicro PowerPC Nexus Development Kit (includes Debugger). You may be able to use a GDB server instead but we haven't tested this.

You can use the MPC5748G-DEVKIT instead with invasive hardware mods - the devkit has an on-board programmer, but it uses buffers such it cannot be routed to any available header pins. You would need to solder small jumper wires to small SMD pins for this to work. However as the dev-kit is very cheap, it may be worthwhile to scrap one and convert into an external programmer.

== HSM Usage ==

The device features a HSM, but details of this are under NDA and cannot be made public.

== Random Useful Tips ==

=== S32DS Version ===

It is recommended to use S32DS Version 2017 or later. The default linker scripts changed slightly in such a way that old scripts don't work with the new version, and thus all scripts have been updated to work with the latest release.

=== Disassembling Source ===

If you are having trouble debugging, it can be useful to read out a memory segment and dissassemble it. This is possible with the included S32DS tools. The following shows the required command line:

E:\nxp\S32DS_Power_v2017.R1\Cross_Tools\powerpc-eabivle-4_9\bin>powerpc-eabivle-objdump.exe -mpowerpc -Me200z4 -D -b srec -EB MPC5748G.s19 > MPC5748G.txt

== Hardware ==
{{Template:Hardware}}

[[Category: CW308 Targets]]

CW308T-ESP32

2020-03-11T19:00:30Z

Adewar:

{{Warningbox|This target requires special setup. An example script can be found at: https://github.com/newaetech/chipwhisperer-jupyter/blob/1ccd1b1fbd8a3295e1033efb37e53e1022d47cc5/Helper_Scripts/Setup_CW308_ESP32.ipynb}}
{{Infobox cw308target
|name = CW308T-ESP32
|image = ESP32_topdown_web.jpg
|caption =
|Target Device = ESP32
|Target Architecture = ARM
|Hardware Crypto = Yes
|Purchase Hardware =

|Supported Applications =
}}

The ESP32 is a super-low-cost IoT device with Bluetooth & WiFi support. This target board does not break out any of the RF capabilities, and is primarily concerned with testing portions of the device stand-alone (such as secure boot, AES hardware accelerator, etc).

== SPI Buffer ==

This device uses a Texas Instruments TXB0104 as a SPI buffer. This is a bidirectional buffer chip, meaning you can use it in any of the following ways:

* Disable chip, allowing ESP32 to load/program the attached SPI flash chip.
* Sniff the SPI bus, but with a buffer in-line to prevent your sniffer from affecting the SPI load process (or trigger on SPI packets).
* Program the SPI chip using external programmer. To do this hold ESP32 in reset.
* Use an external SPI chip (or emulator) to load the data for the ESP32. To do this you'll have to disconnect the CS pin of the SPI chip.

The direction is detected automatically.

== SPI Flash Device ==

The ESP32 needs an attached SPI flash. The production devices use a W25Q32BVSSIG from Winbond, but this can be difficult to find from regular distributors. If you are building your own device I suggest using ISSI IS25WP032D-JBLE which is more widely available.

A variety of other devices will not work with the bootloader, meaning you cannot easily program them. It's not known exactly what is needed (they need to support DSPI at least), but for example SST26VF016BT-104I/SN did not work.

== Example Application ==

An example application is provided in the GIT repository in the [https://github.com/newaetech/chipwhisperer/tree/develop/hardware/victims/firmware/esp32 firmware/esp32 ] directory. Note this hasn't yet been integrated into the full build system. This application uses hardware AES.

== Schematic ==

For PDF see GIT repository.

[[File:CW308T-ESP32-02_schematic_Page_2.png|1000px]]

[[File:CW308T-ESP32-02_schematic_Page_1.png|1000px]]

== Hardware ==
{{Template:Hardware}}

CW308T-AVR

2020-03-11T18:55:32Z

Adewar:

{{Warningbox|The serial pins for this target are swapped compared to the usual setup. An example setup script can be found here: https://github.com/newaetech/chipwhisperer-jupyter/blob/1ccd1b1fbd8a3295e1033efb37e53e1022d47cc5/Helper_Scripts/Setup_Notduino.ipynb}}
{{Infobox cw308target
|name = CW308T-AVR
|image = File:P1090088.jpg
|caption =
|Target Device = Atmel AVR
|Target Architecture = 8-bit Harvard
|Hardware Crypto = No
|Purchase Hardware =
|Design Files = [https://github.com/newaetech/chipwhisperer/tree/master/hardware/victims/cw308_ufo_target/avr GITHub link]

[https://github.com/newaetech/chipwhisperer/blob/master/hardware/victims/cw308_ufo_target/avr/cw308t-avr-bom-1click.tsv 1-Click BOM]

[https://oshpark.com/shared_projects/65GO0ZHN OSH Park PCBs]
|Supported Applications = [[SimpleSerial | Simple Serial Enc/Auth]]
|Programmer = CW Integrated (ISP)
Atmel ICE (ISP)
|Status = Released
}}

== I/O Connections ==

The pinout of this module matches the "NOTDuino" kit along with the "CW301 Multi-Target Board" routing. The following is the connection between GPIO1-4 and the I/O lines on the AVR:

{| class="wikitable"
!CW308 Pin
!ATMega328P Pin
!Notes
|-
|GPIO1
|PD0 (RXD)
|Serial INPUT to AVR.
|-
|GPIO2
|PD1 (TXD)
|Serial OUTPUT from AVR.
|-
|GPIO3
|N/C
|
|-
|GPIO4
|PC0
|Trigger pin (mapped to ADC-port such that I/O driver power comes from AVCC).
|-
|CLKIN
|XTAL1
|
|-
|CLKFB
|PB0
|Can set this pin as CLKO with fuse. Useful for synchronizing to internal RC oscillator.
|-
|nRST
|nRST (PC6)
|Used by in-system-programming (ISP) interface.
|-
|MOSI
|PB3 (MOSI)
|Used by in-system-programming (ISP) interface.
|-
|MISO
|PB4 (MISO)
|Used by in-system-programming (ISP) interface.
|-
|SCK
|PB5 (SCK)
|Used by in-system-programming (ISP) interface.
|}

== Programming Header ==

The 6-pin programming heading can be used with the Atmel ISP interface. The pinout of the 6-pin programming header on the main-board allows it to work with standard Atmel ISP tools:

[[File:avr_isp.jpg|400px]]

== Schematic ==

[[File:CW308T_AVR_Schematic_Page_1.png|1000px]]

[[File:CW308T_AVR_Schematic_Page_2.png|1000px]]

== Hardware ==

{{Template:Hardware}}
[[Category: CW308 Targets]]

CW304 Notduino Target

2020-03-11T18:25:00Z

Adewar:

{{Warningbox|The serial pins for the Notduino Target are swapped compared to most other targets. An example script for correctly setting up the Notduino can be found here: https://github.com/newaetech/chipwhisperer-jupyter/blob/1ccd1b1fbd8a3295e1033efb37e53e1022d47cc5/Helper_Scripts/Setup_Notduino.ipynb}}
{{Infobox cw308target
|name = CW308T-CEC1702
|image = File:Notduino.jpg
|caption =
|Target Device = Atmel MEGA328P
|Target Architecture = 8-bit RISC
|Hardware Crypto =
|Purchase Hardware =
|Supported Applications =
|Programmer = CW Integrated (ISP)
|Status = Released
}}

The Notduino is used as a target for the ChipWhisperer Capture system. This includes interfacing to the CW-Lite (CW1173) and ChipWhisperer Capture Rev 2 (CW1002).

== Specifications / Feature Set ==
* 3.3V Operating Voltage
* Atmel ATMega328P Microcontroller
* Power analysis on VCC rail
* Power glitching using CW1173 Crowbar
* One user LED
* One user push-button
* Clock input or output line
* 6 user I/O lines (including trigger to ChipWhisperer)
* Optional crystal mounting holes
* USART Lines for communication
* Header to connect USB-Serial for Arduino bootloader usage

== Board Usage ==

The board is connected to the standard 20-pin target connector used on the ChipWhisperer system. In addition you will require connection of the SMA connector to perform power measurements:

[[File:Cwlite_notduino.jpg|image]]

Like most of our targets, the Notduino can be used without the capture hardware. In this case the SMA connector is used to connect to the regular oscilloscope, and a USB-Serial is used for communications:

[[File:Normalscope.jpg|image]]

=== VCC Jumper Settings (JP2) ===

JP2 uses our standard 6-pin connector, similar to the Multi-Target board. On the NOTDuino board only the VCC shunt is present however, which means you cannot perform measurements on a GND shunt.

Using the header in the following position is required for both side-channel power analysis and voltage-glitching attacks:

[[File:6pin_measure.jpg|image]]

If you are only doing clock glitching attacks (without associated power measurement), you could short the jumper:

[[File:6pin_short.jpg|image]]

== Clock Jumper Settings (JP8/JP9) ==

The clock jumpers allow you to connect the HSOUT and HSIN lines to the two XTAL pins on the ATMega328P. Normally you would mount JP8, which routes the HSOUT line from the ChipWhisperer to the "External Clock Input" on the ATMega328P.

You can also try mounting a crystal at Q1 (along with require capacitors typically in 18pF-22pF range) at C8 and C9. If this is done, you will need to ensure the fuses for the ATMega328P are programmed for the "Full Output Swing", and you can then route the output of the crystal buffer to CLKIN by mounting pin C9.

Finally, you can also solder a wire from pin 14 (PB0) of the ATMega328P to pin 10 (PB7, the XTAL out pin). This allows you to enable the internal oscillator of the ATMega328P, and also enable the "Clock Out" pin. This clock output drives the internal oscillator frequency onto the output pin, which you then route to the HSIN lines.

== Serial Header (JP4) ==

The serial header at JP4 provides a method of connecting a standard serial cable to the NOTDuino board. Note the "RST" pin is broken out, allowing you to use a serial cable with a "DTR" pin to control the reset of the ATMega328P (which is required for the Arduino bootloader).

Note you will need to mount an appropriate crystal at Q1, along with C8 and C9 if not using the ChipWhisperer for a clock source.

{|
! Silkscreen
! ATMega328P
! Arduino Name
! Notes
|-
| GND
| Ground
|

|

|-
| 3V3
| VCC
|

| If NOT connected to CW-Lite, can power from 3-5V
|-
| TXD
| PORTD.1
| Pin 1
| Output from AVR
|-
| RXD
| PORTD.0
| Pin 0
| Input to AVR
|-
| RST
| Reset
|

|

|}

== User IO Header (JP3) ==

The user IO header breaks out

{|
! Silkscreen
! ATMega328P
! Arduino Name
! Notes
|-
| GND
| Ground
|

|

|-
| A5
| PORTC.5
| Analog Pin A5
|

|-
| A4
| PORTC.4
| Analog Pin A4
|

|-
| A3
| PORTC.3
| Analog Pin A3
|

|-
| A2
| PORTC.2
| Analog Pin A2
|

|-
| 1
| PORTC.1
| Analog Pin A1
|

|-
| 0
| PORTC.0
| Analog Pin A0
| Trigger
|}

== Using Arduino Software ==

If you wish to use the Arduino software with the NOTDuino board, there is two main methods of doing that:

# Using ChipWhisperer-Lite as programmer.
# Using board entirely stand-alone.

=== Using ChipWhisperer-Lite as Programmer ===

If using the board with the ChipWhisperer-Lite attached (i.e. using the ChipWhisperer-Lite as the capture hardware), this requires the fewest modifications. To use the board you will need to:

<ol style="list-style-type: decimal;">
<li>In the tutorials, set the CLKGEN frequency to 16.00 MHz instead of 7.37 MHz.</li>
<li>Use the integrated AVR programmer, program the compiled <code>.hex</code> file. This file can be found in two ways:
<ol style="list-style-type: lower-alpha;">
<li>For Arduino 1.6.5 or later, there is an ''Export Compiled Binary'' from the ''Sketch'' menu.</li>
<li>For earlier version of Arduino, enable the ''Show vervose output during compilation'' in the ''Preferences'' menu. This will show you where the <code>.hex</code> file is located (NOTE: it changes after every compilation).</li></ol>
</li></ol>

=== Using Board Entirely Stand-Alone ===

If using the board stand-alone, you will need to perform the following:

<ol style="list-style-type: decimal;">
<li>Program the Arduino bootloader into the ATMega328P. This can be done with the ChipWhisperer-Lite programmer, or with a standard programmer and the 6-pin ISP header at JP6.
Also program default fuses for the Arduino to select the external crystal.</li>
<li>Mount a 16 MHz crystal at Q1, and appropriate capacitors at C8 and C9 (typically in range of 18-22pF depending on the crystal). Remove jumpers JP8 and JP9.</li>
<li>Connect a USB-Serial adapter to JP4. You can connect the VCC line of a serial port to the "+3v3" line, as the board can be powered from 5V '''when not connected to the ChipWhisperer-Lite'''. Never connect the board to a 5V line with the ChipWhisperer-Lite attached, as it will ''destroy the ChipWhisperer-Lite''.</li></ol>

== Kit Assembly ==

The Notduino kit includes all the parts to assemble the Notduino kit. The following shows the kit parts:

[[File:Kit_packaged.jpg|image]]

=== Kit Parts ===

Which you can break out into the following parts:

[[File:Kit_parts.jpg|image]]

The following lists all the parts in the kit:

{|
! Qty
! Description
|-
| 1
| NPCB-CWTARG-NOTDUINO-02
|-
| 5
| 100nF Ceramic Capacitor (Marked with '104')
|-
| 2
| 220uF Electrolytic Capacitor
|-
| 5
| 51-ohm 1/4W Resistor (Green Brown Black Gold Brown), 1 spare
|-
| 3
| 330-ohm 1/4W Resistor (Orange Orange Black Black Brown), 1 spare
|-
| 2
| 10k-ohm 1/4W Resistor (Brown Black Black Red Brown), 1 spare
|-
| 1
| Red 5MM LED
|-
| 1
| Green 5MM LED
|-
| 1
| ATMega328P-PU
|-
| 1
| 28-pin IC Socket
|-
| 2
| Tactile Pushbuttons
|-
| 2
| Jumpers
|-
| 1
| 1x5 Pin Header
|-
| 1
| 1x7 Pin Header
|-
| 1
| 2x3 Pin Header
|-
| 1
| 2x4 Pin Header
|-
| 1
| 20-Pin Shrouded Header
|-
| 2
| SMA Edge-Mount Connector
|}

Note the resistors use a 5-band colour code, which is different from the "regular" colour code you might be used to. The following shows the resistors, note the colour code listed in the parts list above. Each of the resistors have an extra provided, so when you assemble the board you should have three left-over resistors.

[[File:Resistors.jpg|image]]

=== Assembly Process ===

There is no specific assembly procedure for the board. The values of components have been marked on the blank PCB, here are some general instructions for the assembly process:

# You can use lead or lead-free solder due to the immersion gold finish of the PCB.
# Mount parts starting with the lowest height (such as resistors and ceramic capacitors) first.
# Note there is an extra of each of the resistors - i.e. you only need one 10k resistor (R4) but are provided two.
# Watch the polarity of LED1 and LED2. The flat edge of the LED should match the flat marking on the silkscreen.
# The electrolytic capacitors (C7 and C6) have the negative marked on them. Be sure to match up the negative with the "-" marking on the PCB. The two capacitors have the negative terminal facing each other.
# The shrouded header has an orientation - match up the notch in the 20-pin header with the mark on the PCB silkscreen.
# See the picture at the beginning of this section for details of the assembly.
# The test-points (including the "GND") can be made using a cut-off resistor lead. This gives you something to clip a test point onto.

=== Assembly Video ===

You can see a [http://www.youtube.com/watch?v=zCmWzpyEYe8&hd=1 Video] of the assembly process of YouTube:

[[File:Cw304asm.png|link=http://www.youtube.com/watch?v=zCmWzpyEYe8&hd=1]]

== Troubleshooting ==

=== Programming a New Notduino AVR ===

Some users have had trouble programming fresh Notduinos from the ChipWhisperer-Lite: attempting to read the AVR's signature or program it causes the program to time out (with the message <code>USBError: [Errno 110] Operation timed out</code>). This is generally because the ChipWhisperer-Lite can't generate a clock speed slow enough to program a fresh AVR. See [https://www.newae.com/forum/viewtopic.php?f=6&t=174 this forum thread] for the problem symptoms, and [https://www.newae.com/forum/viewtopic.php?f=6&t=67 this thread] for the solution.

== Schematic ==

[[File:Cw304_schematic.png|image]]

== Hardware ==

{{Template:Hardware}}

[[Category:Targets]]

CW308T-STM32F

2020-03-11T18:16:29Z

Adewar: /* Example Projects */

{{Infobox cw308target
|name = CW308T-STM32F
|image = STM32F3-Top_Rev03.jpg
|caption =
|Target Device = ST STM32F
|Target Architecture = Cortex M0,M3,M4
|Hardware Crypto = Possible
|Purchase Hardware = [http://store.newae.com/stm32f0-target-for-cw308-arm-cortex-m0-128kb-flash-8kb-sram/ Webstore, F0]

[http://store.newae.com/stm32f1-target-for-cw308-arm-cortex-m3-128kb-flash-8kb-sram/ Webstore, F1]

[http://store.newae.com/stm32f3-target-for-cw308-arm-cortex-m4-256kb-flash-40kb-sram/ Webstore, F3]

[http://store.newae.com/stm32f4-target-for-cw308-arm-cortex-m4-1mb-flash-192kb-sram/ Webstore, F4]

[http://store.newae.com/blank-pcb-stm32fx-cw308-target/ Webstore PCB]
|Design Files = [https://github.com/newaetech/chipwhisperer/tree/master/hardware/victims/cw308_ufo_target/stm32f GITHub Link]

[https://wiki.newae.com/CW308T-STM32F OSH Park PCBs]

|Supported Applications = [[SimpleSerial | Simple Serial Enc/Auth]]
|Programmer = ST-LINK/V2
|Status = Released
}}

{{Warningbox|ChipWisperer v5.1.3 before commit 3557 and arm-none-eabi-gcc before q2-2018 can produce non-working binaries for the STM32F3. The only fix is to update either ChipWhisperer or gcc}}

== Supported Devices ==

The STM32F board supports several STM32F devices in the TQFP-64 package. Various solder jumpers need to bet set to either the "A" or "B" position to select appropriate VCC supply for the different series. The following table summarizes examples of suitable devices:
{| class="wikitable"
!STM32F Series
!Package
!Device
!Hardware AES
!Tested
!Jumper
!Flash
!SRAM
!NAE P/N
|-
|F0
|TQFP-64
|STM32F071RBT6
|No
|Yes
|B
|128KB
|16KB
|NAE-CW308T-STM32F0
|-
|F1
|TQFP-64
|STM32F100RBT6B
|No
|Yes
|B
|128KB
|8KB
|NAE-CW308T-STM32F1
|-
|F2
|TQFP-64
|STM32F215RET6
|Yes
|Yes
|A
|512KB
|132KB
|NAE-CW308T-STM32F2HWC
|-
|F3
|TQFP-64
|STM32F303RCT7
|No
|Yes
|B
|256KB
|40KB
|NAE-CW308T-STM32F3
|-
|F4
|TQFP-64
|STM32F415RGT6
|Yes
|Yes
|A
|1MB
|192KB
|NAE-CW308T-STM32F4HWC
|-
|F4
|TQFP-64
|STM32F405RGT6
|No
|Yes
|A
|1MB
|192KB
|NAE-CW308T-STM32F4
|}

=== VCC-Int Supply ===
Several devices (F2, F4) have internal core voltage regulators. By default the CW308 board attempts to provide power for these pins, but the voltage may not be high enough to cause the internal regulator to disable itself. In this case you can use the VADJ regulator to ensure the internal regulator is disabled. See [[Targets with Internal Regulators]] for details.

=== Pin-outs across TQFP Devices ===

The following shows differences in pinouts between three groups of devices. The left-most is the STM32F051RB, which uses the same 3.3V VCORE as the STM32F1/F3. It has fewer VCC pins, so the I/O occupying that are VCC/GND pins on the STM32F1 (such as PF6/PF7) are tied to GND/VCC. The right-most part is the pinout of the STM32F2/F4. It has an internal regulator, where the VCAP pins are the output of this regulator (and input to the internal core logic).

[[File:power_diffstm32.png|800px]]

Note for the devices with a 3.3V VCORE, you should not mount decoupling capacitors C5/C6/C7/C8. You will still get some leakage with those capacitors mounted, but a stronger signal is present without them.

== Hardware AES ==

The STM32F21x, and STM32F41x/43x have hardware crypto modules (AES, DES, TDES) along with hardware hash (SHA1, MD5). Hardware crypto for the STM32F4 has been integrated into the Hal build system on the develop branch. To use the hardware crypto, call HW_AES128_Init() at the beginning of your program. You can update the key with HW_AES128_LoadKey(), encrypt plaintext with HW_AES128_Enc(), and decrypt data with HW_AES128_Dec().

== CAN Connection ==

A 6-pin header is present for devices which have CAN hardware support (not all devices have this). A CANoodler can be plugged in to provide the physical transceiver. This header is not normally mounted, unless the board is part of an 'automotive bundle'. The header is left unmounted as it can impede sweeping a probe over the surface of the chip.

== Programming Connection ==

=== ChipWhisperer Programmer via Bootloader ===

See further down this wiki page for details.

=== JTAG Programmer ===

The 20-pin JTAG port (J6 on CW308 Board) can be used with the [https://www.digikey.com/product-detail/en/stmicroelectronics/ST-LINK-V2/497-10484-ND/2214535 ST-LINK/V2] which is a low-cost JTAG programmer.

It is also possible to use other JTAG programmers such as OpenOCD. The following command worked with an Olimex OpenOCD programmer and their [https://www.olimex.com/Products/ARM/JTAG/ARM-USB-OCD-H/ OpenOCD for Windows] software:
<pre>
openocd
-f path/to/board/files/cw308.cfg
-c init
-c targets
-c "halt"
-c "flash write_image erase path/to/firmware.hex"
-c "verify_image path/to/firmware.hex"
-c "reset run"
-c shutdown
</pre>
where the contents of <code>cw308.cfg</code> are
<pre>
source [find interface/olimex-arm-usb-ocd-h.cfg]
source [find target/stm32f4x.cfg]
reset_config srst_only
</pre>

== Example Projects ==

SimpleSerial builds for each of the STM32Fx Devices. Each device is a separate HAL. These HAL modules have been copied from ST's HAL (not the CUBE) and greatly reduced in size by deleting unused files (such as headers for unused devices), and combining several C-source files into a single low-level C-file.

Many example projects are available via Jupyter Notebooks: https://chipwhisperer.readthedocs.io/en/latest/tutorials.html. Note that all of these examples were created for the CWLITEARM (equivalent STM32F3) target. You will need to make changes based on which target you have to run the tutorials. For some tutorials, changing the PLATFORM variable in the first block to the one you're using is enough to get the tutorial working:
<syntaxhighlight lang=python>
SCOPETYPE = "OPENADC"
PLATFORM = "CW308_STM32F4" #For STM32F4 target, was originally "CWLITEARM"
</syntaxhighlight>

=== Building ST Example on Command Line ===
The regular firmware build process works with the STM32 devices. For example, to build `simpleserial-aes`, navigate to the folder `chipwhisperer\hardware\victims\firmware\simpleserial-aes` and run the following command on the command line:

<code>
make PLATFORM=CW308_STM32F0 CRYPTO_TARGET=TINYAES128C
</code>

If all goes well, this command will finish by printing the output file size and the platform:

[[File:Stm32-make.png]]

{{CollapsibleSection
|intro = === Programming via ChipWhisperer Bootloader ===
|content= CW308T-STM32F/ChipWhisperer_Bootloader}}

{{CollapsibleSection
|intro = === Running ST Example with ST-Link ===
|content= CW308T-STM32F/ST_Link}}

{{CollapsibleSection
|intro = === Building and Debugging via ST's System Workbench ===
|content= CW308T-STM32F/Debugging_with_ST_Link}}

== Schematic ==
The following variants are possible, see the table above for SRAM/FLASH/HW-Crypto status:
{| class="wikitable"
!Variant
!U1
!R3 (VCC-Shunt)
!R4 (Clock)
|-
|F0
|STM32F071RBT6
|33-ohm
|120-ohm
|-
|F1
|STM32F100RBT6
|22-ohm
|51-ohm
|-
|F2HWC
|STM32F215RET6
|10-ohm
|51-ohm
|-
|F3
|STM32F303RCT7
|12-ohm
|51-ohm
|-
|F4
|STM32F405RGT6
|10-ohm
|51-ohm
|-
|F4HWC
|STM32F415RGT6
|10-ohm
|51-ohm
|}

=== Rev -03 Schematic ===

The current revision of the target is -03. The following shows this schematic:

[[File:CW308T_STM32F_03.png|1100px]]

=== Rev -02 Schematic ===

The original board sold was the -02 revision. The revision is part of the part number, for example these boards will be marked STM32F-02. The -02 revision also does not have the CAN connector:
[[File:cw308_stm32f.jpg|400px]]

[[File:CW308T_STM32F_02.png|1100px]]

== Hardware ==
{{Template:Hardware}}

[[Category: CW308 Targets]]

CW308T-STM32F

2020-03-11T18:15:41Z

Adewar: /* Example Projects */

{{Infobox cw308target
|name = CW308T-STM32F
|image = STM32F3-Top_Rev03.jpg
|caption =
|Target Device = ST STM32F
|Target Architecture = Cortex M0,M3,M4
|Hardware Crypto = Possible
|Purchase Hardware = [http://store.newae.com/stm32f0-target-for-cw308-arm-cortex-m0-128kb-flash-8kb-sram/ Webstore, F0]

[http://store.newae.com/stm32f1-target-for-cw308-arm-cortex-m3-128kb-flash-8kb-sram/ Webstore, F1]

[http://store.newae.com/stm32f3-target-for-cw308-arm-cortex-m4-256kb-flash-40kb-sram/ Webstore, F3]

[http://store.newae.com/stm32f4-target-for-cw308-arm-cortex-m4-1mb-flash-192kb-sram/ Webstore, F4]

[http://store.newae.com/blank-pcb-stm32fx-cw308-target/ Webstore PCB]
|Design Files = [https://github.com/newaetech/chipwhisperer/tree/master/hardware/victims/cw308_ufo_target/stm32f GITHub Link]

[https://wiki.newae.com/CW308T-STM32F OSH Park PCBs]

|Supported Applications = [[SimpleSerial | Simple Serial Enc/Auth]]
|Programmer = ST-LINK/V2
|Status = Released
}}

{{Warningbox|ChipWisperer v5.1.3 before commit 3557 and arm-none-eabi-gcc before q2-2018 can produce non-working binaries for the STM32F3. The only fix is to update either ChipWhisperer or gcc}}

== Supported Devices ==

The STM32F board supports several STM32F devices in the TQFP-64 package. Various solder jumpers need to bet set to either the "A" or "B" position to select appropriate VCC supply for the different series. The following table summarizes examples of suitable devices:
{| class="wikitable"
!STM32F Series
!Package
!Device
!Hardware AES
!Tested
!Jumper
!Flash
!SRAM
!NAE P/N
|-
|F0
|TQFP-64
|STM32F071RBT6
|No
|Yes
|B
|128KB
|16KB
|NAE-CW308T-STM32F0
|-
|F1
|TQFP-64
|STM32F100RBT6B
|No
|Yes
|B
|128KB
|8KB
|NAE-CW308T-STM32F1
|-
|F2
|TQFP-64
|STM32F215RET6
|Yes
|Yes
|A
|512KB
|132KB
|NAE-CW308T-STM32F2HWC
|-
|F3
|TQFP-64
|STM32F303RCT7
|No
|Yes
|B
|256KB
|40KB
|NAE-CW308T-STM32F3
|-
|F4
|TQFP-64
|STM32F415RGT6
|Yes
|Yes
|A
|1MB
|192KB
|NAE-CW308T-STM32F4HWC
|-
|F4
|TQFP-64
|STM32F405RGT6
|No
|Yes
|A
|1MB
|192KB
|NAE-CW308T-STM32F4
|}

=== VCC-Int Supply ===
Several devices (F2, F4) have internal core voltage regulators. By default the CW308 board attempts to provide power for these pins, but the voltage may not be high enough to cause the internal regulator to disable itself. In this case you can use the VADJ regulator to ensure the internal regulator is disabled. See [[Targets with Internal Regulators]] for details.

=== Pin-outs across TQFP Devices ===

The following shows differences in pinouts between three groups of devices. The left-most is the STM32F051RB, which uses the same 3.3V VCORE as the STM32F1/F3. It has fewer VCC pins, so the I/O occupying that are VCC/GND pins on the STM32F1 (such as PF6/PF7) are tied to GND/VCC. The right-most part is the pinout of the STM32F2/F4. It has an internal regulator, where the VCAP pins are the output of this regulator (and input to the internal core logic).

[[File:power_diffstm32.png|800px]]

Note for the devices with a 3.3V VCORE, you should not mount decoupling capacitors C5/C6/C7/C8. You will still get some leakage with those capacitors mounted, but a stronger signal is present without them.

== Hardware AES ==

The STM32F21x, and STM32F41x/43x have hardware crypto modules (AES, DES, TDES) along with hardware hash (SHA1, MD5). Hardware crypto for the STM32F4 has been integrated into the Hal build system on the develop branch. To use the hardware crypto, call HW_AES128_Init() at the beginning of your program. You can update the key with HW_AES128_LoadKey(), encrypt plaintext with HW_AES128_Enc(), and decrypt data with HW_AES128_Dec().

== CAN Connection ==

A 6-pin header is present for devices which have CAN hardware support (not all devices have this). A CANoodler can be plugged in to provide the physical transceiver. This header is not normally mounted, unless the board is part of an 'automotive bundle'. The header is left unmounted as it can impede sweeping a probe over the surface of the chip.

== Programming Connection ==

=== ChipWhisperer Programmer via Bootloader ===

See further down this wiki page for details.

=== JTAG Programmer ===

The 20-pin JTAG port (J6 on CW308 Board) can be used with the [https://www.digikey.com/product-detail/en/stmicroelectronics/ST-LINK-V2/497-10484-ND/2214535 ST-LINK/V2] which is a low-cost JTAG programmer.

It is also possible to use other JTAG programmers such as OpenOCD. The following command worked with an Olimex OpenOCD programmer and their [https://www.olimex.com/Products/ARM/JTAG/ARM-USB-OCD-H/ OpenOCD for Windows] software:
<pre>
openocd
-f path/to/board/files/cw308.cfg
-c init
-c targets
-c "halt"
-c "flash write_image erase path/to/firmware.hex"
-c "verify_image path/to/firmware.hex"
-c "reset run"
-c shutdown
</pre>
where the contents of <code>cw308.cfg</code> are
<pre>
source [find interface/olimex-arm-usb-ocd-h.cfg]
source [find target/stm32f4x.cfg]
reset_config srst_only
</pre>

== Example Projects ==

SimpleSerial builds for each of the STM32Fx Devices. Each device is a separate HAL. These HAL modules have been copied from ST's HAL (not the CUBE) and greatly reduced in size by deleting unused files (such as headers for unused devices), and combining several C-source files into a single low-level C-file.

Many example projects are available via Jupyter Notebooks: https://chipwhisperer.readthedocs.io/en/latest/tutorials.html. Note that all of these examples were created for the CWLITEARM (equivalent STM32F3) target. You will need to make changes based on which target you have to run the tutorials. For some tutorials, changing the PLATFORM variable in the first block to the one you're using is enough to get the tutorial working:
<syntaxhighlight lang=python>
SCOPETYPE = "OPENADC"
PLATFORM = "CW308_STM32F4" #previously "CWLITEARM"
</syntaxhighlight>

=== Building ST Example on Command Line ===
The regular firmware build process works with the STM32 devices. For example, to build `simpleserial-aes`, navigate to the folder `chipwhisperer\hardware\victims\firmware\simpleserial-aes` and run the following command on the command line:

<code>
make PLATFORM=CW308_STM32F0 CRYPTO_TARGET=TINYAES128C
</code>

If all goes well, this command will finish by printing the output file size and the platform:

[[File:Stm32-make.png]]

{{CollapsibleSection
|intro = === Programming via ChipWhisperer Bootloader ===
|content= CW308T-STM32F/ChipWhisperer_Bootloader}}

{{CollapsibleSection
|intro = === Running ST Example with ST-Link ===
|content= CW308T-STM32F/ST_Link}}

{{CollapsibleSection
|intro = === Building and Debugging via ST's System Workbench ===
|content= CW308T-STM32F/Debugging_with_ST_Link}}

== Schematic ==
The following variants are possible, see the table above for SRAM/FLASH/HW-Crypto status:
{| class="wikitable"
!Variant
!U1
!R3 (VCC-Shunt)
!R4 (Clock)
|-
|F0
|STM32F071RBT6
|33-ohm
|120-ohm
|-
|F1
|STM32F100RBT6
|22-ohm
|51-ohm
|-
|F2HWC
|STM32F215RET6
|10-ohm
|51-ohm
|-
|F3
|STM32F303RCT7
|12-ohm
|51-ohm
|-
|F4
|STM32F405RGT6
|10-ohm
|51-ohm
|-
|F4HWC
|STM32F415RGT6
|10-ohm
|51-ohm
|}

=== Rev -03 Schematic ===

The current revision of the target is -03. The following shows this schematic:

[[File:CW308T_STM32F_03.png|1100px]]

=== Rev -02 Schematic ===

The original board sold was the -02 revision. The revision is part of the part number, for example these boards will be marked STM32F-02. The -02 revision also does not have the CAN connector:
[[File:cw308_stm32f.jpg|400px]]

[[File:CW308T_STM32F_02.png|1100px]]

== Hardware ==
{{Template:Hardware}}

[[Category: CW308 Targets]]

CW308T-STM32F

2020-03-11T18:08:49Z

Adewar:

{{Infobox cw308target
|name = CW308T-STM32F
|image = STM32F3-Top_Rev03.jpg
|caption =
|Target Device = ST STM32F
|Target Architecture = Cortex M0,M3,M4
|Hardware Crypto = Possible
|Purchase Hardware = [http://store.newae.com/stm32f0-target-for-cw308-arm-cortex-m0-128kb-flash-8kb-sram/ Webstore, F0]

[http://store.newae.com/stm32f1-target-for-cw308-arm-cortex-m3-128kb-flash-8kb-sram/ Webstore, F1]

[http://store.newae.com/stm32f3-target-for-cw308-arm-cortex-m4-256kb-flash-40kb-sram/ Webstore, F3]

[http://store.newae.com/stm32f4-target-for-cw308-arm-cortex-m4-1mb-flash-192kb-sram/ Webstore, F4]

[http://store.newae.com/blank-pcb-stm32fx-cw308-target/ Webstore PCB]
|Design Files = [https://github.com/newaetech/chipwhisperer/tree/master/hardware/victims/cw308_ufo_target/stm32f GITHub Link]

[https://wiki.newae.com/CW308T-STM32F OSH Park PCBs]

|Supported Applications = [[SimpleSerial | Simple Serial Enc/Auth]]
|Programmer = ST-LINK/V2
|Status = Released
}}

{{Warningbox|ChipWisperer v5.1.3 before commit 3557 and arm-none-eabi-gcc before q2-2018 can produce non-working binaries for the STM32F3. The only fix is to update either ChipWhisperer or gcc}}

== Supported Devices ==

The STM32F board supports several STM32F devices in the TQFP-64 package. Various solder jumpers need to bet set to either the "A" or "B" position to select appropriate VCC supply for the different series. The following table summarizes examples of suitable devices:
{| class="wikitable"
!STM32F Series
!Package
!Device
!Hardware AES
!Tested
!Jumper
!Flash
!SRAM
!NAE P/N
|-
|F0
|TQFP-64
|STM32F071RBT6
|No
|Yes
|B
|128KB
|16KB
|NAE-CW308T-STM32F0
|-
|F1
|TQFP-64
|STM32F100RBT6B
|No
|Yes
|B
|128KB
|8KB
|NAE-CW308T-STM32F1
|-
|F2
|TQFP-64
|STM32F215RET6
|Yes
|Yes
|A
|512KB
|132KB
|NAE-CW308T-STM32F2HWC
|-
|F3
|TQFP-64
|STM32F303RCT7
|No
|Yes
|B
|256KB
|40KB
|NAE-CW308T-STM32F3
|-
|F4
|TQFP-64
|STM32F415RGT6
|Yes
|Yes
|A
|1MB
|192KB
|NAE-CW308T-STM32F4HWC
|-
|F4
|TQFP-64
|STM32F405RGT6
|No
|Yes
|A
|1MB
|192KB
|NAE-CW308T-STM32F4
|}

=== VCC-Int Supply ===
Several devices (F2, F4) have internal core voltage regulators. By default the CW308 board attempts to provide power for these pins, but the voltage may not be high enough to cause the internal regulator to disable itself. In this case you can use the VADJ regulator to ensure the internal regulator is disabled. See [[Targets with Internal Regulators]] for details.

=== Pin-outs across TQFP Devices ===

The following shows differences in pinouts between three groups of devices. The left-most is the STM32F051RB, which uses the same 3.3V VCORE as the STM32F1/F3. It has fewer VCC pins, so the I/O occupying that are VCC/GND pins on the STM32F1 (such as PF6/PF7) are tied to GND/VCC. The right-most part is the pinout of the STM32F2/F4. It has an internal regulator, where the VCAP pins are the output of this regulator (and input to the internal core logic).

[[File:power_diffstm32.png|800px]]

Note for the devices with a 3.3V VCORE, you should not mount decoupling capacitors C5/C6/C7/C8. You will still get some leakage with those capacitors mounted, but a stronger signal is present without them.

== Hardware AES ==

The STM32F21x, and STM32F41x/43x have hardware crypto modules (AES, DES, TDES) along with hardware hash (SHA1, MD5). Hardware crypto for the STM32F4 has been integrated into the Hal build system on the develop branch. To use the hardware crypto, call HW_AES128_Init() at the beginning of your program. You can update the key with HW_AES128_LoadKey(), encrypt plaintext with HW_AES128_Enc(), and decrypt data with HW_AES128_Dec().

== CAN Connection ==

A 6-pin header is present for devices which have CAN hardware support (not all devices have this). A CANoodler can be plugged in to provide the physical transceiver. This header is not normally mounted, unless the board is part of an 'automotive bundle'. The header is left unmounted as it can impede sweeping a probe over the surface of the chip.

== Programming Connection ==

=== ChipWhisperer Programmer via Bootloader ===

See further down this wiki page for details.

=== JTAG Programmer ===

The 20-pin JTAG port (J6 on CW308 Board) can be used with the [https://www.digikey.com/product-detail/en/stmicroelectronics/ST-LINK-V2/497-10484-ND/2214535 ST-LINK/V2] which is a low-cost JTAG programmer.

It is also possible to use other JTAG programmers such as OpenOCD. The following command worked with an Olimex OpenOCD programmer and their [https://www.olimex.com/Products/ARM/JTAG/ARM-USB-OCD-H/ OpenOCD for Windows] software:
<pre>
openocd
-f path/to/board/files/cw308.cfg
-c init
-c targets
-c "halt"
-c "flash write_image erase path/to/firmware.hex"
-c "verify_image path/to/firmware.hex"
-c "reset run"
-c shutdown
</pre>
where the contents of <code>cw308.cfg</code> are
<pre>
source [find interface/olimex-arm-usb-ocd-h.cfg]
source [find target/stm32f4x.cfg]
reset_config srst_only
</pre>

== Example Projects ==

SimpleSerial builds for each of the STM32Fx Devices. Each device is a separate HAL. These HAL modules have been copied from ST's HAL (not the CUBE) and greatly reduced in size by deleting unused files (such as headers for unused devices), and combining several C-source files into a single low-level C-file.

=== Building ST Example on Command Line ===
The regular firmware build process works with the STM32 devices. For example, to build `simpleserial-aes`, navigate to the folder `chipwhisperer\hardware\victims\firmware\simpleserial-aes` and run the following command on the command line:

<code>
make PLATFORM=CW308_STM32F0 CRYPTO_TARGET=TINYAES128C
</code>

If all goes well, this command will finish by printing the output file size and the platform:

[[File:Stm32-make.png]]

{{CollapsibleSection
|intro = === Programming via ChipWhisperer Bootloader ===
|content= CW308T-STM32F/ChipWhisperer_Bootloader}}

{{CollapsibleSection
|intro = === Running ST Example with ST-Link ===
|content= CW308T-STM32F/ST_Link}}

{{CollapsibleSection
|intro = === Building and Debugging via ST's System Workbench ===
|content= CW308T-STM32F/Debugging_with_ST_Link}}

== Schematic ==
The following variants are possible, see the table above for SRAM/FLASH/HW-Crypto status:
{| class="wikitable"
!Variant
!U1
!R3 (VCC-Shunt)
!R4 (Clock)
|-
|F0
|STM32F071RBT6
|33-ohm
|120-ohm
|-
|F1
|STM32F100RBT6
|22-ohm
|51-ohm
|-
|F2HWC
|STM32F215RET6
|10-ohm
|51-ohm
|-
|F3
|STM32F303RCT7
|12-ohm
|51-ohm
|-
|F4
|STM32F405RGT6
|10-ohm
|51-ohm
|-
|F4HWC
|STM32F415RGT6
|10-ohm
|51-ohm
|}

=== Rev -03 Schematic ===

The current revision of the target is -03. The following shows this schematic:

[[File:CW308T_STM32F_03.png|1100px]]

=== Rev -02 Schematic ===

The original board sold was the -02 revision. The revision is part of the part number, for example these boards will be marked STM32F-02. The -02 revision also does not have the CAN connector:
[[File:cw308_stm32f.jpg|400px]]

[[File:CW308T_STM32F_02.png|1100px]]

== Hardware ==
{{Template:Hardware}}

[[Category: CW308 Targets]]

CW308T-STM32F

2020-03-11T18:07:24Z

Adewar: /* Example Projects */

{{Infobox cw308target
|name = CW308T-STM32F
|image = STM32F3-Top_Rev03.jpg
|caption =
|Target Device = ST STM32F
|Target Architecture = Cortex M0,M3,M4
|Hardware Crypto = Possible
|Purchase Hardware = [http://store.newae.com/stm32f0-target-for-cw308-arm-cortex-m0-128kb-flash-8kb-sram/ Webstore, F0]

[http://store.newae.com/stm32f1-target-for-cw308-arm-cortex-m3-128kb-flash-8kb-sram/ Webstore, F1]

[http://store.newae.com/stm32f3-target-for-cw308-arm-cortex-m4-256kb-flash-40kb-sram/ Webstore, F3]

[http://store.newae.com/stm32f4-target-for-cw308-arm-cortex-m4-1mb-flash-192kb-sram/ Webstore, F4]

[http://store.newae.com/blank-pcb-stm32fx-cw308-target/ Webstore PCB]
|Design Files = [https://github.com/newaetech/chipwhisperer/tree/master/hardware/victims/cw308_ufo_target/stm32f GITHub Link]

[https://wiki.newae.com/CW308T-STM32F OSH Park PCBs]

|Supported Applications = [[SimpleSerial | Simple Serial Enc/Auth]]
|Programmer = ST-LINK/V2
|Status = Released
}}

{{Warningbox|ChipWisperer v5.1.3 before commit 3557 and arm-none-eabi-gcc before q2-2018 can produce non-working binaries for the STM32F3. The only fix is to update either ChipWhisperer or gcc}}

{{Warningbox|This page has not yet been fully updated for the v5 release. Some information may be outdated.}}

== Supported Devices ==

The STM32F board supports several STM32F devices in the TQFP-64 package. Various solder jumpers need to bet set to either the "A" or "B" position to select appropriate VCC supply for the different series. The following table summarizes examples of suitable devices:
{| class="wikitable"
!STM32F Series
!Package
!Device
!Hardware AES
!Tested
!Jumper
!Flash
!SRAM
!NAE P/N
|-
|F0
|TQFP-64
|STM32F071RBT6
|No
|Yes
|B
|128KB
|16KB
|NAE-CW308T-STM32F0
|-
|F1
|TQFP-64
|STM32F100RBT6B
|No
|Yes
|B
|128KB
|8KB
|NAE-CW308T-STM32F1
|-
|F2
|TQFP-64
|STM32F215RET6
|Yes
|Yes
|A
|512KB
|132KB
|NAE-CW308T-STM32F2HWC
|-
|F3
|TQFP-64
|STM32F303RCT7
|No
|Yes
|B
|256KB
|40KB
|NAE-CW308T-STM32F3
|-
|F4
|TQFP-64
|STM32F415RGT6
|Yes
|Yes
|A
|1MB
|192KB
|NAE-CW308T-STM32F4HWC
|-
|F4
|TQFP-64
|STM32F405RGT6
|No
|Yes
|A
|1MB
|192KB
|NAE-CW308T-STM32F4
|}

=== VCC-Int Supply ===
Several devices (F2, F4) have internal core voltage regulators. By default the CW308 board attempts to provide power for these pins, but the voltage may not be high enough to cause the internal regulator to disable itself. In this case you can use the VADJ regulator to ensure the internal regulator is disabled. See [[Targets with Internal Regulators]] for details.

=== Pin-outs across TQFP Devices ===

The following shows differences in pinouts between three groups of devices. The left-most is the STM32F051RB, which uses the same 3.3V VCORE as the STM32F1/F3. It has fewer VCC pins, so the I/O occupying that are VCC/GND pins on the STM32F1 (such as PF6/PF7) are tied to GND/VCC. The right-most part is the pinout of the STM32F2/F4. It has an internal regulator, where the VCAP pins are the output of this regulator (and input to the internal core logic).

[[File:power_diffstm32.png|800px]]

Note for the devices with a 3.3V VCORE, you should not mount decoupling capacitors C5/C6/C7/C8. You will still get some leakage with those capacitors mounted, but a stronger signal is present without them.

== Hardware AES ==

The STM32F21x, and STM32F41x/43x have hardware crypto modules (AES, DES, TDES) along with hardware hash (SHA1, MD5). Hardware crypto for the STM32F4 has been integrated into the Hal build system on the develop branch. To use the hardware crypto, call HW_AES128_Init() at the beginning of your program. You can update the key with HW_AES128_LoadKey(), encrypt plaintext with HW_AES128_Enc(), and decrypt data with HW_AES128_Dec().

== CAN Connection ==

A 6-pin header is present for devices which have CAN hardware support (not all devices have this). A CANoodler can be plugged in to provide the physical transceiver. This header is not normally mounted, unless the board is part of an 'automotive bundle'. The header is left unmounted as it can impede sweeping a probe over the surface of the chip.

== Programming Connection ==

=== ChipWhisperer Programmer via Bootloader ===

See further down this wiki page for details.

=== JTAG Programmer ===

The 20-pin JTAG port (J6 on CW308 Board) can be used with the [https://www.digikey.com/product-detail/en/stmicroelectronics/ST-LINK-V2/497-10484-ND/2214535 ST-LINK/V2] which is a low-cost JTAG programmer.

It is also possible to use other JTAG programmers such as OpenOCD. The following command worked with an Olimex OpenOCD programmer and their [https://www.olimex.com/Products/ARM/JTAG/ARM-USB-OCD-H/ OpenOCD for Windows] software:
<pre>
openocd
-f path/to/board/files/cw308.cfg
-c init
-c targets
-c "halt"
-c "flash write_image erase path/to/firmware.hex"
-c "verify_image path/to/firmware.hex"
-c "reset run"
-c shutdown
</pre>
where the contents of <code>cw308.cfg</code> are
<pre>
source [find interface/olimex-arm-usb-ocd-h.cfg]
source [find target/stm32f4x.cfg]
reset_config srst_only
</pre>

== Example Projects ==

SimpleSerial builds for each of the STM32Fx Devices. Each device is a separate HAL. These HAL modules have been copied from ST's HAL (not the CUBE) and greatly reduced in size by deleting unused files (such as headers for unused devices), and combining several C-source files into a single low-level C-file.

=== Building ST Example on Command Line ===
The regular firmware build process works with the STM32 devices. For example, to build `simpleserial-aes`, navigate to the folder `chipwhisperer\hardware\victims\firmware\simpleserial-aes` and run the following command on the command line:

<code>
make PLATFORM=CW308_STM32F0 CRYPTO_TARGET=TINYAES128C
</code>

If all goes well, this command will finish by printing the output file size and the platform:

[[File:Stm32-make.png]]

{{CollapsibleSection
|intro = === Programming via ChipWhisperer Bootloader ===
|content= CW308T-STM32F/ChipWhisperer_Bootloader}}

{{CollapsibleSection
|intro = === Running ST Example with ST-Link ===
|content= CW308T-STM32F/ST_Link}}

{{CollapsibleSection
|intro = === Building and Debugging via ST's System Workbench ===
|content= CW308T-STM32F/Debugging_with_ST_Link}}

== Schematic ==
The following variants are possible, see the table above for SRAM/FLASH/HW-Crypto status:
{| class="wikitable"
!Variant
!U1
!R3 (VCC-Shunt)
!R4 (Clock)
|-
|F0
|STM32F071RBT6
|33-ohm
|120-ohm
|-
|F1
|STM32F100RBT6
|22-ohm
|51-ohm
|-
|F2HWC
|STM32F215RET6
|10-ohm
|51-ohm
|-
|F3
|STM32F303RCT7
|12-ohm
|51-ohm
|-
|F4
|STM32F405RGT6
|10-ohm
|51-ohm
|-
|F4HWC
|STM32F415RGT6
|10-ohm
|51-ohm
|}

=== Rev -03 Schematic ===

The current revision of the target is -03. The following shows this schematic:

[[File:CW308T_STM32F_03.png|1100px]]

=== Rev -02 Schematic ===

The original board sold was the -02 revision. The revision is part of the part number, for example these boards will be marked STM32F-02. The -02 revision also does not have the CAN connector:
[[File:cw308_stm32f.jpg|400px]]

[[File:CW308T_STM32F_02.png|1100px]]

== Hardware ==
{{Template:Hardware}}

[[Category: CW308 Targets]]

CW308T-STM32F/Debugging with ST Link

2020-03-11T18:06:50Z

Adewar: Created page with "It's also possible to work on the example projects using [http://www.st.com/en/development-tools/sw4stm32.html ST's System Workbench IDE]. This IDE also supports debugging, wh..."

It's also possible to work on the example projects using [http://www.st.com/en/development-tools/sw4stm32.html ST's System Workbench IDE]. This IDE also supports debugging, which is helpful for working out all the kinks in your firmware.

To build the ChipWhisperer examples in System Workbench:

1. Create a new Mcu project by going to ''File > New > C Project'' and selecting ''<nowiki/>'<nowiki/>''Ac6 STM32 MCU Project'''.'' When you get to Target Configuration, click the Mcu tab and select the microcontroller that you want to target:

[[File:STM32 New Project.PNG|400px]]

[[File:STM32 MCU-Selection.PNG|400px]]

2. Link the external files into the project. To do this, under ''File > Import'', select ''File System''. In the `chipwhisperer\hardware\victims\firmware` directory, select all of the relevant files and folders (Makefile in base folder, Makefile in HAL folder, STM32Fx HAL folder).:

[[File:STM32 Import.PNG|400px]]

3. Set up the build command. In ''File > Properties'', go to ''C/C++ Build > Behavior'' and remove 'all''<nowiki/>''' from 'Build' and deselect 'Enable parallel build'. Next, click the ''Builder Settings'' tab and deselect 'Use default build command' and 'Generate Makefiles Automatically'. Enter the command you would normally enter on the command line and change 'Build directory' to the folder you want to build in:

[[File:STM32 Behaviour.PNG|400px]]

[[File:STM32 Build-Settings.PNG|400px]]

4. Build the project and confirm that the build works from the output in the IDE console.

Then, if you want to set up debugging:

1. Go to ''in File > Properties'' select Run/Debug Settings and create a new debug configuration. Under Debugger, click 'Show generator options...' and setup your Connection Setup based on your debugger. Change 'Reset Mode' to 'Software System reset':

[[File:STM32 Debugging.PNG|400px]]

2. Click Apply and enter debugging mode.

'''Caveat''': the I/O register map in the debugger appears to use the last known device (ie: if you debugged an STM32F4 project before your Makefile project, it sticks with F4's registers). Check that the registers' addresses are correct before you trust them!

CW308T-STM32F/ST Link

2020-03-11T18:05:33Z

Adewar: Created page with "If instead of using the bootloader, you want to use a ST-Link you can instead plug your programmer into the 20 pin JTAG connector (J6 on the UFO board): File:Stm32-jtag.jpg..."

If instead of using the bootloader, you want to use a ST-Link you can instead plug your programmer into the 20 pin JTAG connector (J6 on the UFO board):

[[File:Stm32-jtag.jpg|600px]]

Then, the details of this step will depend on your programmer. If you're using an ST-Link programmer, open the ST-Link utility and connect to the device:

[[File:Stm32-connect.png]]

Load your `.hex` file and program the device with the Program and Verify button:

[[File:Stm32-program.png]]

After this, you're ready to go - you can use the ChipWhisperer terminal to talk to your target. You might need to reset the target before you do anything else.

CW308T-STM32F

2020-03-11T18:03:21Z

Adewar:

{{Infobox cw308target
|name = CW308T-STM32F
|image = STM32F3-Top_Rev03.jpg
|caption =
|Target Device = ST STM32F
|Target Architecture = Cortex M0,M3,M4
|Hardware Crypto = Possible
|Purchase Hardware = [http://store.newae.com/stm32f0-target-for-cw308-arm-cortex-m0-128kb-flash-8kb-sram/ Webstore, F0]

[http://store.newae.com/stm32f1-target-for-cw308-arm-cortex-m3-128kb-flash-8kb-sram/ Webstore, F1]

[http://store.newae.com/stm32f3-target-for-cw308-arm-cortex-m4-256kb-flash-40kb-sram/ Webstore, F3]

[http://store.newae.com/stm32f4-target-for-cw308-arm-cortex-m4-1mb-flash-192kb-sram/ Webstore, F4]

[http://store.newae.com/blank-pcb-stm32fx-cw308-target/ Webstore PCB]
|Design Files = [https://github.com/newaetech/chipwhisperer/tree/master/hardware/victims/cw308_ufo_target/stm32f GITHub Link]

[https://wiki.newae.com/CW308T-STM32F OSH Park PCBs]

|Supported Applications = [[SimpleSerial | Simple Serial Enc/Auth]]
|Programmer = ST-LINK/V2
|Status = Released
}}

{{Warningbox|ChipWisperer v5.1.3 before commit 3557 and arm-none-eabi-gcc before q2-2018 can produce non-working binaries for the STM32F3. The only fix is to update either ChipWhisperer or gcc}}

{{Warningbox|This page has not yet been fully updated for the v5 release. Some information may be outdated.}}

== Supported Devices ==

The STM32F board supports several STM32F devices in the TQFP-64 package. Various solder jumpers need to bet set to either the "A" or "B" position to select appropriate VCC supply for the different series. The following table summarizes examples of suitable devices:
{| class="wikitable"
!STM32F Series
!Package
!Device
!Hardware AES
!Tested
!Jumper
!Flash
!SRAM
!NAE P/N
|-
|F0
|TQFP-64
|STM32F071RBT6
|No
|Yes
|B
|128KB
|16KB
|NAE-CW308T-STM32F0
|-
|F1
|TQFP-64
|STM32F100RBT6B
|No
|Yes
|B
|128KB
|8KB
|NAE-CW308T-STM32F1
|-
|F2
|TQFP-64
|STM32F215RET6
|Yes
|Yes
|A
|512KB
|132KB
|NAE-CW308T-STM32F2HWC
|-
|F3
|TQFP-64
|STM32F303RCT7
|No
|Yes
|B
|256KB
|40KB
|NAE-CW308T-STM32F3
|-
|F4
|TQFP-64
|STM32F415RGT6
|Yes
|Yes
|A
|1MB
|192KB
|NAE-CW308T-STM32F4HWC
|-
|F4
|TQFP-64
|STM32F405RGT6
|No
|Yes
|A
|1MB
|192KB
|NAE-CW308T-STM32F4
|}

=== VCC-Int Supply ===
Several devices (F2, F4) have internal core voltage regulators. By default the CW308 board attempts to provide power for these pins, but the voltage may not be high enough to cause the internal regulator to disable itself. In this case you can use the VADJ regulator to ensure the internal regulator is disabled. See [[Targets with Internal Regulators]] for details.

=== Pin-outs across TQFP Devices ===

The following shows differences in pinouts between three groups of devices. The left-most is the STM32F051RB, which uses the same 3.3V VCORE as the STM32F1/F3. It has fewer VCC pins, so the I/O occupying that are VCC/GND pins on the STM32F1 (such as PF6/PF7) are tied to GND/VCC. The right-most part is the pinout of the STM32F2/F4. It has an internal regulator, where the VCAP pins are the output of this regulator (and input to the internal core logic).

[[File:power_diffstm32.png|800px]]

Note for the devices with a 3.3V VCORE, you should not mount decoupling capacitors C5/C6/C7/C8. You will still get some leakage with those capacitors mounted, but a stronger signal is present without them.

== Hardware AES ==

The STM32F21x, and STM32F41x/43x have hardware crypto modules (AES, DES, TDES) along with hardware hash (SHA1, MD5). Hardware crypto for the STM32F4 has been integrated into the Hal build system on the develop branch. To use the hardware crypto, call HW_AES128_Init() at the beginning of your program. You can update the key with HW_AES128_LoadKey(), encrypt plaintext with HW_AES128_Enc(), and decrypt data with HW_AES128_Dec().

== CAN Connection ==

A 6-pin header is present for devices which have CAN hardware support (not all devices have this). A CANoodler can be plugged in to provide the physical transceiver. This header is not normally mounted, unless the board is part of an 'automotive bundle'. The header is left unmounted as it can impede sweeping a probe over the surface of the chip.

== Programming Connection ==

=== ChipWhisperer Programmer via Bootloader ===

See further down this wiki page for details.

=== JTAG Programmer ===

The 20-pin JTAG port (J6 on CW308 Board) can be used with the [https://www.digikey.com/product-detail/en/stmicroelectronics/ST-LINK-V2/497-10484-ND/2214535 ST-LINK/V2] which is a low-cost JTAG programmer.

It is also possible to use other JTAG programmers such as OpenOCD. The following command worked with an Olimex OpenOCD programmer and their [https://www.olimex.com/Products/ARM/JTAG/ARM-USB-OCD-H/ OpenOCD for Windows] software:
<pre>
openocd
-f path/to/board/files/cw308.cfg
-c init
-c targets
-c "halt"
-c "flash write_image erase path/to/firmware.hex"
-c "verify_image path/to/firmware.hex"
-c "reset run"
-c shutdown
</pre>
where the contents of <code>cw308.cfg</code> are
<pre>
source [find interface/olimex-arm-usb-ocd-h.cfg]
source [find target/stm32f4x.cfg]
reset_config srst_only
</pre>

== Example Projects ==

SimpleSerial builds for each of the STM32Fx Devices. Each device is a separate HAL. These HAL modules have been copied from ST's HAL (not the CUBE) and greatly reduced in size by deleting unused files (such as headers for unused devices), and combining several C-source files into a single low-level C-file.

=== Building ST Example on Command Line ===
The regular firmware build process works with the STM32 devices. For example, to build `simpleserial-aes`, navigate to the folder `chipwhisperer\hardware\victims\firmware\simpleserial-aes` and run the following command on the command line:

<code>
make PLATFORM=CW308_STM32F0 CRYPTO_TARGET=TINYAES128C
</code>

If all goes well, this command will finish by printing the output file size and the platform:

[[File:Stm32-make.png]]

{{CollapsibleSection
|intro = === Programming via ChipWhisperer Bootloader ===
|content= CW308T-STM32F/ChipWhisperer_Bootloader}}

=== Running ST Example with ST-Link ===
If instead of using the bootloader, you want to use a ST-Link you can instead plug your programmer into the 20 pin JTAG connector (J6 on the UFO board):

[[File:Stm32-jtag.jpg|600px]]

Then, the details of this step will depend on your programmer. If you're using an ST-Link programmer, open the ST-Link utility and connect to the device:

[[File:Stm32-connect.png]]

Load your `.hex` file and program the device with the Program and Verify button:

[[File:Stm32-program.png]]

After this, you're ready to go - you can use the ChipWhisperer terminal to talk to your target. You might need to reset the target before you do anything else.

=== Building and Debugging via ST's System Workbench ===
It's also possible to work on the example projects using [http://www.st.com/en/development-tools/sw4stm32.html ST's System Workbench IDE]. This IDE also supports debugging, which is helpful for working out all the kinks in your firmware.

To build the ChipWhisperer examples in System Workbench:

1. Create a new Mcu project by going to ''File > New > C Project'' and selecting ''<nowiki/>'<nowiki/>''Ac6 STM32 MCU Project'''.'' When you get to Target Configuration, click the Mcu tab and select the microcontroller that you want to target:

[[File:STM32 New Project.PNG|400px]]

[[File:STM32 MCU-Selection.PNG|400px]]

2. Link the external files into the project. To do this, under ''File > Import'', select ''File System''. In the `chipwhisperer\hardware\victims\firmware` directory, select all of the relevant files and folders (Makefile in base folder, Makefile in HAL folder, STM32Fx HAL folder).:

[[File:STM32 Import.PNG|400px]]

3. Set up the build command. In ''File > Properties'', go to ''C/C++ Build > Behavior'' and remove 'all''<nowiki/>''' from 'Build' and deselect 'Enable parallel build'. Next, click the ''Builder Settings'' tab and deselect 'Use default build command' and 'Generate Makefiles Automatically'. Enter the command you would normally enter on the command line and change 'Build directory' to the folder you want to build in:

[[File:STM32 Behaviour.PNG|400px]]

[[File:STM32 Build-Settings.PNG|400px]]

4. Build the project and confirm that the build works from the output in the IDE console.

Then, if you want to set up debugging:

1. Go to ''in File > Properties'' select Run/Debug Settings and create a new debug configuration. Under Debugger, click 'Show generator options...' and setup your Connection Setup based on your debugger. Change 'Reset Mode' to 'Software System reset':

[[File:STM32 Debugging.PNG|400px]]

2. Click Apply and enter debugging mode.

'''Caveat''': the I/O register map in the debugger appears to use the last known device (ie: if you debugged an STM32F4 project before your Makefile project, it sticks with F4's registers). Check that the registers' addresses are correct before you trust them!

== Schematic ==
The following variants are possible, see the table above for SRAM/FLASH/HW-Crypto status:
{| class="wikitable"
!Variant
!U1
!R3 (VCC-Shunt)
!R4 (Clock)
|-
|F0
|STM32F071RBT6
|33-ohm
|120-ohm
|-
|F1
|STM32F100RBT6
|22-ohm
|51-ohm
|-
|F2HWC
|STM32F215RET6
|10-ohm
|51-ohm
|-
|F3
|STM32F303RCT7
|12-ohm
|51-ohm
|-
|F4
|STM32F405RGT6
|10-ohm
|51-ohm
|-
|F4HWC
|STM32F415RGT6
|10-ohm
|51-ohm
|}

=== Rev -03 Schematic ===

The current revision of the target is -03. The following shows this schematic:

[[File:CW308T_STM32F_03.png|1100px]]

=== Rev -02 Schematic ===

The original board sold was the -02 revision. The revision is part of the part number, for example these boards will be marked STM32F-02. The -02 revision also does not have the CAN connector:
[[File:cw308_stm32f.jpg|400px]]

[[File:CW308T_STM32F_02.png|1100px]]

== Hardware ==
{{Template:Hardware}}

[[Category: CW308 Targets]]

CW308T-STM32F/ChipWhisperer Bootloader

2020-03-11T17:58:13Z

Adewar:

{{Warningbox|These instructions have been updated for ChipWhisperer 5. If you're using and earlier version, see https://wiki.newae.com/V4:CW308T-STM32F/ChipWhisperer_Bootloader}}
The STM32Fx devices have a built-in bootloader, and the ChipWhisperer software as of 3.5.2 includes support for this bootloader.

Important notes before we begin:
* You MUST setup a clock and the serial lines for the chip. This is easily done by selecting a start-up script such as the "AES SimpleSerial on XMEGA" startup script.
* On the STM32F1, you MUST adjust the clock frequency to 8MHz. The bootloader does not work with our usual 7.37 MHz clock frequency. '''This 8MHz frequency does not apply to the code that you're running on the device. Once you're done programming, you'll need to set the frequency back to F_CPU (likely 7.37MHz)'''

To access the bootloader you can perform these steps. They vary based on if you have a "Rev 02" board or a "Rev 03 or Later" board. The revision number is printed on the bottom side as part of the PCB part number (STM32F-03 is Rev -03 for example).

== Rev -03 or Later ==

Run the following python code once you have the scope and target set up:
<syntaxhighlight lang=python>
prog = cw.programmers.STM32FProgrammer
cw.program_target(scope, prog, "<path to fw hex file>")
</syntaxhighlight>

If you get errors during the programming process:
* Retry the programming process with a lower baud rate:
<syntaxhighlight lang=python>
prog = cw.programmers.STM32FProgrammer
cw.program_target(scope, prog, "<path to fw hex file>", baud=38400)
</syntaxhighlight>
* If using a CW308 based STM, try mounting a jumper between the "SH-" and "SH+" pins at J16 (to the left of the SMA connector) on the UFO board. Retry programming with the jumper mounted.

== Rev -02 Boards ==

The Rev -02 boards did not have all programming connections present. They require some additional steps:

# Setup the device as usual:
#:<syntaxhighlight lang=python>
scope = cw.scope()
target = cw.target(scope)
scope.default_setup()
</syntaxhighlight>
# Mount a jumper between the H1 and PDIC pins (again this is ONLY for the -02 rev).
#: [[File:STMF32F-02 programmer jumper.jpg|400px]]
# Reset the ARM device either by pressing the reset button (newer UFO boards only), or by toggling power:
#:<syntaxhighlight lang=python>
import time
scope.io.target_pwr = False
time.sleep(1)
scope.io.target_pwr = True
</syntaxhighlight>
# Program the device:
#:<syntaxhighlight lang=python>
prog = cw.programmers.STM32FProgrammer
cw.program_target(scope, prog, "<path to fw hex file>")
</syntaxhighlight>
# The device should program, it may take a moment to fully program/verify on larger devices.
# Remove the jumper between the H1/H2 pins.
# Reset the ARM device either by pressing the reset button (newer UFO boards only), or by toggling power:
#:<syntaxhighlight lang=python>
import time
scope.io.target_pwr = False
time.sleep(1)
scope.io.target_pwr = True
</syntaxhighlight>

V5:CW308T-STM32F/ChipWhisperer Bootloader

2020-03-11T17:40:59Z

Adewar:

The STM32Fx devices have a built-in bootloader, and the ChipWhisperer software as of 3.5.2 includes support for this bootloader. a

Important notes before we begin:
* You MUST setup a clock and the serial lines for the chip. This is easily done by selecting a start-up script such as the "AES SimpleSerial on XMEGA" startup script.
* On the STM32F1, you MUST adjust the clock frequency to by 8MHz. The bootloader does not work with our usual 7.37 MHz clock frequency. '''You must set the clock frequency back to 7.37MHz after programming the device.'''

To access the bootloader you can perform these steps. They vary based on if you have a "Rev 02" board or a "Rev 03 or Later" board. The revision number is printed on the bottom side as part of the PCB part number (STM32F-03 is Rev -03 for example).

== Rev -03 or Later ==

# Select the "Serial STM32F Programmer"
#: [[File:arm_programmer.png]]
# Select the hex-file and press the "Program/Verify" button.
# The device should program, it may take a moment to fully program/verify on larger devices:
#: [[File:arm_programmed.png]]

{{Warningbox|If you get verify errors, it's possible the shunt resistor is causing power to dip too low. This can be solved by mounting a jumper between the "SH-" and "SH+" pins at J16 (to the left of the SMA connector) on the UFO board. Retry programming with the jumper mounted. }}

== Rev -02 Boards ==

The Rev -02 boards did not have all programming connections present. They require some additional steps:

# Select the "Serial STM32F Programmer"
#: [[File:arm_programmer.png]]
# Mount a jumper between the H1 and PDIC pins (again this is ONLY for the -02 rev).
#: [[File:STMF32F-02 programmer jumper.jpg|400px]]
# Reset the ARM device either by pressing the reset button (newer UFO boards only), or by toggling power:
#: [[File:arm_togglepower.png]]
# Select the hex-file and press the "Program/Verify" button.
# The device should program, it may take a moment to fully program/verify on larger devices:
#: [[File:arm_programmed.png]]
# Remove the jumper between the H1/H2 pins.
# Reset the ARM device either by pressing the reset button (newer UFO boards only), or by toggling power:
#: [[File:arm_togglepower.png]]

{{Warningbox|If you get verify errors, it's possible the shunt resistor is causing power to dip too low. This can be solved by mounting a jumper between the "SH-" and "SH+" pins at J16 (to the left of the SMA connector) on the UFO board. Retry programming with the jumper mounted. }}

V5:CW308T-STM32F/ChipWhisperer Bootloader

2020-03-11T17:40:48Z

Adewar: Created page with "The STM32Fx devices have a built-in bootloader, and the ChipWhisperer software as of 3.5.2 includes support for this bootloader. Important notes before we begin: * You MUST s..."

The STM32Fx devices have a built-in bootloader, and the ChipWhisperer software as of 3.5.2 includes support for this bootloader.

Important notes before we begin:
* You MUST setup a clock and the serial lines for the chip. This is easily done by selecting a start-up script such as the "AES SimpleSerial on XMEGA" startup script.
* On the STM32F1, you MUST adjust the clock frequency to by 8MHz. The bootloader does not work with our usual 7.37 MHz clock frequency. '''You must set the clock frequency back to 7.37MHz after programming the device.'''

To access the bootloader you can perform these steps. They vary based on if you have a "Rev 02" board or a "Rev 03 or Later" board. The revision number is printed on the bottom side as part of the PCB part number (STM32F-03 is Rev -03 for example).

== Rev -03 or Later ==

# Select the "Serial STM32F Programmer"
#: [[File:arm_programmer.png]]
# Select the hex-file and press the "Program/Verify" button.
# The device should program, it may take a moment to fully program/verify on larger devices:
#: [[File:arm_programmed.png]]

{{Warningbox|If you get verify errors, it's possible the shunt resistor is causing power to dip too low. This can be solved by mounting a jumper between the "SH-" and "SH+" pins at J16 (to the left of the SMA connector) on the UFO board. Retry programming with the jumper mounted. }}

== Rev -02 Boards ==

The Rev -02 boards did not have all programming connections present. They require some additional steps:

# Select the "Serial STM32F Programmer"
#: [[File:arm_programmer.png]]
# Mount a jumper between the H1 and PDIC pins (again this is ONLY for the -02 rev).
#: [[File:STMF32F-02 programmer jumper.jpg|400px]]
# Reset the ARM device either by pressing the reset button (newer UFO boards only), or by toggling power:
#: [[File:arm_togglepower.png]]
# Select the hex-file and press the "Program/Verify" button.
# The device should program, it may take a moment to fully program/verify on larger devices:
#: [[File:arm_programmed.png]]
# Remove the jumper between the H1/H2 pins.
# Reset the ARM device either by pressing the reset button (newer UFO boards only), or by toggling power:
#: [[File:arm_togglepower.png]]

{{Warningbox|If you get verify errors, it's possible the shunt resistor is causing power to dip too low. This can be solved by mounting a jumper between the "SH-" and "SH+" pins at J16 (to the left of the SMA connector) on the UFO board. Retry programming with the jumper mounted. }}

V4:CW308T-STM32F/ChipWhisperer Bootloader

2020-03-11T17:40:09Z

CW308T-STM32F/ChipWhisperer Bootloader

2020-02-27T16:26:51Z

Adewar:

CW308T-STM32F

2020-02-27T15:16:54Z

Adewar:

{{Infobox cw308target
|name = CW308T-STM32F
|image = STM32F3-Top_Rev03.jpg
|caption =
|Target Device = ST STM32F
|Target Architecture = Cortex M0,M3,M4
|Hardware Crypto = Possible
|Purchase Hardware = [http://store.newae.com/stm32f0-target-for-cw308-arm-cortex-m0-128kb-flash-8kb-sram/ Webstore, F0]

[http://store.newae.com/stm32f1-target-for-cw308-arm-cortex-m3-128kb-flash-8kb-sram/ Webstore, F1]

[http://store.newae.com/stm32f3-target-for-cw308-arm-cortex-m4-256kb-flash-40kb-sram/ Webstore, F3]

[http://store.newae.com/stm32f4-target-for-cw308-arm-cortex-m4-1mb-flash-192kb-sram/ Webstore, F4]

[http://store.newae.com/blank-pcb-stm32fx-cw308-target/ Webstore PCB]
|Design Files = [https://github.com/newaetech/chipwhisperer/tree/master/hardware/victims/cw308_ufo_target/stm32f GITHub Link]

[https://wiki.newae.com/CW308T-STM32F OSH Park PCBs]

|Supported Applications = [[SimpleSerial | Simple Serial Enc/Auth]]
|Programmer = ST-LINK/V2
|Status = Released
}}

{{Warningbox|ChipWisperer v5.1.3 before commit 3557 and arm-none-eabi-gcc before q2-2018 can produce non-working binaries for the STM32F3. The only fix is to update either ChipWhisperer or gcc}}

{{Warningbox|This page has not yet been fully updated for the v5 release. Some information may be outdated.}}

== Supported Devices ==

The STM32F board supports several STM32F devices in the TQFP-64 package. Various solder jumpers need to bet set to either the "A" or "B" position to select appropriate VCC supply for the different series. The following table summarizes examples of suitable devices:
{| class="wikitable"
!STM32F Series
!Package
!Device
!Hardware AES
!Tested
!Jumper
!Flash
!SRAM
!NAE P/N
|-
|F0
|TQFP-64
|STM32F071RBT6
|No
|Yes
|B
|128KB
|16KB
|NAE-CW308T-STM32F0
|-
|F1
|TQFP-64
|STM32F100RBT6B
|No
|Yes
|B
|128KB
|8KB
|NAE-CW308T-STM32F1
|-
|F2
|TQFP-64
|STM32F215RET6
|Yes
|Yes
|A
|512KB
|132KB
|NAE-CW308T-STM32F2HWC
|-
|F3
|TQFP-64
|STM32F303RCT7
|No
|Yes
|B
|256KB
|40KB
|NAE-CW308T-STM32F3
|-
|F4
|TQFP-64
|STM32F415RGT6
|Yes
|Yes
|A
|1MB
|192KB
|NAE-CW308T-STM32F4HWC
|-
|F4
|TQFP-64
|STM32F405RGT6
|No
|Yes
|A
|1MB
|192KB
|NAE-CW308T-STM32F4
|}

=== VCC-Int Supply ===
Several devices (F2, F4) have internal core voltage regulators. By default the CW308 board attempts to provide power for these pins, but the voltage may not be high enough to cause the internal regulator to disable itself. In this case you can use the VADJ regulator to ensure the internal regulator is disabled. See [[Targets with Internal Regulators]] for details.

=== Pin-outs across TQFP Devices ===

The following shows differences in pinouts between three groups of devices. The left-most is the STM32F051RB, which uses the same 3.3V VCORE as the STM32F1/F3. It has fewer VCC pins, so the I/O occupying that are VCC/GND pins on the STM32F1 (such as PF6/PF7) are tied to GND/VCC. The right-most part is the pinout of the STM32F2/F4. It has an internal regulator, where the VCAP pins are the output of this regulator (and input to the internal core logic).

[[File:power_diffstm32.png|800px]]

Note for the devices with a 3.3V VCORE, you should not mount decoupling capacitors C5/C6/C7/C8. You will still get some leakage with those capacitors mounted, but a stronger signal is present without them.

== Hardware AES ==

The STM32F21x, and STM32F41x/43x have hardware crypto modules (AES, DES, TDES) along with hardware hash (SHA1, MD5). Hardware crypto for the STM32F4 has been integrated into the Hal build system on the develop branch. To use the hardware crypto, call HW_AES128_Init() at the beginning of your program. You can update the key with HW_AES128_LoadKey(), encrypt plaintext with HW_AES128_Enc(), and decrypt data with HW_AES128_Dec().

== CAN Connection ==

A 6-pin header is present for devices which have CAN hardware support (not all devices have this). A CANoodler can be plugged in to provide the physical transceiver. This header is not normally mounted, unless the board is part of an 'automotive bundle'. The header is left unmounted as it can impede sweeping a probe over the surface of the chip.

== Programming Connection ==

=== ChipWhisperer Programmer via Bootloader ===

See further down this wiki page for details.

=== JTAG Programmer ===

The 20-pin JTAG port (J6 on CW308 Board) can be used with the [https://www.digikey.com/product-detail/en/stmicroelectronics/ST-LINK-V2/497-10484-ND/2214535 ST-LINK/V2] which is a low-cost JTAG programmer.

It is also possible to use other JTAG programmers such as OpenOCD. The following command worked with an Olimex OpenOCD programmer and their [https://www.olimex.com/Products/ARM/JTAG/ARM-USB-OCD-H/ OpenOCD for Windows] software:
<pre>
openocd
-f path/to/board/files/cw308.cfg
-c init
-c targets
-c "halt"
-c "flash write_image erase path/to/firmware.hex"
-c "verify_image path/to/firmware.hex"
-c "reset run"
-c shutdown
</pre>
where the contents of <code>cw308.cfg</code> are
<pre>
source [find interface/olimex-arm-usb-ocd-h.cfg]
source [find target/stm32f4x.cfg]
reset_config srst_only
</pre>

== Example Projects ==

SimpleSerial builds for each of the STM32Fx Devices. Each device is a separate HAL. These HAL modules have been copied from ST's HAL (not the CUBE) and greatly reduced in size by deleting unused files (such as headers for unused devices), and combining several C-source files into a single low-level C-file.

=== Building ST Example on Command Line ===
The regular firmware build process works with the STM32 devices. For example, to build `simpleserial-aes`, navigate to the folder `chipwhisperer\hardware\victims\firmware\simpleserial-aes` and run the following command on the command line:

<code>
make PLATFORM=CW308_STM32F0 CRYPTO_TARGET=TINYAES128C
</code>

If all goes well, this command will finish by printing the output file size and the platform:

[[File:Stm32-make.png]]

=== Programming via ChipWhisperer Bootloader ===

{{:CW308T-STM32F/ChipWhisperer_Bootloader}}

=== Running ST Example with ST-Link ===
If instead of using the bootloader, you want to use a ST-Link you can instead plug your programmer into the 20 pin JTAG connector (J6 on the UFO board):

[[File:Stm32-jtag.jpg|600px]]

Then, the details of this step will depend on your programmer. If you're using an ST-Link programmer, open the ST-Link utility and connect to the device:

[[File:Stm32-connect.png]]

Load your `.hex` file and program the device with the Program and Verify button:

[[File:Stm32-program.png]]

After this, you're ready to go - you can use the ChipWhisperer terminal to talk to your target. You might need to reset the target before you do anything else.

=== Building and Debugging via ST's System Workbench ===
It's also possible to work on the example projects using [http://www.st.com/en/development-tools/sw4stm32.html ST's System Workbench IDE]. This IDE also supports debugging, which is helpful for working out all the kinks in your firmware.

To build the ChipWhisperer examples in System Workbench:

1. Create a new Mcu project by going to ''File > New > C Project'' and selecting ''<nowiki/>'<nowiki/>''Ac6 STM32 MCU Project'''.'' When you get to Target Configuration, click the Mcu tab and select the microcontroller that you want to target:

[[File:STM32 New Project.PNG|400px]]

[[File:STM32 MCU-Selection.PNG|400px]]

2. Link the external files into the project. To do this, under ''File > Import'', select ''File System''. In the `chipwhisperer\hardware\victims\firmware` directory, select all of the relevant files and folders (Makefile in base folder, Makefile in HAL folder, STM32Fx HAL folder).:

[[File:STM32 Import.PNG|400px]]

3. Set up the build command. In ''File > Properties'', go to ''C/C++ Build > Behavior'' and remove 'all''<nowiki/>''' from 'Build' and deselect 'Enable parallel build'. Next, click the ''Builder Settings'' tab and deselect 'Use default build command' and 'Generate Makefiles Automatically'. Enter the command you would normally enter on the command line and change 'Build directory' to the folder you want to build in:

[[File:STM32 Behaviour.PNG|400px]]

[[File:STM32 Build-Settings.PNG|400px]]

4. Build the project and confirm that the build works from the output in the IDE console.

Then, if you want to set up debugging:

1. Go to ''in File > Properties'' select Run/Debug Settings and create a new debug configuration. Under Debugger, click 'Show generator options...' and setup your Connection Setup based on your debugger. Change 'Reset Mode' to 'Software System reset':

[[File:STM32 Debugging.PNG|400px]]

2. Click Apply and enter debugging mode.

'''Caveat''': the I/O register map in the debugger appears to use the last known device (ie: if you debugged an STM32F4 project before your Makefile project, it sticks with F4's registers). Check that the registers' addresses are correct before you trust them!

== Schematic ==
The following variants are possible, see the table above for SRAM/FLASH/HW-Crypto status:
{| class="wikitable"
!Variant
!U1
!R3 (VCC-Shunt)
!R4 (Clock)
|-
|F0
|STM32F071RBT6
|33-ohm
|120-ohm
|-
|F1
|STM32F100RBT6
|22-ohm
|51-ohm
|-
|F2HWC
|STM32F215RET6
|10-ohm
|51-ohm
|-
|F3
|STM32F303RCT7
|12-ohm
|51-ohm
|-
|F4
|STM32F405RGT6
|10-ohm
|51-ohm
|-
|F4HWC
|STM32F415RGT6
|10-ohm
|51-ohm
|}

=== Rev -03 Schematic ===

The current revision of the target is -03. The following shows this schematic:

[[File:CW308T_STM32F_03.png|1100px]]

=== Rev -02 Schematic ===

The original board sold was the -02 revision. The revision is part of the part number, for example these boards will be marked STM32F-02. The -02 revision also does not have the CAN connector:
[[File:cw308_stm32f.jpg|400px]]

[[File:CW308T_STM32F_02.png|1100px]]

== Hardware ==
{{Template:Hardware}}

[[Category: CW308 Targets]]

CW308T-STM32F

2020-01-21T15:57:06Z

Adewar:

{{Infobox cw308target
|name = CW308T-STM32F
|image = STM32F3-Top_Rev03.jpg
|caption =
|Target Device = ST STM32F
|Target Architecture = Cortex M0,M3,M4
|Hardware Crypto = Possible
|Purchase Hardware = [http://store.newae.com/stm32f0-target-for-cw308-arm-cortex-m0-128kb-flash-8kb-sram/ Webstore, F0]

[http://store.newae.com/stm32f1-target-for-cw308-arm-cortex-m3-128kb-flash-8kb-sram/ Webstore, F1]

[http://store.newae.com/stm32f3-target-for-cw308-arm-cortex-m4-256kb-flash-40kb-sram/ Webstore, F3]

[http://store.newae.com/stm32f4-target-for-cw308-arm-cortex-m4-1mb-flash-192kb-sram/ Webstore, F4]

[http://store.newae.com/blank-pcb-stm32fx-cw308-target/ Webstore PCB]
|Design Files = [https://github.com/newaetech/chipwhisperer/tree/master/hardware/victims/cw308_ufo_target/stm32f GITHub Link]

[https://wiki.newae.com/CW308T-STM32F OSH Park PCBs]

|Supported Applications = [[SimpleSerial | Simple Serial Enc/Auth]]
|Programmer = ST-LINK/V2
|Status = Released
}}

{{Warningbox|Some versions of the Arm GCC compiler appear to produce firmware that does not work. Known working versions include Windows/2018-q2, Windows/2019-q4 and Linux/5.4.1 20160919. Versions known not to work include Windows/2018-q1, Windows/2018-q4}}

{{Warningbox|This page has not yet been updated for the v5 release. Some information may be outdated.}}

== Supported Devices ==

The STM32F board supports several STM32F devices in the TQFP-64 package. Various solder jumpers need to bet set to either the "A" or "B" position to select appropriate VCC supply for the different series. The following table summarizes examples of suitable devices:
{| class="wikitable"
!STM32F Series
!Package
!Device
!Hardware AES
!Tested
!Jumper
!Flash
!SRAM
!NAE P/N
|-
|F0
|TQFP-64
|STM32F071RBT6
|No
|Yes
|B
|128KB
|16KB
|NAE-CW308T-STM32F0
|-
|F1
|TQFP-64
|STM32F100RBT6B
|No
|Yes
|B
|128KB
|8KB
|NAE-CW308T-STM32F1
|-
|F2
|TQFP-64
|STM32F215RET6
|Yes
|Yes
|A
|512KB
|132KB
|NAE-CW308T-STM32F2HWC
|-
|F3
|TQFP-64
|STM32F303RCT7
|No
|Yes
|B
|256KB
|40KB
|NAE-CW308T-STM32F3
|-
|F4
|TQFP-64
|STM32F415RGT6
|Yes
|Yes
|A
|1MB
|192KB
|NAE-CW308T-STM32F4HWC
|-
|F4
|TQFP-64
|STM32F405RGT6
|No
|Yes
|A
|1MB
|192KB
|NAE-CW308T-STM32F4
|}

=== VCC-Int Supply ===
Several devices (F2, F4) have internal core voltage regulators. By default the CW308 board attempts to provide power for these pins, but the voltage may not be high enough to cause the internal regulator to disable itself. In this case you can use the VADJ regulator to ensure the internal regulator is disabled. See [[Targets with Internal Regulators]] for details.

=== Pin-outs across TQFP Devices ===

The following shows differences in pinouts between three groups of devices. The left-most is the STM32F051RB, which uses the same 3.3V VCORE as the STM32F1/F3. It has fewer VCC pins, so the I/O occupying that are VCC/GND pins on the STM32F1 (such as PF6/PF7) are tied to GND/VCC. The right-most part is the pinout of the STM32F2/F4. It has an internal regulator, where the VCAP pins are the output of this regulator (and input to the internal core logic).

[[File:power_diffstm32.png|800px]]

Note for the devices with a 3.3V VCORE, you should not mount decoupling capacitors C5/C6/C7/C8. You will still get some leakage with those capacitors mounted, but a stronger signal is present without them.

== Hardware AES ==

The STM32F21x, and STM32F41x/43x have hardware crypto modules (AES, DES, TDES) along with hardware hash (SHA1, MD5). Hardware crypto for the STM32F4 has been integrated into the Hal build system on the develop branch. To use the hardware crypto, call HW_AES128_Init() at the beginning of your program. You can update the key with HW_AES128_LoadKey(), encrypt plaintext with HW_AES128_Enc(), and decrypt data with HW_AES128_Dec().

== CAN Connection ==

A 6-pin header is present for devices which have CAN hardware support (not all devices have this). A CANoodler can be plugged in to provide the physical transceiver. This header is not normally mounted, unless the board is part of an 'automotive bundle'. The header is left unmounted as it can impede sweeping a probe over the surface of the chip.

== Programming Connection ==

=== ChipWhisperer Programmer via Bootloader ===

See further down this wiki page for details.

=== JTAG Programmer ===

The 20-pin JTAG port (J6 on CW308 Board) can be used with the [https://www.digikey.com/product-detail/en/stmicroelectronics/ST-LINK-V2/497-10484-ND/2214535 ST-LINK/V2] which is a low-cost JTAG programmer.

It is also possible to use other JTAG programmers such as OpenOCD. The following command worked with an Olimex OpenOCD programmer and their [https://www.olimex.com/Products/ARM/JTAG/ARM-USB-OCD-H/ OpenOCD for Windows] software:
<pre>
openocd
-f path/to/board/files/cw308.cfg
-c init
-c targets
-c "halt"
-c "flash write_image erase path/to/firmware.hex"
-c "verify_image path/to/firmware.hex"
-c "reset run"
-c shutdown
</pre>
where the contents of <code>cw308.cfg</code> are
<pre>
source [find interface/olimex-arm-usb-ocd-h.cfg]
source [find target/stm32f4x.cfg]
reset_config srst_only
</pre>

== Example Projects ==

SimpleSerial builds for each of the STM32Fx Devices. Each device is a separate HAL. These HAL modules have been copied from ST's HAL (not the CUBE) and greatly reduced in size by deleting unused files (such as headers for unused devices), and combining several C-source files into a single low-level C-file.

=== Building ST Example on Command Line ===
The regular firmware build process works with the STM32 devices. For example, to build `simpleserial-aes`, navigate to the folder `chipwhisperer\hardware\victims\firmware\simpleserial-aes` and run the following command on the command line:

<code>
make PLATFORM=CW308_STM32F0 CRYPTO_TARGET=TINYAES128C
</code>

If all goes well, this command will finish by printing the output file size and the platform:

[[File:Stm32-make.png]]

=== Programming via ChipWhisperer Bootloader ===

{{:CW308T-STM32F/ChipWhisperer_Bootloader}}

=== Running ST Example with ST-Link ===
If instead of using the bootloader, you want to use a ST-Link you can instead plug your programmer into the 20 pin JTAG connector (J6 on the UFO board):

[[File:Stm32-jtag.jpg|600px]]

Then, the details of this step will depend on your programmer. If you're using an ST-Link programmer, open the ST-Link utility and connect to the device:

[[File:Stm32-connect.png]]

Load your `.hex` file and program the device with the Program and Verify button:

[[File:Stm32-program.png]]

After this, you're ready to go - you can use the ChipWhisperer terminal to talk to your target. You might need to reset the target before you do anything else.

=== Building and Debugging via ST's System Workbench ===
It's also possible to work on the example projects using [http://www.st.com/en/development-tools/sw4stm32.html ST's System Workbench IDE]. This IDE also supports debugging, which is helpful for working out all the kinks in your firmware.

To build the ChipWhisperer examples in System Workbench:

1. Create a new Mcu project by going to ''File > New > C Project'' and selecting ''<nowiki/>'<nowiki/>''Ac6 STM32 MCU Project'''.'' When you get to Target Configuration, click the Mcu tab and select the microcontroller that you want to target:

[[File:STM32 New Project.PNG|400px]]

[[File:STM32 MCU-Selection.PNG|400px]]

2. Link the external files into the project. To do this, under ''File > Import'', select ''File System''. In the `chipwhisperer\hardware\victims\firmware` directory, select all of the relevant files and folders (Makefile in base folder, Makefile in HAL folder, STM32Fx HAL folder).:

[[File:STM32 Import.PNG|400px]]

3. Set up the build command. In ''File > Properties'', go to ''C/C++ Build > Behavior'' and remove 'all''<nowiki/>''' from 'Build' and deselect 'Enable parallel build'. Next, click the ''Builder Settings'' tab and deselect 'Use default build command' and 'Generate Makefiles Automatically'. Enter the command you would normally enter on the command line and change 'Build directory' to the folder you want to build in:

[[File:STM32 Behaviour.PNG|400px]]

[[File:STM32 Build-Settings.PNG|400px]]

4. Build the project and confirm that the build works from the output in the IDE console.

Then, if you want to set up debugging:

1. Go to ''in File > Properties'' select Run/Debug Settings and create a new debug configuration. Under Debugger, click 'Show generator options...' and setup your Connection Setup based on your debugger. Change 'Reset Mode' to 'Software System reset':

[[File:STM32 Debugging.PNG|400px]]

2. Click Apply and enter debugging mode.

'''Caveat''': the I/O register map in the debugger appears to use the last known device (ie: if you debugged an STM32F4 project before your Makefile project, it sticks with F4's registers). Check that the registers' addresses are correct before you trust them!

== Schematic ==
The following variants are possible, see the table above for SRAM/FLASH/HW-Crypto status:
{| class="wikitable"
!Variant
!U1
!R3 (VCC-Shunt)
!R4 (Clock)
|-
|F0
|STM32F071RBT6
|33-ohm
|120-ohm
|-
|F1
|STM32F100RBT6
|22-ohm
|51-ohm
|-
|F2HWC
|STM32F215RET6
|10-ohm
|51-ohm
|-
|F3
|STM32F303RCT7
|12-ohm
|51-ohm
|-
|F4
|STM32F405RGT6
|10-ohm
|51-ohm
|-
|F4HWC
|STM32F415RGT6
|10-ohm
|51-ohm
|}

=== Rev -03 Schematic ===

The current revision of the target is -03. The following shows this schematic:

[[File:CW308T_STM32F_03.png|1100px]]

=== Rev -02 Schematic ===

The original board sold was the -02 revision. The revision is part of the part number, for example these boards will be marked STM32F-02. The -02 revision also does not have the CAN connector:
[[File:cw308_stm32f.jpg|400px]]

[[File:CW308T_STM32F_02.png|1100px]]

== Hardware ==
{{Template:Hardware}}

[[Category: CW308 Targets]]

CW308T-STM32F

2019-08-02T19:18:55Z

Adewar:

{{Infobox cw308target
|name = CW308T-STM32F
|image = STM32F3-Top_Rev03.jpg
|caption =
|Target Device = ST STM32F
|Target Architecture = Cortex M0,M3,M4
|Hardware Crypto = Possible
|Purchase Hardware = [http://store.newae.com/stm32f0-target-for-cw308-arm-cortex-m0-128kb-flash-8kb-sram/ Webstore, F0]

[http://store.newae.com/stm32f1-target-for-cw308-arm-cortex-m3-128kb-flash-8kb-sram/ Webstore, F1]

[http://store.newae.com/stm32f3-target-for-cw308-arm-cortex-m4-256kb-flash-40kb-sram/ Webstore, F3]

[http://store.newae.com/stm32f4-target-for-cw308-arm-cortex-m4-1mb-flash-192kb-sram/ Webstore, F4]

[http://store.newae.com/blank-pcb-stm32fx-cw308-target/ Webstore PCB]
|Design Files = [https://github.com/newaetech/chipwhisperer/tree/master/hardware/victims/cw308_ufo_target/stm32f GITHub Link]

[https://wiki.newae.com/CW308T-STM32F OSH Park PCBs]

|Supported Applications = [[SimpleSerial | Simple Serial Enc/Auth]]
|Programmer = ST-LINK/V2
|Status = Released
}}

{{Warningbox|Some versions of the Arm GCC compiler appear to produce firmware that does not work. Known working versions include Windows/2018-q2 and Linux/5.4.1 20160919. Versions known not to work include Windows/2018-q1, Windows/2018-q4}}

{{Warningbox|This page has not yet been updated for the v5 release. Some information may be outdated.}}

== Supported Devices ==

The STM32F board supports several STM32F devices in the TQFP-64 package. Various solder jumpers need to bet set to either the "A" or "B" position to select appropriate VCC supply for the different series. The following table summarizes examples of suitable devices:
{| class="wikitable"
!STM32F Series
!Package
!Device
!Hardware AES
!Tested
!Jumper
!Flash
!SRAM
!NAE P/N
|-
|F0
|TQFP-64
|STM32F071RBT6
|No
|Yes
|B
|128KB
|16KB
|NAE-CW308T-STM32F0
|-
|F1
|TQFP-64
|STM32F100RBT6B
|No
|Yes
|B
|128KB
|8KB
|NAE-CW308T-STM32F1
|-
|F2
|TQFP-64
|STM32F215RET6
|Yes
|Yes
|A
|512KB
|132KB
|NAE-CW308T-STM32F2HWC
|-
|F3
|TQFP-64
|STM32F303RCT7
|No
|Yes
|B
|256KB
|40KB
|NAE-CW308T-STM32F3
|-
|F4
|TQFP-64
|STM32F415RGT6
|Yes
|Yes
|A
|1MB
|192KB
|NAE-CW308T-STM32F4HWC
|-
|F4
|TQFP-64
|STM32F405RGT6
|No
|Yes
|A
|1MB
|192KB
|NAE-CW308T-STM32F4
|}

=== VCC-Int Supply ===
Several devices (F2, F4) have internal core voltage regulators. By default the CW308 board attempts to provide power for these pins, but the voltage may not be high enough to cause the internal regulator to disable itself. In this case you can use the VADJ regulator to ensure the internal regulator is disabled. See [[Targets with Internal Regulators]] for details.

=== Pin-outs across TQFP Devices ===

The following shows differences in pinouts between three groups of devices. The left-most is the STM32F051RB, which uses the same 3.3V VCORE as the STM32F1/F3. It has fewer VCC pins, so the I/O occupying that are VCC/GND pins on the STM32F1 (such as PF6/PF7) are tied to GND/VCC. The right-most part is the pinout of the STM32F2/F4. It has an internal regulator, where the VCAP pins are the output of this regulator (and input to the internal core logic).

[[File:power_diffstm32.png|800px]]

Note for the devices with a 3.3V VCORE, you should not mount decoupling capacitors C5/C6/C7/C8. You will still get some leakage with those capacitors mounted, but a stronger signal is present without them.

== Hardware AES ==

The STM32F21x, and STM32F41x/43x have hardware crypto modules (AES, DES, TDES) along with hardware hash (SHA1, MD5). Hardware crypto for the STM32F4 has been integrated into the Hal build system on the develop branch. To use the hardware crypto, call HW_AES128_Init() at the beginning of your program. You can update the key with HW_AES128_LoadKey(), encrypt plaintext with HW_AES128_Enc(), and decrypt data with HW_AES128_Dec().

== CAN Connection ==

A 6-pin header is present for devices which have CAN hardware support (not all devices have this). A CANoodler can be plugged in to provide the physical transceiver. This header is not normally mounted, unless the board is part of an 'automotive bundle'. The header is left unmounted as it can impede sweeping a probe over the surface of the chip.

== Programming Connection ==

=== ChipWhisperer Programmer via Bootloader ===

See further down this wiki page for details.

=== JTAG Programmer ===

The 20-pin JTAG port (J6 on CW308 Board) can be used with the [https://www.digikey.com/product-detail/en/stmicroelectronics/ST-LINK-V2/497-10484-ND/2214535 ST-LINK/V2] which is a low-cost JTAG programmer.

It is also possible to use other JTAG programmers such as OpenOCD. The following command worked with an Olimex OpenOCD programmer and their [https://www.olimex.com/Products/ARM/JTAG/ARM-USB-OCD-H/ OpenOCD for Windows] software:
<pre>
openocd
-f path/to/board/files/cw308.cfg
-c init
-c targets
-c "halt"
-c "flash write_image erase path/to/firmware.hex"
-c "verify_image path/to/firmware.hex"
-c "reset run"
-c shutdown
</pre>
where the contents of <code>cw308.cfg</code> are
<pre>
source [find interface/olimex-arm-usb-ocd-h.cfg]
source [find target/stm32f4x.cfg]
reset_config srst_only
</pre>

== Example Projects ==

SimpleSerial builds for each of the STM32Fx Devices. Each device is a separate HAL. These HAL modules have been copied from ST's HAL (not the CUBE) and greatly reduced in size by deleting unused files (such as headers for unused devices), and combining several C-source files into a single low-level C-file.

=== Building ST Example on Command Line ===
The regular firmware build process works with the STM32 devices. For example, to build `simpleserial-aes`, navigate to the folder `chipwhisperer\hardware\victims\firmware\simpleserial-aes` and run the following command on the command line:

<code>
make PLATFORM=CW308_STM32F0 CRYPTO_TARGET=TINYAES128C
</code>

If all goes well, this command will finish by printing the output file size and the platform:

[[File:Stm32-make.png]]

=== Programming via ChipWhisperer Bootloader ===

{{:CW308T-STM32F/ChipWhisperer_Bootloader}}

=== Running ST Example with ST-Link ===
If instead of using the bootloader, you want to use a ST-Link you can instead plug your programmer into the 20 pin JTAG connector (J6 on the UFO board):

[[File:Stm32-jtag.jpg|600px]]

Then, the details of this step will depend on your programmer. If you're using an ST-Link programmer, open the ST-Link utility and connect to the device:

[[File:Stm32-connect.png]]

Load your `.hex` file and program the device with the Program and Verify button:

[[File:Stm32-program.png]]

After this, you're ready to go - you can use the ChipWhisperer terminal to talk to your target. You might need to reset the target before you do anything else.

=== Building and Debugging via ST's System Workbench ===
It's also possible to work on the example projects using [http://www.st.com/en/development-tools/sw4stm32.html ST's System Workbench IDE]. This IDE also supports debugging, which is helpful for working out all the kinks in your firmware.

To build the ChipWhisperer examples in System Workbench:

1. Create a new Mcu project by going to ''File > New > C Project'' and selecting ''<nowiki/>'<nowiki/>''Ac6 STM32 MCU Project'''.'' When you get to Target Configuration, click the Mcu tab and select the microcontroller that you want to target:

[[File:STM32 New Project.PNG|400px]]

[[File:STM32 MCU-Selection.PNG|400px]]

2. Link the external files into the project. To do this, under ''File > Import'', select ''File System''. In the `chipwhisperer\hardware\victims\firmware` directory, select all of the relevant files and folders (Makefile in base folder, Makefile in HAL folder, STM32Fx HAL folder).:

[[File:STM32 Import.PNG|400px]]

3. Set up the build command. In ''File > Properties'', go to ''C/C++ Build > Behavior'' and remove 'all''<nowiki/>''' from 'Build' and deselect 'Enable parallel build'. Next, click the ''Builder Settings'' tab and deselect 'Use default build command' and 'Generate Makefiles Automatically'. Enter the command you would normally enter on the command line and change 'Build directory' to the folder you want to build in:

[[File:STM32 Behaviour.PNG|400px]]

[[File:STM32 Build-Settings.PNG|400px]]

4. Build the project and confirm that the build works from the output in the IDE console.

Then, if you want to set up debugging:

1. Go to ''in File > Properties'' select Run/Debug Settings and create a new debug configuration. Under Debugger, click 'Show generator options...' and setup your Connection Setup based on your debugger. Change 'Reset Mode' to 'Software System reset':

[[File:STM32 Debugging.PNG|400px]]

2. Click Apply and enter debugging mode.

'''Caveat''': the I/O register map in the debugger appears to use the last known device (ie: if you debugged an STM32F4 project before your Makefile project, it sticks with F4's registers). Check that the registers' addresses are correct before you trust them!

== Schematic ==
The following variants are possible, see the table above for SRAM/FLASH/HW-Crypto status:
{| class="wikitable"
!Variant
!U1
!R3 (VCC-Shunt)
!R4 (Clock)
|-
|F0
|STM32F071RBT6
|33-ohm
|120-ohm
|-
|F1
|STM32F100RBT6
|22-ohm
|51-ohm
|-
|F2HWC
|STM32F215RET6
|10-ohm
|51-ohm
|-
|F3
|STM32F303RCT7
|12-ohm
|51-ohm
|-
|F4
|STM32F405RGT6
|10-ohm
|51-ohm
|-
|F4HWC
|STM32F415RGT6
|10-ohm
|51-ohm
|}

=== Rev -03 Schematic ===

The current revision of the target is -03. The following shows this schematic:

[[File:CW308T_STM32F_03.png|1100px]]

=== Rev -02 Schematic ===

The original board sold was the -02 revision. The revision is part of the part number, for example these boards will be marked STM32F-02. The -02 revision also does not have the CAN connector:
[[File:cw308_stm32f.jpg|400px]]

[[File:CW308T_STM32F_02.png|1100px]]

== Hardware ==
{{Template:Hardware}}

[[Category: CW308 Targets]]

CW1101 ChipWhisperer-Nano

2019-08-02T19:17:24Z

Adewar:

{{Warningbox|This page has not yet been updated for the v5 release. Some information may be outdated.}}

== ChipWhisperer Nano (CWNANO) Background ==

[[File:CWNANO_RESIZE.png|800px]]

ChipWhisperer-Nano is an ultra low-cost platform for side-channel power analysis & voltage fault injection. It has the following features:

# ADC capable of sampling up to 20 MS/s, using either external clock (synchronous to device) or internal clock (both synchronous and asynchronous).
# ADC hardware trigger uses rising-edge input and starts sampling on first device clock after trigger line going high, samples for user-configurable length.
# STM32F030 target for loading example code onto, including a programmer built into the ChipWhisperer-Nano.
# Crowbar based VCC glitching, approx 10nS resolution on glitch width and offset (glitch offset from trigger with up to 200nS jitter).

It is primarily designed for power analysis demonstrations and training programs. It is also available as a module without a target for integration onto a target board, as one option for ChipWhisperer-Enabling your development platforms.

=== Examples of Tutorials you can Run ===

ChipWhisperer-Nano is a complete tutorial platform. You could run the following tutorials on it for example (using the included target):

* Perform a CPA (power analysis) attack on a textbook AES implementation.
* Perform a CPA attack on MBED-TLS AES implementation.
* Perform a DPA attack on an XOR password check.
* Perform a SPA attack on an RSA library.
* Perform a timing attack on a password check.
* Perform fault injection attacks to demonstrate corrupting a variable (NB: not as reliable due to limitations listed below).

If you were to attach an external target, you could also do the following:

* Perform a CPA attack on a hardware AES accelerator.
* Perform a power analysis attack on a FPGA target.
* Perform the LPC1114 tutorial.
* Connect to CW308 UFO Board for use with a wide variety of targets.

=== Limitations compared to ChipWhisperer-Lite and Pro ===

The ChipWhisperer-Lite and Pro both use an FPGA for performing all clock routing, in addition to using better ADCs and analog front ends. Fundamentally, the design of the ChipWhisperer-Nano means it has the following major limitations:

* Sampling clock in external mode directly follows the input clock (no ability to multiply/divide/offset clock as in CW1173/CW1200).
* Sampling clock in internal mode limited to specific fixed divisions of 240 MHz PLL clock.
* Fixed analog front-end gain of approx 10dB.
* ADC limited to 20MS/s (can be overclocked slightly, up to 30MS/s but not guaranteed).
* No ADC offset to delay capture for some specific number of cycles after the trigger.
* Cannot generate clock glitching waveforms.
* VCC crowbar limited to coarse offset and width steps.
* Considerable jitter on glitch offset (due to interrupt-based source).
* Rising edge trigger only.
* Full-speed USB instead of high-speed USB.

Note that despite these limitations, ChipWhisperer-Nano can be used for attacking real devices. You can attack hardware crypto running on a microcontroller, or use power-analysis to recover a bootloader password or key. The fundamental synchronous architecture of the device (which powers all of our capture hardware tools) means it achieves considerably better performance than a regular asynchronous oscilloscope, even when that oscilloscope is running 5-20x faster.

== Connecting to External Targets ==

You have two options for connecting to external targets: to either break off the STM32F0 end, or to program it with a loop that keeps all I/O in tristate mode. Either way you will also need to add the following connectors:

* 20-pin connector (follows standard 20-pin pinout).
* Either 3-pin headers on MEASURE and GLITCH, or SMA connectors (only if end is broken off).

=== Tri-State via Program ===

If using the tri-state mode, you should ensure the PDIC line is held LOW to avoid accidentally entering bootloader mode on the STM32F0.

There will be some additional noise due to the STM32F0 being on the power line. You can reduce this by opening the solder jumper that links the STM32F0 to the input stage.

=== Cutting end Off ===

Similar to the ChipWhisperer-Lite, you can break off the end section. To do that, you will have to do the following:

# Use an xacto knife or similar to deeply score along the perforated holes on both top and bottom, being very careful not to cut towards or near your hand. You will need to hold the CWNANO in an appropriate jig or vice.
# Align the holes on the edge of a hard surface (suggested: block of wood), and firmly push down on the target end while pushing against down the PCB against the edge. The objective is to avoid flexing the PCB which is likely to break components or solder joints.
# With appropriate protection from the fiberglass dust, lightly sand the broken edges.

== Reprogramming ==

To reprogram the CW1101, you simply need to force the ERASE. This is done by shorting the "ERASE" jumper on the bottom side while plugging in the USB. This is easier to do by inserting the micro-USB end into the CW1101, and leaving the full-sized end not plugged into the computer. While shorting the ERASE jumper with tweezers have someone plug in the full-sized USB. The device should re-enumerate as a serial port, and the USB LED will be off or dimly lit.

== Beta Versions ==

There exist TWO beta (pre-release) versions floating around. The two versions were released at these events:

# CHES 2018 version
# arm TechCon version

These versions have some limitations. First, they have not been well tested and were not built under the normal production processes, so are not guaranteed to be as reliable w.r.t. soldering. Second, they have some specific hardware changes relative to the production units:

# arm TechCon and CHES version (-01 and -02 PCB revs): If you cut/snap the target off, the GPIO4 (trigger) pin is not connected. As this pin is required to be used for the ADC trigger, we recommend not cutting the targets off these versions. The GPIO4 trace is incorrectly routed THROUGH the target section. If you'd like to use an external target, either erase the STM32F0 or remove the IC.
# CHES version (-01 PCB rev) does not have the amplifier on the front-end. This results in poor analog performance.

CW1200 ChipWhisperer-Pro

2019-08-02T19:16:59Z

Adewar:

{{Warningbox|This page has not yet been updated for the v5 release. Some information may be outdated.}}

The CW1200 (ChipWhisperer Pro) is an upgraded version of the ChipWhisperer Lite capture hardware. The Pro includes an FPGA with much more space than the Lite, allowing many new features to be added, including a larger sample buffer, streaming-mode captures, additional trigger methods, and a touchscreen interface. These features make it a high-end device suitable for laboratory use.

Check out a [https://youtu.be/qS6JwX4SBOI sneak peek of the CW-Pro].

[[File:cwpro_invisible.png|500x500px]]
{{TOC|limit=3}}

== Connection Quick-Start ==

<ol>
<li>Follow the [[Installing ChipWhisperer]] instructions for the ChipWhisperer software and its prerequisites.</li>
<li>Connect ChipWhisperer-Lite, install USB Drivers:
<dl>
<dt>Windows:</dt>
<dd><ul>
<li>Plug micro-USB cable into ChipWhisperer-Lite</li>
<li>If the "New Hardware Found" wizard doesn't prompt you for drivers, go to the control panel and find the "ChipWhisperer-Pro" device, and select "Update Drivers".</li>
<li>You can find drivers in <code>c:\chipwhisperer\hardware\capture\chipwhisperer-cw1200\</code>. You will likely need to extract them from the <code>cw1200_usbdriver.zip</code> file. If so simply extract them somewhere (i.e. your desktop), and then point the new hardware found wizard to that location.</li></ul>
</dd>
<dt>Linux:</dt>
<dd><ul>
<li>Driver installation is not required, but if you do not update the 'udev' system, you will be unable to run ChipWhisperer-Capture as a regular user. To update the udev system, first make sure the ChipWhisperer-Lite is Make a file called <code>/etc/udev/rules.d/99-cwlite.rules</code> . The contents of this file should be:
<pre># allow users to claim the device
SUBSYSTEM=="usb", ATTRS{idVendor}=="2b3e", ATTRS{idProduct}=="ace3", MODE="0664", GROUP="plugdev"</pre></li>
<li>Add your username to the plugdev group:
<pre>$ sudo usermod -a -G plugdev YOUR-USERNAME</pre></li>
<li>And reset the udev system:
<pre>$ sudo udevadm control --reload-rules</pre></li>
<li>Finally log out & in again for the group change to take effect.</li>
<li>Connect the USB-A cable, and DC power cable</li></ul>
</dd>
<dt>MAC:</dt>
<dd><ul>
<li>No special installation required - must ensure you have installed libusb via homebrew (see instructions at [[MacOSX_Installation]]).</li></ul>
</dd></dl>
</li>
<li>To check for a successful installation Run ChipWhisperer-Capture. This can be done from one of three ways:
<blockquote><ul>
<li>Double-click on <code>CWCapture.pyw</code> in the <code>chipwhisperer\software</code> folder. You must have installed Python into your path for this to work.</li>
<li>run <code>python CWCapture.pyw</code> from the <code>chipwhisperer\software</code> folder using a command prompt with Python in the path.</li>
<li>run <code>python CWCaptureGUI.py</code> from the <code>chipwhisperer\software\chipwhisperer\capture\ui</code> directory.</li></ul>

The last option is the most reliable, in that it should always work on all platforms. If it doesn't start look for possible missing modules or other useful errors.
</blockquote>
<li>Your ChipWhisperer-Lite is now connected. See the Tutorial B-1 for details of the demo attack.</li>
</li></ol>

== Power Supply ==
The ChipWhisperer Pro can only be powered through its 5 V jack. It cannot be powered through the USB port - internally, there are no connections to the USB port's 5 V rail. This limitation is primarily due to the high current draw of the Pro: while powering the touchscreen running and an external target, it would be easy to exceed the USB current limit, causing all sorts of issues.

To make this setup more flexible, the Pro ships with two power sources:
* A 5 V, 2.1 A power supply. This supply is suitable for a permanent bench setup.
* A USB-to-barrel jack cable. This solution is more portable: if you're travelling with a laptop, you can use a second USB port for power. A USB charger will also work here.
If you're using the USB power cable, it is recommended to use a separate power supply to power any external target boards.

== Basic Usage ==
The basic features on the Pro are exactly the same as the ChipWhisperer Lite. This means that any scripts and tutorials made for the Lite will work on the Pro, too: the connectors and pinouts are exactly the same.

{{CollapsibleSection
|intro = === AVR Programmer ===
|content= CW1173_ChipWhisperer-Lite/AVR Programmer}}

{{CollapsibleSection
|intro = === XMEGA Programmer ===
|content= CW1173_ChipWhisperer-Lite/XMEGA Programmer}}

{{CollapsibleSection
|intro = === Using Glitch Port ===
|content= CW1173_ChipWhisperer-Lite/Glitch Port}}

{{CollapsibleSection
|intro = === Using Measure Port ===
|content= CW1173_ChipWhisperer-Lite/Measure Port}}

{{CollapsibleSection
|intro = === 20-Pin Connector ===
|content= CW1173_ChipWhisperer-Lite/20-Pin Connector}}

{{CollapsibleSection
|intro = === Upgrading SAM3U Firmware ===
|content= CW1173_ChipWhisperer-Lite/Upgrading SAM3U Firmware}}

== Advanced Features ==
{{CollapsibleSection
|intro = === Streaming Mode ===
|content= CW1200 ChipWhisperer-Pro/Streaming Mode}}

{{CollapsibleSection
|intro = === Trigger Module ===
|content= CW1200 ChipWhisperer-Pro/Trigger Module}}

{{CollapsibleSection
|intro = === SMA I/O ===
|content= CW1200 ChipWhisperer-Pro/SMA I/O}}

{{CollapsibleSection
|intro = === Touchscreen ===
|content= CW1200 ChipWhisperer-Pro/Touchscreen}}

== Hardware ==
{{Template:Hardware}}

[[Category:Capture Hardware]]