ChipWhisperer Wiki - User contributions [en]

Installing ChipWhisperer/Required Tools - Mac OS X

2018-03-22T17:51:22Z

Cwiesner:

<h2> Python </h2>
The following have been tested on Mac OS X Yosemite (10.10) - earlier versions may not have a recent enough Python installation (recommended 2.7.6 or later). It's possible to install other Python versions on your Mac OS X via the 'homebrew' system, we will use this for installing a few additional required tools.

<ol style="list-style-type: decimal;">
<li>Ensure your user account has a password. In order for the 'sudo' command to work it requires you to type your password, so if you don't have one enabled be sure to set a temporary password now.</li>
<li><p>Install the 'homebrew' system, see [http://brew.sh brew.sh] for details. Briefly, you can install it by pasting the following in a terminal:</p>
<pre>$ ruby -e "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/master/install)"</pre></li>
<li><p>As PySide is based on Qt 4, which is not officially supported by Homebrew, you will need to load the [https://github.com/cartr/homebrew-qt4 homebrew-qt4 tap]:</p>
<pre>$ brew tap cartr/qt4</pre></li>
<li><p>Install PySide using homebrew:</p>
<pre>$ brew install pyside</pre>
<p>If you recieve an error saying that no such package exists, you can also install PySide using the pip installer</p>
<pre>pip install -U PySide</pre>
<p>The install will probably print a message like this:</p>
<blockquote><p>[[File:Install_macosx_brewpath.png|image]]</p></blockquote>
<p>Note you must run that command in order to successfully import the modules, in this example it would be:</p>
<pre>$ mkdir -p /Users/macmini/Library/Python/2.7/lib/python/site-packages
$ echo 'import site; site.addsitedir("/usr/local/lib/python2.7/site-packages")' >> /Users/macmini/Library/Python/2.7/lib/python/site-packages/homebrew.pth</pre></li></ol>

<h2> SciPy </h2>
You may need to upgrade your SciPy from the base install if you wish to do template attacks. This is not needed for other attacks, so please only proceed with the following if you receive an error that your version of scipy is too old.

The easiest method is to use brew again:

brew install scipy

You will also need to follow the instructions as above (inserting the link to the brew site-packages location). You will finally need to run the following:

brew link --overwrite numpy

<h2> libusb </h2>
libusb is needed for the ChipWhisperer software to communicate with the board.

Again, use brew:

brew install libusb

<h2> AVR-GCC </h2>

You can easily use brew to install avr-gcc, as decribed at [https://github.com/osx-cross/homebrew-avr/ OSX-Cross Project]:

$ brew tap osx-cross/avr

$ brew install avr-gcc

CW506 Advanced Breakout Board

2018-03-15T20:58:30Z

Cwiesner: /* XMEGA Programming & Pull Up Resistors */

[[File:cw506_white_medsize.jpg|600px]]

== Background ==

The CW506 is a simple but powerful breakout board for devices using NewAE Technology's [[20-Pin Connector]] standard. Almost all of our target boards and capture hardware feature this connector, making the breakout board widely applicable to our product line.

The breakout board features a variety of voltage translators, test points, connectors, and switches that makes it simple to interface various test equipment and target devices together. This includes both connecting other lab equipment, along with connecting ChipWhisperer capture hardware to your own targets.

[[File:cw506_annotate1.png]]

== Connection Routing ==

The following shows the routing of various connections on the breakout board:

[[File:cw506_route.png]]

=== Voltage Translation ===

The voltage translation is done with three different parts:

* SN74LVC1T45DBVT for high-speed clock lines (unidirectional, approx 200 Mbps max speed, 1.65V - 5.5V)
* PI4ULS5V201TAEX for GPIO1/2 (bidirectional, approx 20 Mbps max speed, 1.2V - 5.5V)
* GTL2003PW for GPIO2/3 + Others (bidirectional, 1.0V - 5.5V)

Note the clock translators limit lower operating voltage, if not using HS1 or HS2 you can safely use this board down to 1.2V. The maximum speed of the voltage translators varies with different output voltages, see datasheet for details.

The VCCIO net on the board defines what logic level the target (i.e., the signals on the jumpers and headers on the right side of the board) section operates at. There is a vertical double-line on the breakout board, everything on the right side of the double-line operates at VCC-IO levels.

=== SW4 (Target Disconnect) ===

A DIP switch can be used to disconnect certain pins of the 20-pin header. The DIP switch has small text marked "ON", when the DIP switch is moved to this position the 20-pin connector is ENABLED.

The following shows an example where we've disconnected GPIO4 (the trigger) from our target device, and am feeding an external trigger in with the header (JP4) to the left of the DIP switch. This new trigger signal will be routed to the attached ChipWhisperer, and can be used instead of the trigger coming from the target device. Notice the DIP switch for TIO4 (GPIO4/IO4) is set to the LEFT, and the rest are set to the RIGHT (ON).
[[File:Cw506_dip_nogpio4.jpg|none|Setting the DIP switch to the LEFT causes the 20-pin target to be disconnected.|thumb|400x400px]]The following summarizes the connection for different SW4 settings. Note the 20-pin connector and the test-points to the right of that connector (marked TIO1, TIO2, TIO3, TIO4) are the only things disconnected.
{| class="wikitable"
!
!scope="row" colspan="2"|3.3V Logic
!scope="row" colspan="5"|VCC-IO Logic
|-
!SW4 Setting
!JP1 (Left 20-Pin)
!JP3
!JP4
!JP5/JP6
!JP2 (Right 20-Pin)
!TIO1-TIO4 Test Points
!TP7/TP8, SMA Connectors
|-
|OFF
|TIO1-TIO4
|☑
|☑
|
|
|
|
|-
|ON
|TIO1-TIO4
|☑
|☑
|
|☑
|☑
|
|- style="background-color: white;"
|OFF
|HS1-HS2
|☑
|
|
|
|
|☑
|- style="background-color: white;"
|ON
|HS1-HS2
|☑
|
|
|☑
|
|☑
|-
|?
|SPI/PDI/Other
|☑
|
|☑
|☑
|
|
|}

=== VCC-IO Settings ===

The VCC-IO level defines what voltage the inputs/outputs on the RIGHT side operate at (the target side). The inputs/outputs on the LEFT side (the ChipWhisperer capture side) are always 3.3V.

The VCC-IO level can be set to one of:

* Fixed 3.3V.
* Based on voltage on VREF pin of JP2 (20-pin target connector).
* Based on external voltage reference.

The current VCC-IO voltage is available on test point TP11 (just beside the 3 LEDs).

==== Normal Usage ====

Normally you would use either "JP2.VREF" or "+3V3". All NewAE target boards will provide a signal on JP2.VREF which indicates the correct translation voltage. If using a simple breakout or your own target board, you may just wish to force use of 3.3V IO voltages however.

These settings are configured with switch SW1 and SW2. In addition, three LEDs will confirm your setting. For example here the board is set to output 3.3V reference signals:

[[File:cw506_vccio.jpg|400px]]

==== Using External VREF ====

The final setting allows you to use the banana jack (BJACK) or test point TP9 as the voltage reference. This allows usage of an external lab supply for setting the output signal level to any supported level.

If using the BJACK feature, be sure to check switch SW3 is set in the correct position. The BJACK can also be used to provide the 3.3V rail for the target device.

=== JP2.+3v3 Settings ===

The 20-pin target connector (JP2) has two power supplies: a +5.0V signal, and a +3.3V signal. Normally these signals would come from a power supply in the ChipWhisperer-Capture target board (on JP1).

However if using the breakout board stand-alone, these will not be present. Switch SW3 allows you to route an external power supply onto the +3.3V power supply pins of JP2, allowing you to power a target expecting this supply voltage. This can also be used to power a target that draws more current than the ChipWhisperer-Capture hardware can provide.

Note it's possible but not recommended to also use this feature to adjust the supply voltage of the target (i.e., experiment running the target at 2.5V or 5.0V). The 3.3V supply may power 3.3V-only logic on the target board.

Setting SW3 to the LEFT position will drive the 3.3V power supply on the target board from the banana jack connector, which also connect to test point TP9 (the large red test point).

== XMEGA Programming & Voltage Levels ==

If you want to program an XMEGA target with the CW506 and CW-Lite, you'll have to place a resistor on your UFO Board. You must connect a 330 Ohm resistor between the GPIO3 and PDIC pin (you can use jumper cables instead of soldering or physically modifying your board).

To program the target set "Target IO3" to GPIO in "Scope Settings"-->"Target IOn pins". Next set GPIO3 to low from "Scope Settings"-->"Target IOn GPIO mode".

IMPORTANT: You must set GPIO3 to high after programming, otherwise the chip will remain in programming mode, and your code will not execute.

There is a known issue where GPIO3/4 do not reach VREF/VCCIO. Usually this does not cause problems, unless you are using a reference voltage above 3.3 volts. In some cases the high level voltage will be too close to its threshold to provide reliable performance. In this case a 330 Ohm pull up resistor between VREF and the affected pin should resolve the issue.

== Use Cases ==

=== Probing Target Board Signals ===

=== Using Target Board Stand-Alone ===

=== Inserting External Equipment into Test Path ===

== Schematic ==

The schematic is available in two formats - PDF and schematic images. Click the images for full resolution.

* [[:File:NAE-CW506-02-SCH.pdf|Schematic PDF (NAE-CW506-02: June 1st, 2016)]]

[[File:NAE-CW506-02_page1.png|600px]]

[[File:NAE-CW506-02_page2.png|600px]]

{{Template:Hardware}}

CW1173 ChipWhisperer-Lite/Upgrading SAM3U Firmware

2018-03-02T18:36:05Z

Cwiesner:

When talking about the ChipWhisperer's firmware, there is really two parts to this:

# The FPGA Bitstream file.
# The SAM3U USB interface chip firmware.

The FPGA bitstream alone is what is normally configured by the ChipWhisperer-Capture software. This bitstream is always the most up-to-date, since it's automatically reloaded by the computer every time you power cycle the ChipWhisperer-Capture. The SAM3U firmware however is not automatically updated, but it tends to change less frequently.

=== Checking Firmware Version ===

The firmware version is printed at start-up. You will see a line that looks like this indicating the version of the SAM3U Firmware:

<pre>Found CW-Lite, Serial Number = 442031204630xxxxxxxxxxx
SAM3U Firmware version = 0.11 b0
Programmed FPGA</pre>
If your firmware version is outdated, a warning will be printed. You can also see the firmware version in the ''Config CW Firmware'' dialog:

<blockquote>[[File:sam3fwver.png|image]]
</blockquote>
Note the main version is 0.11 in this example. The "b0" indicates a "build" number. Typically this will be "build 0", but special versions will use a different build number to indicate a variant of a regular version.

=== Upgrading Firmware ===

Before updating, you must put your ChipWhisperer into bootloader mode. Once put into this mode you will need to load a new firmware file. There is two ways of doing it: the ''automatic'' method, and the ''manual'' method. The automatic method is done through the GUI, and works if you have valid firmware image loaded. The ''manual'' method is always guaranteed to work.

The automatic method is:

Using ChipWhisperer-Capture GUI

# Connect to the ChipWhisperer.
# From the ''Tools'' menu select ''Config CW Firmware''
# Select the ''Open SAM3U Update Widget'' button.
# Press the ''Enable Bootloader Mode'' button.
# You will get an error, and the ChipWhisperer will disconnect. This is normal, and indicates the USB mode changed suddenly.
# The blue LED will stop flashing, and the device will reconnect in programmer mode (see below).

Once you are in bootloader mode, both the blue and red LED will be very dimmly lit:

[[File:lights_prog.jpg|400px]]

This indicates it is in bootloader mode. The device will now attach as a serial port. If you are using Windows this may take a few minutes to happen.

If using Linux, you can use ''dmesg'' to verify the serial port was connected OK.

If this doesn't work, see the page [[Manual SAM3U Firmware Update]] for details on how to manually enter bootloader mode. You can return to this page for the actual programming - you don't need to install/use the BOSSA utility if you follow those manual directions. You simply need to force the system into bootloader mode using those directions.

To actually program the file, we use the second part of the dialog box you already had open:

[[File:sam3uupdate.png|400px]]

Once we are in bootloader mode, you can follow these steps:

# Hit "Update List", and select the serial port the SAM3U attached as.
# To use the default firmware file, leave the "Built-in" radio-box selected. If you want a custom firmware you can select the "External" mode.
# Hit the "Run Program" button
# Once completed, unplug/replug your device and it should come to life.
# Close the update widgets, and reconnect to your ChipWhisperer.

=== Linux usbserial module Workaround ===
There is an issue in some versions of Linux, where the SAM3U is not assigned a serial port when it enters bootloader mode. Here are some steps to resolve this issue (Note. this is not a permanent fix, you must go through these steps each time you put your ChipWhisperer into bootloader mode.). These steps assume you've already put ChipWhisperer into bootloader mode.

# Unplug your ChipWhisperer (Leave unplugged until instructed otherwise)
# Reboot your computer
# Once logged in again, open a terminal session
# Run this command: <code>sudo modprobe usbserial vendor=0x3eb product=0x6124</code>
# Plug your ChipWhisperer back in
# Check that a serial port is now open using: <code>ls -l /dev/ttyUSB*</code>

[[File:ttyUSB example.png|400px]]

You should now be able to program the bootloader from ChipWhisperer Capture through the port you created

=== Manual Update ===

If the above instructions fail, there is no big problem. The SAM3U chip contains a hardware-resident bootloader. You may need to follow instructions on the [[Manual SAM3U Firmware Update]] page (including using BOSSA) if you are unable to use the automatic system that is part of ChipWhisperer-Capture.

File:TtyUSB example.png

2018-03-02T18:35:12Z

Cwiesner: File uploaded with MsUpload

File uploaded with MsUpload

CW506 Advanced Breakout Board

2018-02-23T21:26:38Z

Cwiesner: XMEGA programmer and pull up resistor updates

[[File:cw506_white_medsize.jpg|600px]]

== Background ==

The CW506 is a simple but powerful breakout board for devices using NewAE Technology's [[20-Pin Connector]] standard. Almost all of our target boards and capture hardware feature this connector, making the breakout board widely applicable to our product line.

The breakout board features a variety of voltage translators, test points, connectors, and switches that makes it simple to interface various test equipment and target devices together. This includes both connecting other lab equipment, along with connecting ChipWhisperer capture hardware to your own targets.

[[File:cw506_annotate1.png]]

== Connection Routing ==

The following shows the routing of various connections on the breakout board:

[[File:cw506_route.png]]

=== Voltage Translation ===

The voltage translation is done with three different parts:

* SN74LVC1T45DBVT for high-speed clock lines (unidirectional, approx 200 Mbps max speed, 1.65V - 5.5V)
* PI4ULS5V201TAEX for GPIO1/2 (bidirectional, approx 20 Mbps max speed, 1.2V - 5.5V)
* GTL2003PW for GPIO2/3 + Others (bidirectional, 1.0V - 5.5V)

Note the clock translators limit lower operating voltage, if not using HS1 or HS2 you can safely use this board down to 1.2V. The maximum speed of the voltage translators varies with different output voltages, see datasheet for details.

The VCCIO net on the board defines what logic level the target (i.e., the signals on the jumpers and headers on the right side of the board) section operates at. There is a vertical double-line on the breakout board, everything on the right side of the double-line operates at VCC-IO levels.

=== SW4 (Target Disconnect) ===

A DIP switch can be used to disconnect certain pins of the 20-pin header. The DIP switch has small text marked "ON", when the DIP switch is moved to this position the 20-pin connector is ENABLED.

The following shows an example where we've disconnected GPIO4 (the trigger) from our target device, and am feeding an external trigger in with the header (JP4) to the left of the DIP switch. This new trigger signal will be routed to the attached ChipWhisperer, and can be used instead of the trigger coming from the target device. Notice the DIP switch for TIO4 (GPIO4/IO4) is set to the LEFT, and the rest are set to the RIGHT (ON).
[[File:Cw506_dip_nogpio4.jpg|none|Setting the DIP switch to the LEFT causes the 20-pin target to be disconnected.|thumb|400x400px]]The following summarizes the connection for different SW4 settings. Note the 20-pin connector and the test-points to the right of that connector (marked TIO1, TIO2, TIO3, TIO4) are the only things disconnected.
{| class="wikitable"
!
!scope="row" colspan="2"|3.3V Logic
!scope="row" colspan="5"|VCC-IO Logic
|-
!SW4 Setting
!JP1 (Left 20-Pin)
!JP3
!JP4
!JP5/JP6
!JP2 (Right 20-Pin)
!TIO1-TIO4 Test Points
!TP7/TP8, SMA Connectors
|-
|OFF
|TIO1-TIO4
|☑
|☑
|
|
|
|
|-
|ON
|TIO1-TIO4
|☑
|☑
|
|☑
|☑
|
|- style="background-color: white;"
|OFF
|HS1-HS2
|☑
|
|
|
|
|☑
|- style="background-color: white;"
|ON
|HS1-HS2
|☑
|
|
|☑
|
|☑
|-
|?
|SPI/PDI/Other
|☑
|
|☑
|☑
|
|
|}

=== VCC-IO Settings ===

The VCC-IO level defines what voltage the inputs/outputs on the RIGHT side operate at (the target side). The inputs/outputs on the LEFT side (the ChipWhisperer capture side) are always 3.3V.

The VCC-IO level can be set to one of:

* Fixed 3.3V.
* Based on voltage on VREF pin of JP2 (20-pin target connector).
* Based on external voltage reference.

The current VCC-IO voltage is available on test point TP11 (just beside the 3 LEDs).

==== Normal Usage ====

Normally you would use either "JP2.VREF" or "+3V3". All NewAE target boards will provide a signal on JP2.VREF which indicates the correct translation voltage. If using a simple breakout or your own target board, you may just wish to force use of 3.3V IO voltages however.

These settings are configured with switch SW1 and SW2. In addition, three LEDs will confirm your setting. For example here the board is set to output 3.3V reference signals:

[[File:cw506_vccio.jpg|400px]]

==== Using External VREF ====

The final setting allows you to use the banana jack (BJACK) or test point TP9 as the voltage reference. This allows usage of an external lab supply for setting the output signal level to any supported level.

If using the BJACK feature, be sure to check switch SW3 is set in the correct position. The BJACK can also be used to provide the 3.3V rail for the target device.

=== JP2.+3v3 Settings ===

The 20-pin target connector (JP2) has two power supplies: a +5.0V signal, and a +3.3V signal. Normally these signals would come from a power supply in the ChipWhisperer-Capture target board (on JP1).

However if using the breakout board stand-alone, these will not be present. Switch SW3 allows you to route an external power supply onto the +3.3V power supply pins of JP2, allowing you to power a target expecting this supply voltage. This can also be used to power a target that draws more current than the ChipWhisperer-Capture hardware can provide.

Note it's possible but not recommended to also use this feature to adjust the supply voltage of the target (i.e., experiment running the target at 2.5V or 5.0V). The 3.3V supply may power 3.3V-only logic on the target board.

Setting SW3 to the LEFT position will drive the 3.3V power supply on the target board from the banana jack connector, which also connect to test point TP9 (the large red test point).

== XMEGA Programming & Pull Up Resitors ==

If you want to program an XMEGA target through the CW506, you'll have to place a pull up resistor on your UFO Board. Connecting a 330 Ohm resistor between the VREF and PDIC pin should allow you to use the XMEGA programmer.

There is a known issue where GPIO3/4 do not reach VREF/VCCIO. Usually this does not cause problems. In some cases though, the high level voltage will be too close to its threshold to provide reliable performance. In this case a 330 Ohm pull up resistor between VREF and the affected pin should resolve the issue

== Use Cases ==

=== Probing Target Board Signals ===

=== Using Target Board Stand-Alone ===

=== Inserting External Equipment into Test Path ===

== Schematic ==

The schematic is available in two formats - PDF and schematic images. Click the images for full resolution.

* [[:File:NAE-CW506-02-SCH.pdf|Schematic PDF (NAE-CW506-02: June 1st, 2016)]]

[[File:NAE-CW506-02_page1.png|600px]]

[[File:NAE-CW506-02_page2.png|600px]]

{{Template:Hardware}}

CW308T-D2000

2018-02-16T20:12:55Z

Cwiesner: /* How to flash D2000 board using OpenOCD */

{{Infobox cw308target
|name = CW308T-D2000
|image = d2000_topdown.jpg
|caption =
|Target Device = Intel Quark D2000
|Target Architecture = x86
|Hardware Crypto = No
|Purchase Hardware =
|Design Files = [https://github.com/newaetech/chipwhisperer/tree/master/hardware/victims/cw308_ufo_target/d2000 GITHub link]

[https://oshpark.com/shared_projects/HOs4WL4l OSH Park PCBs]

|Supported Applications =
}}

[[File:d2000_topdown.jpg|400px]]

The D2000 target is a bit of an oddball. It's an x86 target, but is really a microcontroller (internal flash etc).

== Using Board ==

The CW308T-D2000 is used similar to any other CW308 Target Board. It does not accept an external oscillator, instead it outputs it's own oscillator for you to synchronize to. Specific caveats here:

== Programming ==

An external programmer is needed for this target. The Quark D2000 dev-board can be used with jumper wires, or a standard OpenOCD programmer can be used. The suggested programmer is the [https://mouser.com/ProductDetail/Olimex-Ltd/ARM-USB-OCD-H Olimex ARM-USB-OCD-H] as is available from suppliers such as Mouser and Digi-Key (mouser link provided).

=== How to flash D2000 board using OpenOCD ===

We'll modify the provided scripts from the Intel ISSM distribution (compiler etc for D2000). Start a Windows command prompt and run the following commands. You may have to change the directory of the first command to match your version of Intel ISSM (eg. C:\IntelSWTools\ISSM_2016.0.027\issm_env.bat):

C:\IntelSWTools\ISSM_2016.2.097\issm_env.bat
cd %ISSM_DEBUGGER_ROOT%\openocd
bin\openocd.exe -f scripts\interface\ftdi\olimex-arm-usb-ocd-h.cfg -f scripts\board\quark_d2000.cfg

Note we specify two script files - the first had the JTAG connection (the olimex-arm-usb-ocd-h.cfg), the second had the D2000. This should result in an output like the following:

Open On-Chip Debugger 0.8.0-dev-g7845893 (2015-11-26-18:12)
Licensed under GNU GPL v2
For bug reports, read
http://openocd.sourceforge.net/doc/doxygen/bugs.html
Info : only one transport option; autoselect 'jtag'
adapter speed: 1000 kHz
trst_only separate trst_push_pull
flash_rom
Info : clock speed 1000 kHz
Info : JTAG tap: quark_d2000.cltap tap/device found: 0x0e786013 (mfg: 0x009, part: 0xe786, ver: 0x0)
Enabling lmt core tap
Info : JTAG tap: quark_d2000.lmt enabled

At this point it will hold, waiting for new commands. There is two ways to proceed:

==== Connecting with GDB ====

Connecting and programming with GDB may be preferred if you wish to also do any debug. It however is more limited in what commands you can run. If this does not work see the next section about using telnet commands. Open a second command prompt, and run:

C:\IntelSWTools\ISSM_2016.0.027\issm_env.bat
gdb

You can then run the following within a GDB console:

target remote :3333
monitor clk32M 125
monitor load_image C:\\chipwhisperer\\hardware\\victims\\firmware\\intel_quark\\quark_d2000_rom.bin 0x0
monitor load_image C:\\chipwhisperer\\hardware\\victims\\firmware\\intel_quark\\simpleserial_example\\release\\quark_d2000\\x86\\bin\\simpleserial_aes.bin 0x00180000

The first load_image is used for the ROM image. This should only be done once - do not reload every time, only reload the application. The boards as shipped come with a ROM image so you can skip that step if using the NewAE example code.

Notes:

# The <code>monitor clk32M 125</code> sets a 125 kHz JTAG clock frequency. This may be too slow, but is recommended especially when loading ROM due to potential for misprogramming on the target board due to the shunt resistor. Note it takes a long time (~60 seconds) to program the ROM code so don't abort it!
# If the above fails, see the next note on recovering normal settings with the telnet interface.
# You can short F13 (GPIO1 on the ChipWhisperer-Lite) to GND to force the JTAG pins on. It is suggested to do this via the ChipWhisperer-Lite software (setting it as a GPIO output and then setting it low). This requires the 'ROM' code programmed in already.
# Do not reload the ROM code unless needed -- this is the boot code and if something gets corrupt it can brick the device.

==== Connecting with Telnet to Monitor ====

When running the <code>target remote :3333</code> or other commands above, you may encounter errors that seem fatal. Do not fret, you can likely recover everything using another mode. To do so:

# Power cycle the target board, and re-run the openocd command previously specified (assuming you have encountered errors and the system is in an unknown state).
# If this fails, set GPIO1 to LOW, and power cycle the target. Try connecting again.

Assuming the connect works, open a second command prompt and run

telnet localhost 4444

Note the port connected to is 4444 (not :3333) as before. This now enters the monitor directly, and you can try running the following commands:

reset halt
set QUARK_D2000_OTPC_DATA_WRITE_ENABLED 1
mass_erase
clk32M 100
load_image C:\\chipwhisperer\\hardware\\victims\\firmware\\intel_quark\\quark_d2000_rom.bin 0x0
load_image C:\\chipwhisperer\\hardware\\victims\\firmware\\intel_quark\\simpleserial_example\\release\\quark_d2000\\x86\\bin\\simpleserial_aes.bin 0x00180000

The following should be the example output of these commands:

> reset halt
JTAG tap: quark_d2000.cltap tap/device found: 0x0e786013 (mfg: 0x009, part: 0xe786, ver: 0x0)
Enabling lmt core tap
JTAG tap: quark_d2000.lmt enabled
target state: halted
target halted due to debug-request at 0x0000ffff in real mode
target state: halted
target halted due to debug-request at 0x0000fff0 in real mode
> set QUARK_D2000_OTPC_DATA_WRITE_ENABLED 1
1
> mass_erase
Deleting OTPC, OTPD and FLASH regions
0xb0100014: 00000001
> clk32M 100
adapter speed: 3 kHz
adapter speed: 100 kHz
JTAG tap: quark_d2000.cltap tap/device found: 0x0e786013 (mfg: 0x009, part: 0xe786, ver: 0x0)
Enabling lmt core tap
JTAG tap: quark_d2000.lmt enabled
target state: halted
target halted due to debug-request at 0x0000fff0 in real mode
> load_image C:\\chipwhisperer\\hardware\\victims\\firmware\\intel_quark\\quark_d2000_rom.bin 0x0
....8192 bytes written at address 0x00000000
downloaded 8192 bytes in 66.997505s (0.119 KiB/s)
> load_image C:\\chipwhisperer\\hardware\\victims\\firmware\\intel_quark\\simpleserial_example\\release\\quark_d2000\\x8
.2872 bytes written at address 0x00180000
downloaded 2872 bytes in 42.280869s (0.066 KiB/s)

Note you can try the following if still having trouble:

# Use a slower JTAG clock speed.
# Short the SHUNTH/SHUNTL pins.

== Schematic ==

See GIT Repo for PDF of schematic.

[[File:CW308T-D2000-02_schematic.png|1000px]]

== Board Layout ==

See GIT Repo for gerber files.

{{Template:Hardware}}
[[Category:CW308 Targets]]

CW308T-STM32F/ChipWhisperer Bootloader

2018-02-15T21:10:44Z

Cwiesner: /* Rev -02 Boards */

The STM32Fx devices have a built-in bootloader, and the ChipWhisperer software as of 3.5.2 includes support for this bootloader.

Important notes before we begin:
* You MUST setup a clock and the serial lines for the chip. This is easily done by selecting a start-up script such as the "AES SimpleSerial on XMEGA" startup script.
* On the STM32F1, you MUST adjust the clock frequency to by 8MHz. The bootloader does not work with our usual 7.37 MHz clock frequency.

To access the bootloader you can perform these steps. They vary based on if you have a "Rev 02" board or a "Rev 03 or Later" board. The revision number is printed on the bottom side as part of the PCB part number (STM32F-03 is Rev -03 for example).

== Rev -03 or Later ==

# Select the "Serial STM32F Programmer"
#: [[File:arm_programmer.png]]
# Select the hex-file and press the "Program/Verify" button.
# The device should program, it may take a moment to fully program/verify on larger devices:
#: [[File:arm_programmed.png]]

{{Warningbox|If you get verify errors, it's possible the shunt resistor is causing power to dip too low. This can be solved by mounting a jumper between the "SH-" and "SH+" pins at J16 (to the left of the SMA connector) on the UFO board. Retry programming with the jumper mounted. }}

== Rev -02 Boards ==

The Rev -02 boards did not have all programming connections present. They require some additional steps:

# Select the "Serial STM32F Programmer"
#: [[File:arm_programmer.png]]
# Mount a jumper between the H1 and PDIC pins (again this is ONLY for the -02 rev).
#: [[File:STMF32F-02 programmer jumper.jpg|400px]]
# Reset the ARM device either by pressing the reset button (newer UFO boards only), or by toggling power:
#: [[File:arm_togglepower.png]]
# Select the hex-file and press the "Program/Verify" button.
# The device should program, it may take a moment to fully program/verify on larger devices:
#: [[File:arm_programmed.png]]
# Remove the jumper between the H1/H2 pins.
# Reset the ARM device either by pressing the reset button (newer UFO boards only), or by toggling power:
#: [[File:arm_togglepower.png]]

{{Warningbox|If you get verify errors, it's possible the shunt resistor is causing power to dip too low. This can be solved by mounting a jumper between the "SH-" and "SH+" pins at J16 (to the left of the SMA connector) on the UFO board. Retry programming with the jumper mounted. }}

File:STMF32F-02 programmer jumper.jpg

2018-02-15T21:08:03Z

Cwiesner: File uploaded with MsUpload

File uploaded with MsUpload

CW308T-S6LX9

2018-02-15T18:45:13Z

Cwiesner: /* Programming */

{{Infobox cw308target
|name = CW308T-S6LX9
|image = File:S6LX9-Top.jpg
|caption =
|Target Device = Spartan 6 LX9
|Target Architecture = FPGA
|Hardware Crypto = No
|Purchase Hardware = [http://store.newae.com/spartan-6-lx9-fpga-target-for-cw308/ Webstore]
|Design Files = [https://github.com/newaetech/chipwhisperer/tree/master/hardware/victims/cw308_ufo_target/spartan6lx9 GITHub link]

[https://oshpark.com/shared_projects/ECbBlx58 OSH Park PCBs]
|Supported Applications = [[SimpleSerial | Simple Serial Enc]]
|Programmer = Xilinx JTAG
|Status = Released
}}

The S6LX9 target is a low-cost FPGA target. It uses the Xilinx Spartan 6 in TQFP package (XC6SLX9-2TQG144C), and can fit an entire AES core. The example project includes the Simple-Serial interface which allows it to function like any of our other example targets.

== Usage ==

The board includes a single red LED (D1) which is connected to the FPGA "DONE" pin. This pin will be HIGH (and the LED on) when the FPGA is NOT programmed. That is to say immediately on power-on, the LED will be on. Once the FPGA is successfully programmed this LED will go out.

The FPGA pins are connected to the various headers on the board. The JTAG header connects to the FPGA JTAG pins. The "Hx" pins, USART, and SPI connect to arbitrary FPGA pins.

'''NB: You MUST enable the 1.2V regulator when using this board. The 1.2V power LED should be ON. This is easily done by toggling the position of the 1.2V LDO switch (to either come from the 3.3V from CW-Lite, or external power depending on your setup).
'''

== Example Project ==

The GIT repo includes an example Xilinx ISE project, located at [https://github.com/newaetech/chipwhisperer/tree/develop/hardware/victims/cw308_ufo_target/spartan6lx9/ss_aes_ise hardware/victims/cw308_ufo_target/spartan6lx9/ss_aes_ise]. To use this project:

# Build the bitstream (or see the pre-built one in the repo at [https://github.com/newaetech/chipwhisperer/raw/develop/hardware/victims/cw308_ufo_target/spartan6lx9/ss_aes_ise/cw308t_s6lx9_example.bit cw308t_s6lx9_example.bit])
# Use settings as in the 'Default XMEGA' or 'STM32Fx' targets (i.e., clock jumpers, etc).
# Ensure you have turned on the 1.2V & 3.3V power supplies to the UFO target.
# Program the bitstream into the FPGA using a programming tool such as Xilinx Impact + USB Programmer cable.
# Run the 'XMEGA Simple-Serial' script in ChipWhisperer-Capture. This will setup clocks, serial data format, etc as expected.
# Adjust the trigger offset settings - they should be changed to around ~750, and you can reduce the number of data points to ~128.

The waveform should look something like this:

[[File:s6lx9_waveform.png|400px]]

{{Warningbox|There appears to be occasional jitter on the default AES core, so you might need to use re-synchronization on the power traces. See the [https://github.com/newaetech/chipwhisperer/issues/72 GITHub issue track].}}

== Known Issues ==

Note the -02 Revision of the PCB has swapped the markings of the CLKIN/CLKOUT. The correct pinout is:

* CLKIN connects to P84
* CLKOUT connects to P85

The CLKIN pin is a _N clock pin. If you need the _P clock pin, you can use a jumper on the CW308 board to route the clock input into the CLKOUT pin.

== Programming ==

The ChipWhisperer will eventually support programming this target. Until then, you will need an external programmer. This is connected via JTAG to the pin headers:

[[File:s6lx9_jtag.jpg|400px]]

Options for programmers include:

* Xilinx Platform Cable USB or USB-II (Digikey/Mouser).
* Clone JTAG programmers off AliExpress/E-Bay for low cost (search 'Xilinx JTAG').
* Digilent Inc HS1/HS2/HS3 Cables (NB: you may need separate jumper wires).

To use IMPACT:

* Generate a new project.
* Assign the .bit file to the FPGA (say 'no' to attached SPI flash chips).
* Program.

[[File:s6lx9_program.png|400px]]

== Schematic ==

See GIT Repo for PDF of schematic.

[[File:CW308T_S6LX9_Schematic_Page_1.png|1000px]]

[[File:CW308T_S6LX9_Schematic_Page_2.png|1000px]]

[[File:CW308T_S6LX9_Schematic_Page_3.png|1000px]]

== Board Layout ==

See GIT Repo for gerber files.

{{Template:Hardware}}
[[Category: CW308 Targets]]

File:S6lx9 jtag.jpg

2018-02-15T18:37:45Z

Cwiesner: Cwiesner uploaded a new version of File:S6lx9 jtag.jpg

File uploaded with MsUpload

File:S6lx9 jtag.jpg

2018-02-15T18:36:10Z

Cwiesner: File uploaded with MsUpload

File uploaded with MsUpload