Tutorial A3 VCC Glitch Attacks - Revision history

Adewar at 13:31, 29 July 2019

2019-07-29T13:31:52Z

Show changes

Adewar at 13:30, 29 July 2019

2019-07-29T13:30:10Z

Fheubach at 18:49, 1 May 2018

2018-05-01T18:49:12Z

Fheubach: General -> Generic

2018-04-12T16:52:40Z

General -> Generic

Fheubach: Added glitch vary aux module picture and list item

2018-04-12T16:50:56Z

Added glitch vary aux module picture and list item

Fheubach: Changed r$GLITCH$\n to $GLITCH$ and updated the picture

2018-04-12T16:45:05Z

Changed r$GLITCH$\n to $GLITCH$ and updated the picture

Fheubach: Addition of aux settings tab

2018-04-12T16:39:49Z

Addition of aux settings tab

Fheubach: changed size of xmega programmer pictures

2018-04-12T16:29:00Z

changed size of xmega programmer pictures

Fheubach: Addition of the ge_widthoffset_vary.py script to the files

2018-04-12T16:24:50Z

Addition of the ge_widthoffset_vary.py script to the files

Fheubach: finished first draft of cw4.0 updated tutorial

2018-04-12T15:21:08Z

finished first draft of cw4.0 updated tutorial

← Older revision		Revision as of 13:30, 29 July 2019
Line 1:		Line 1:
	{{Warningbox\|For the older V3.x tools, see [[V3:Tutorial A3 VCC Glitch Attacks]]}}		{{Warningbox\|For the older V3.x tools, see [[V3:Tutorial A3 VCC Glitch Attacks]]}}
		+
		+	{{Infobox tutorial
		+	\|name = A3: VCC Glitch Attacks
		+	\|image =
		+	\|caption =
		+	\|software versions =
		+	\|capture hardware = CW-Lite, CW-Lite 2-Part, CW-Pro
		+	\|Target Device =
		+	\|Target Architecture = XMEGA/Arm/Other
		+	\|Hardware Crypto = No
		+	\|Purchase Hardware =
		+	}}

	This advanced tutorial will demonstrate power glitch attacks using the ChipWhisperer system.		This advanced tutorial will demonstrate power glitch attacks using the ChipWhisperer system.

@@ Line 387: / Line 387: @@
 <p>The following shows an example of inserting several glitches successfully:</p>
 <p>[[File:rpi-glitch.png|image]]</p></li></ol>
 {{Template:Tutorials}}
 [[Category:Tutorials]]

@@ Line 280: / Line 280: @@
   </li>
   <li>
-   <p>On the ''General Settings'' tab:</p>
+   <p>On the ''Generic Settings'' tab:</p>
    <blockquote>
     <ol style="list-style-type: lower-alpha;">

@@ Line 275: / Line 275: @@
    </syntaxhighlight>
   </li>
+ <li>
   <li>
    <p>On the ''General Settings'' tab:</p>

@@ Line 111: / Line 111: @@
   <li>
    <p> Navigate to the ''Target Settings'' tab and remove all the text in the ''Load Key Command'', ''Go Command'', and ''Output Format'' fields</p>
-   <p> Set the ''Output Format'' field to ''r$GLITCH$\n''</p>
+   <p> Set the ''Output Format'' field to ''$GLITCH$''</p>
    <p>[[File:target_output_setting.png|500px]]</p>
   </li>

@@ Line 91: / Line 91: @@
    <p>Time to setup the voltage glitching parameters. Start with the ''Glitch Module'' section under the ''Scope Settings'' tab</p>
    <ol>
     <li>
      <p>Set the ''Clock Source'' as ''CLKGEN'':</p>
@@ Line 109: / Line 106: @@
   <li>
    <p>Now activate the lower power glitch module, by enabling the ''HS-Glitch Out Enable (Low Power)'' toggle under ''Trigger Pins'' section in the ''Scope Settings'' tab</p>
    <p>[[File:low_power_glitch_enable.png|500px]]</p>
   </li>
@@ Line 155: / Line 153: @@
    </syntaxhighlight>
   </li>
 </ol>

@@ Line 82: / Line 82: @@
   <li>
    <p>Open the appropriate programmer from top main menu ''Tools'', and in the dialog press ''Check Signature'' to verify you can connect to the target</p>
-   <p>[[File:xmega_programmer.png|300px]]</p>
+   <p>[[File:xmega_programmer.png|325px]]</p>
   </li>
   <li>
    <p>Find the correct firmware file, previously compiled for the target you are using, and press the ''Erase/Program/Verify FLASH''</p>
-   <p>[[File:xmega_programmer_press_program.png|300px]]</p>
+   <p>[[File:xmega_programmer_press_program.png|325px]]</p>
   </li>
   <li>

@@ Line 154: / Line 154: @@
    </syntaxhighlight>
-<ol>
+ </li>
+</ol>
-Optionally, you can also configure the power measurement setup too:
 === Monitoring Glitch Insertion ===
@@ Line 205: / Line 204: @@
 False</pre>
    <p>Finally, configure the Glitch Explorer:</p>
 <blockquote><ol style="list-style-type: lower-alpha;">
-<li>Set the ''Normal Response'' to <code>s.endswith(&quot;hello\nA&quot;) and (len(s) &lt; 12)</code></li>
+  <blockquote>
-<li>Set the ''Successful Response'' to <code>&quot;1234&quot; in s</code></li></ol>
+   <ol style="list-style-type: lower-alpha;">
-</blockquote>
+    <li>Set the ''Normal Response'' to <code>s.endswith(&quot;hello\nA&quot;) and (len(s) &lt; 12)</code></li>
-<p>You can test the updated color-coding seems to be working too with a few ''Capture 1'' events.</p></li>
+    <li>Set the ''Successful Response'' to <code>&quot;1234&quot; in s</code></li>
-<li><p>Using the following table, set the ''Glitch Width (as % of period)'' and ''Repeat'' on the ''Scope Settings'' tab:</p>
+   </ol>
 {| class="wikitable"
 ! Parameter
@@ Line 221: / Line 227: @@
 | 10
 |}
-</li>
+ </li>
-<li>Finally, let's configure the Glitch Explorer to give us the required sweep of the ''Offset'' parameter.
+ <li>
-<ol style="list-style-type: lower-alpha;">
+  <p>Finally, let's configure the Glitch Explorer to sweep the ''Offset'' and ''Width'' parameters by running the <code>ge_widthoffset_vary.py</code>. The starting, stopping and step attributes can be changed for both parameters by editing the script</p>
-<li>Adjust the ''Glitch Offset (as % of period)'' up or down by 1 in the ''Glitch Module'' settings. We do this only to get the required string printed to the ''Script Commands'' output.</li>
+  <syntaxhighlight lang=python>
-<li>Set the ''Tuning Parameters'' to ''1'' in the Glitch Explorer.</li>
+"""Glitch Explorer example to modify clock offset & width.
-<li><p>Set the parameters as appropriate:</p>
-{| class="wikitable"
+To use this be sure to set 'Output Format' as $GLITCH$ so data is passed through.
-! Option
+"""
-! Value
-|-
+class IterateGlitchWidthOffset(object):
-| Name
+    def __init__(self, ge_window):
-| Offset
+        self._starting_offset = -40
-|-
+        self._starting_width = -40
-| Script Command
+        self.ge_window = ge_window
-| ['Glitch Module', 'Glitch Offset (as % of period)']
-|-
+    def reset_glitch_to_default(self, scope, target, project):
-| Data Format
+        """ Set glitch settings to defaults. """
-| Float
+        self.offset = self._starting_offset
-|-
+        self.width = self._starting_width
-| Range
-| -49 : 49
+    def change_glitch_parameters(self, scope, target, project):
-|-
+        """ Example of simple glitch parameter modification function. """
-| Value
+        # This value is minimum clock offset/width increment
-| -49
+        scope.glitch.offset += 0.390624
-|-
-| Step
+        if scope.glitch.offset > 40:
-| 0.5
+            scope.glitch.offset = self._starting_offset
-|-
+            scope.glitch.width += 0.390624
-| Repeat
-| 1
+        if scope.glitch.width > 40:
-|}
+            scope.glitch.width = self._starting_width
-</li></ol>
-</li>
+        # Write data to scope
-<li><p>On the ''General Settings'' tab:</p>
+        #scope.glitch.width = self.width
-<blockquote><ol style="list-style-type: lower-alpha;">
+        #scope.glitch.offset = self.offset
 <li>Ensure the ''Trace Format'' is set to ''None'' (i.e., no traces will be written to disk).</li>
-<li>Set the ''Number of Traces'' to 200.</li></ol>
+        #You MUST tell the glitch explorer about the updated settings
-</blockquote></li>
+        if self.ge_window:
-<li>Press the ''Capture Multi'' button. You will get a warning as there is no trace writer, but can just hit ''Continue Anyway'', since we do not want to store traces to disk.</li>
+            self.ge_window.add_data("Glitch Width", scope.glitch.width)
-<li><p>Hopefully you will determine some useful parameters for glitching this target:</p>
+            self.ge_window.add_data("Glitch Offset",scope.glitch.offset)
 <blockquote><p>[[File:ge-success.png|image]]</p></blockquote></li>
-<li>Try reducing the ''Repeat'' parameter in the ''Glitch Module'' settings. See how few cycles you can glitch while still achieving a reliable glitch.</li></ol>
+glitch_iterator = IterateGlitchWidthOffset(self.glitch_explorer)
 Once you have the glitch parameter determined, you can work on trying to recreate some of the previous tutorials such as glitching passed the password prompt.

@@ Line 116: / Line 116: @@
    <p>[[File:target_output_setting.png|500px]]</p>
   </li>
-<ol>
+ <li>
-<li>Switch to the ''Aux Settings'' tab. Depending on your module you will see different settings here, for example the ChipWhisperer-Lite lets you select between AVR and XMEGA targets. This normally defaults to the &quot;XMEGA&quot; device, so be sure to switch this to the &quot;AVR&quot; device if using the NOTDuino or Multi-Target boards!</li>
+# GUI compatibility
-<li>Switch to the ''Target Settings'' tab, and </li></ol>
+try:
 Optionally, you can also configure the power measurement setup too:
@@ Line 129: / Line 163: @@
 <ol style="list-style-type: decimal;">
-<li>Switch to the ''Scope Settings'' tab.</li>
+ <li>Switch to the ''Scope Settings'' tab.</li>
-<li>Switch the ''ADC Clock Source'' as being ''CLKGEN x4''.</li>
+ <li>Switch the ''ADC Clock Source'' as being ''CLKGEN x4''.</li>
-<li>Press ''Reset ADC DCM'', confirm the frequency is 29.5 MHz as expected.</li>
+ <li>Press ''Reset ADC DCM'', confirm the frequency is 29.5 MHz as expected.</li>
-<li>Switch the ''Trigger Setup'' --&gt; ''Mode'' to be ''Rising Edge''</li>
+ <li>Switch the ''Trigger Setup'' --&gt; ''Mode'' to be ''Rising Edge''</li>
-<li>Switch the ''Trigger Setup'' --&gt; ''Total Samples'' to be ''1000''</li>
+ <li>Switch the ''Trigger Setup'' --&gt; ''Total Samples'' to be ''1000''</li>
-<li>Switch the ''Gain Setting'' --&gt; ''Setting'' to be ''40''. You might need to adjust this for different hardware.</li>
+ <li>Switch the ''Gain Setting'' --&gt; ''Setting'' to be ''40''. You might need to adjust this for different hardware.</li>
-<li><p>Press ''Capture 1'', confirm some waveform is displayed. For example with the NOTDuino Target on the ChipWhisperer-Lite, the waveform looks like this:</p>
+ <li>
-<p>[[File:waveform-notduino-normal.png|image]]</p></li>
+  <p>Press ''Capture 1'', confirm some waveform is displayed. For example with the NOTDuino Target on the ChipWhisperer-Lite, the waveform looks like this:</p>
-<li>If this does't work: check the trigger in use is the ''Target IO4'' pin.</li>
+  <p>[[File:waveform-notduino-normal.png|image]]</p>
-<li><p>Play around a bit with the glitch width, offset, and repeat. You should see different effects in the power consumption traces. For example the following shows a narrow (15% pulse width) glitch being inserted:</p>
+ </li>
-<p>[[File:waveform-notduino-glitch1.png|image]]</p></li></ol>
+ <li>If this does't work: check the trigger in use is the ''Target IO4'' pin.</li>
 === Starting the Glitch Attack ===
@@ Line 147: / Line 186: @@
 Rather than using the manual trigger, we'll jump right into using the Glitch Explorer to break this target. First, we'll setup some basic glitch parameters for your specific target.
-<ol style="list-style-type: decimal;">
+<ol>
-<li>Switch to the ''Target Settings'' tab, and set the ''Output Format'' to <code>$GLITCH$</code>.</li>
+ <li>Switch to the ''Target Settings'' tab, and set the ''Output Format'' to <code>$GLITCH$</code>.</li>
-<li><p>Open the ''Glitch Explorer'', and hit ''Capture 1'' a few times. Confirm this populates the table with various examples.</p>
+ <li>
-<p>[[File:ge-normal.png|image]]</p></li>
+  <p>Open the ''Glitch Explorer'', and hit ''Capture 1'' a few times. Confirm this populates the table with various examples.</p>
-<li><p>We need to setup the ''Normal Response'' and ''Successful Response''. Note in this example the normal response has a little random noise we want to ignore, but we want to capture when the device resets after the glitch and sends the &quot;hello&quot; message twice. We could accomplish this with the following bit of Python code:</p>
+  <p>[[File:ge-normal.png|image]]</p>
-<pre>s.endswith(&quot;hello\nA&quot;) and (len(s) &lt; 12)</pre>
+ </li>
-<p>This looks for both the ending without glitch, and the length of the string isn't too long. In the case of the successful glitch, we just want to see if &quot;1234&quot; is printed. This can be accomplished in Python with:</p>
+ <li>
-<pre>&quot;1234&quot; in s</pre>
+  <p>We need to setup the ''Normal Response'' and ''Successful Response''. Note in this example the normal response has a little random noise we want to ignore, but we want to capture when the device resets after the glitch and sends the &quot;hello&quot; message twice. We could accomplish this with the following bit of Python code:</p>
-<p>You can always experiment using the ''Python Console'' to see how your potential systems work. For example here is checking that the first line works:</p>
+  <pre>s.endswith(&quot;hello\nA&quot;) and (len(s) &lt; 12)</pre>
-<pre>&gt;&gt;&gt; s = &quot;\x1ahello\nA&quot;
+  <p>This looks for both the ending without glitch, and the length of the string isn't too long. In the case of the successful glitch, we just want to see if &quot;1234&quot; is printed. This can be accomplished in Python with:</p>
 &gt;&gt;&gt; s.endswith(&quot;hello\nA&quot;) and (len(s) &lt; 12)
 True
@@ Line 162: / Line 204: @@
 &gt;&gt;&gt; s.endswith(&quot;hello\nA&quot;) and (len(s) &lt; 12)
 False</pre>
-<p>Finally, configure the Glitch Explorer:</p>
+  <p>Finally, configure the Glitch Explorer:</p>
 <blockquote><ol style="list-style-type: lower-alpha;">
 <li>Set the ''Normal Response'' to <code>s.endswith(&quot;hello\nA&quot;) and (len(s) &lt; 12)</code></li>