CW308T-87C51 - Revision history

Coflynn: Replaced content with "== Page Moved == See [https://rtfm.newae.com/Targets/UFO%20Targets/CW308T-87C51/ NewAE RTFM Page] which is now built from the [https://github.com/newaetech/chipwhisperer-..."

2020-07-29T19:30:14Z

Replaced content with "== Page Moved == See [https://rtfm.newae.com/Targets/UFO%20Targets/CW308T-87C51/ NewAE RTFM Page] which is now built from the [https://github.com/newaetech/chipwhisperer-..."

Show changes

Fheubach at 18:18, 1 May 2018

2018-05-01T18:18:35Z

Fheubach at 14:35, 1 May 2018

2018-05-01T14:35:50Z

Coflynn at 00:08, 1 February 2018

2018-02-01T00:08:23Z

Coflynn: /* Hardware Details */

2017-04-07T19:41:23Z

‎Hardware Details

Coflynn at 19:38, 7 April 2017

2017-04-07T19:38:25Z

Coflynn at 19:38, 7 April 2017

2017-04-07T19:38:00Z

Coflynn at 15:57, 2 April 2017

2017-04-02T15:57:19Z

Coflynn at 19:35, 26 March 2017

2017-03-26T19:35:44Z

Coflynn at 17:34, 25 March 2017

2017-03-25T17:34:26Z

@@ Line 237: / Line 237: @@
 The 87C51 has a synchronous reset input (?!) - a reset requires 12 oscillator cycles to take effect, and the machine clock's phase does not change during a reset! This means that the only way to change the machine clock's phase is to power cycle the 87C51. (The "Read Signature" button in the AVR Programmer does this. Pulling out the processor and re-mounting it does too.)
 {{Template:Hardware}}
 [[Category: CW308 Targets]]

@@ Line 18: / Line 18: @@
 This page describes the setup of the 87C51 target and shows how it can be used to perform these two types of attacks.
-= Hardware Details =
+== Hardware Details ==
-== Programming Microcontroller ==
+=== Programming Microcontroller ===
 The target board contains an ATMega165PA/ATMega325PA (referred to as the 'AVR' hereafter), which can be used for performing program verification. It is also used to generate trigger points for attacks such as encryption table read-out & inserting glitches into the program read logic. The programming interface contains the following limitations:
@@ Line 25: / Line 25: @@
 * Address lines A0 - A13 are mapped to the AVR. The upper two lines are shared with LED1/LED2 outputs. (A14 and A15 aren't needed because the 87C51 model that's used only has 16 KB = 2^14 bytes of memory.)
-== Target Microcontroller ==
+=== Target Microcontroller ===
 The default target device is an Intel EE87C51RB1 (16K EPROM, 512 RAM). Useful references:
@@ Line 37: / Line 37: @@
 '''NOTE:''' The 87C51 devices are either EPROM memories. Some may have a UV window but some don't, those without the UV window are OTP devices. You may wish to use a 89C51 device instead in some cases. See note below about 89C51 devices.
-=== Using 89C51 Devices ===
+==== Using 89C51 Devices ====
 The 89C51 devices are also possible to be used with this board, which can be more easily reprogrammed. The 89C51 devices do not normally have the "XOR encryption table" however, so you cannot attempt attacks on that encryption table.
-== Jumpers ==
+=== Jumpers ===
 A number of jumpers are present on the target board. They are mostly used to select different features and options on the target board. First, there are 7 jumpers that connect to the IO lines of the two microcontrollers
@@ Line 59: / Line 59: @@
 Finally, the baseboard's "Target-Defined Programming" header (J15) is connected to some of the 8051 pins. P3.3, P3.4, and P3.5 are connected to H2, H4, and H6. Normally, these pins are all pulled down to ground (logic 0). When a jumper is mounted to H1-H2, H3-H4, or H5-H6, these pins are instead connected to VCC (logic 1).
-= AVR Firmware =
+== AVR Firmware ==
 The AVR on the target board has its own firmware to control the 87C51 code verification process. This firmware is one Atmel Studio project in the Git repository. The compiled hex file can be programmed onto the AVR using the AVR Programmer in the capture software.
@@ Line 68: / Line 68: @@
 To program these, the AVR programmer will have to use Slow Clock Mode. Once these fuses are set, slow clock mode can be disabled again.
-= 87C51 Firmware =
+== 87C51 Firmware ==
-== Developing Firmware for the 87C51 ==
+=== Developing Firmware for the 87C51 ===
 There are a number of tools that can be used to develop firmware for the 87C51 processor. The best 8051-specific software can be pretty expensive, but it is possible to get by with free software:
@@ Line 96: / Line 96: @@
 '''Programmer''': To write a program into the code EPROM, an EPROM programmer is needed. We used a [http://minipro.txt.si/index.php?title=Main_Page MiniPro TL866 programmer] along with their free software. However, any programmer compatible with the 87C51 should be fine.
-== Example Firmware ==
+=== Example Firmware ===
 We've written a couple of firmware examples and put them together into one big 87C51 project. Combining multiple pieces of code together means that we can use one chip for all of the side channel attacks - we don't need separate processors to work on different pieces of firmware. This project has six different parts:
 * <code>print</code>: prints "Testing 1\nTesting 2\nTesting 3...". Easy to confirm that the processor is running correctly.
@@ Line 154: / Line 154: @@
 |}
-= Code Verification =
+== Code Verification ==
-== Verification Process ==
+=== Verification Process ===
 The process to read back code from the 87C51's EPROM memory is described in the NXP datasheet (in the EPROM Characteristics section). However, there's a lot of info in this section about ''writing'' to the EPROM memory, which we can't do on the target board. The bare minimum to verify code bytes is repeated here:
@@ Line 214: / Line 214: @@
 . Write P2.7 to 1 to stop reading the device.
-== Security ==
+=== Security ===
 There are two security features built into the 87C51 to stop end-users from reading the firmware out of EPROM. Companies might use these features as an anti-piracy measure: if they can keep their competitors from reading their source code, then they can avoid giving away any of their trade secrets. Both of these security features can be enabled using the Minipro programmer.
@@ Line 229: / Line 229: @@
 The most critical of these locks is the second: it stops all verification.
-== Gotchas ==
+=== Gotchas ===
 This section describes a few quirks/caveats that we found with the 87C51 and its target board.

@@ Line 7: / Line 7: @@
 |Hardware Crypto        = No
 |Purchase Hardware      =
-|Design Files           = [https://github.com/newaetech/chipwhisperer/tree/master/hardware/victims/cw308_ufo_target/87c51 GITHub Link]
+|Design Files           = [https://github.com/newaetech/chipwhisperer/tree/develop/hardware/victims/cw308_ufo_target/87c51 GITHub Link]
 [https://oshpark.com/shared_projects/i31Y8CLo OSH Park PCBs]

← Older revision		Revision as of 19:41, 7 April 2017
Line 34:		Line 34:

	There are 2 20-pin headers on the top side of the board connected to the pins of the 87C51. If you're keeping track, the remaining 4 pins are labelled NC - they aren't used internally, so all of the functional pins are broken out to these headers. These headers make it easier to connect an oscilloscope or logic analyzer to the target.		There are 2 20-pin headers on the top side of the board connected to the pins of the 87C51. If you're keeping track, the remaining 4 pins are labelled NC - they aren't used internally, so all of the functional pins are broken out to these headers. These headers make it easier to connect an oscilloscope or logic analyzer to the target.
		+
		+	'''NOTE:''' The 87C51 devices are either EPROM memories. Some may have a UV window but some don't, those without the UV window are OTP devices. You may wish to use a 89C51 device instead in some cases. See note below about 89C51 devices.
		+
		+	=== Using 89C51 Devices ===
		+
		+	The 89C51 devices are also possible to be used with this board, which can be more easily reprogrammed. The 89C51 devices do not normally have the "XOR encryption table" however, so you cannot attempt attacks on that encryption table.

	== Jumpers ==		== Jumpers ==

@@ Line 5: / Line 5: @@
 |Target Device          = 8xC51
 |Target Architecture    = 8-bit 8051
-|Hardware Crypto        = Possible
+|Hardware Crypto        = No
 |Purchase Hardware      =
 |Design Files           = [https://github.com/newaetech/chipwhisperer/tree/master/hardware/victims/cw308_ufo_target/87c51 GITHub Link]

@@ Line 1: / Line 1: @@
 {{Infobox cw308target
 |name                   = CW308T-87C51
-|image                  =
+|image                  = 87C51-top.JPG
 |caption                =
 |Target Device          = 8xC51

@@ Line 11: / Line 11: @@
 |Purchase Hardware      =
 |Design Files           = [https://github.com/newaetech/chipwhisperer/tree/master/hardware/victims/cw308_ufo_target/87c51 GITHub Link]
-[https://oshpark.com/shared_projects/i31Y8CLo Order PCB from OSHPark]
 |Supported Applications =
 }}

← Older revision		Revision as of 19:35, 26 March 2017
Line 235:		Line 235:

	{{Template:Hardware}}		{{Template:Hardware}}
−	~~[[Category: Hardware]]~~
−	~~[[Category: Targets]~~
	[[Category: CW308 Targets]]		[[Category: CW308 Targets]]

← Older revision		Revision as of 17:34, 25 March 2017
Line 1:		Line 1:
	{{Warningbox\|This is a BETA target and not yet available. This wiki page will continue to be updated until release. }}		{{Warningbox\|This is a BETA target and not yet available. This wiki page will continue to be updated until release. }}

		+
		+	{{Infobox cw308target
		+	\|name = CW308T-87C51
		+	\|image =
		+	\|caption =
		+	\|Target Device = 8xC51
		+	\|Target Architecture = 8-bit 8051
		+	\|Hardware Crypto = Possible
		+	\|Purchase Hardware =
		+	\|Design Files = [https://github.com/newaetech/chipwhisperer/tree/master/hardware/victims/cw308_ufo_target/87c51 GITHub Link]
		+	[https://oshpark.com/shared_projects/i31Y8CLo Order PCB from OSHPark]
		+	\|Supported Applications =
		+	}}

	The 87C51 target is designed for a line of 8051 processors made by Intel in PLCC44 package, although other manufactures make equivalent devices as well (notably NXP as well). This target board allows for two types of side channel attacks:		The 87C51 target is designed for a line of 8051 processors made by Intel in PLCC44 package, although other manufactures make equivalent devices as well (notably NXP as well). This target board allows for two types of side channel attacks: