|
|
| (23 intermediate revisions by 4 users not shown) |
| Line 1: |
Line 1: |
| − | The CW1200 (ChipWhisperer Pro) is an upgraded version of the ChipWhisperer Lite capture hardware. The Pro includes an FPGA with much more space than the Lite, allowing many new features to be added, including a larger sample buffer, streaming-mode captures, additional trigger methods, and a touchscreen interface. These features make it a high-end device suitable for laboratory use.
| + | == Page Moved == |
| | | | |
| − | Check out a [https://youtu.be/qS6JwX4SBOI sneak peek of the CW-Pro].
| + | See [https://rtfm.newae.com/Capture/ChipWhisperer-Pro/ NewAE RTFM Page]. The previous content on this wiki has been moved to the above link. See wiki history if you would like to view exact older versions of this page. |
| − | | + | |
| − | '''(TODO: picture of CW-Pro)'''
| + | |
| − | | + | |
| − | = Power Supply =
| + | |
| − | The ChipWhisperer Pro can only be powered through its 5 V jack. It cannot be powered through the USB port - internally, there are no connections to the USB port's 5 V rail. This limitation is primarily due to the high current draw of the Pro: while powering the touchscreen running and an external target, it would be easy to exceed the USB current limit, causing all sorts of issues.
| + | |
| − | | + | |
| − | To make this setup more flexible, the Pro ships with two power sources:
| + | |
| − | * A 5 V, 2.1 A power supply. This supply is suitable for a permanent bench setup.
| + | |
| − | * A USB-to-barrel jack cable. This solution is more portable: if you're travelling with a laptop, you can use a second USB port for power. A USB charger will also work here.
| + | |
| − | If you're using the USB power cable, it is recommended to use a separate power supply to power any external target boards.
| + | |
| − | | + | |
| − | = Basic Usage =
| + | |
| − | The basic features on the Pro are exactly the same as the ChipWhisperer Lite. This means that any scripts and tutorials made for the Lite will work on the Pro, too: the connectors and pinouts are exactly the same.
| + | |
| − | | + | |
| − | {{CollapsibleSection
| + | |
| − | |intro = == AVR Programmer ==
| + | |
| − | |content= CW1173_ChipWhisperer-Lite/AVR Programmer}}
| + | |
| − | | + | |
| − | {{CollapsibleSection
| + | |
| − | |intro = == XMEGA Programmer ==
| + | |
| − | |content= CW1173_ChipWhisperer-Lite/XMEGA Programmer}}
| + | |
| − | | + | |
| − | {{CollapsibleSection
| + | |
| − | |intro = == Using Glitch Port ==
| + | |
| − | |content= CW1173_ChipWhisperer-Lite/Glitch Port}}
| + | |
| − | | + | |
| − | {{CollapsibleSection
| + | |
| − | |intro = == Using Measure Port ==
| + | |
| − | |content= CW1173_ChipWhisperer-Lite/Measure Port}}
| + | |
| − | | + | |
| − | {{CollapsibleSection
| + | |
| − | |intro = == 20-Pin Connector ==
| + | |
| − | |content= CW1173_ChipWhisperer-Lite/20-Pin Connector}}
| + | |
| − | | + | |
| − | {{CollapsibleSection
| + | |
| − | |intro = == Upgrading SAM3U Firmware ==
| + | |
| − | |content= CW1173_ChipWhisperer-Lite/Upgrading SAM3U Firmware}}
| + | |
| − | | + | |
| − | = Advanced Features =
| + | |
| − | == Streaming Mode ==
| + | |
| − | The ChipWhisperer Pro has a streaming mode that allows extremely long captures as long as relatively low sampling rates are used. For example, this plot shows an exerpt from two traces with nearly 1 million samples:
| + | |
| − | | + | |
| − | '''TODO: add streaming example'''
| + | |
| − | | + | |
| − | This capture mode is useful for many types of attacks, including:
| + | |
| − | * Full captures of slow software AES libraries
| + | |
| − | * Power analysis on ECC
| + | |
| − | * Context switches on embedded operating systems
| + | |
| − | | + | |
| − | While streaming, the ChipWhisperer hardware sends ADC data back to the capture software while recording more samples (instead of waiting until the end of the capture). During this process, the ADC samples are sent back to the computer in packets of approximately 3000 samples at a time. As a block diagram, this looks like:
| + | |
| − | | + | |
| − | [[File:Cwpro-stream.PNG|800px]]
| + | |
| − | | + | |
| − | The main danger in streaming mode is that the FPGA's sample buffer can overflow if the PC doesn't request these packets quickly enough. In practice, the maximum transfer rate is around 10 Msamples/s, so the maximum ADC frequency is approximately 10 MHz in streaming mode. Trying to stream above this rate will usually cause data to be lost: the FPGA overwrites samples after the buffer is full, so it's impossible to recover these samples after overrunning the buffer.
| + | |
| − | | + | |
| − | On the software end, there are two things to watch for:
| + | |
| − | * Long captures from streaming mode (millions of points) may take several seconds to record. When working with these long captures, make sure the software's timeouts are long enough.
| + | |
| − | * Extremely long captures take a lot of memory. 64-bit Python is recommended if you plan on capturing many traces with millions of samples - you can hit the memory limit on 32-bit Python pretty quickly.
| + | |
| − | | + | |
| − | == Trigger Module ==
| + | |
| − | Unlike the ChipWhisperer-Lite, the Pro has three different trigger modes to help capture traces when it's difficult to get a concrete trigger signal. A block diagram of the trigger module is:
| + | |
| − | | + | |
| − | [[File:Cwpro-trigger.PNG|800px]]
| + | |
| − | | + | |
| − | The first two trigger modes use a combination of the trigger inputs - the four GPIO inputs and the auxiliary SMA input. In the Capture software, these five inputs can be enabled independently and combined in three methods (AND, OR, and NAND). This combined trigger signal is the input for the edge/level and I/O decode detectors. The last trigger mode looks directly at the power trace and does not use these trigger inputs.
| + | |
| − | | + | |
| − | === Edge/Level ===
| + | |
| − | The edge/level detector can trigger on four different events:
| + | |
| − | * Trigger input is low (0)
| + | |
| − | * Trigger input is high (1)
| + | |
| − | * Trigger input had a rising edge (0 -> 1)
| + | |
| − | * Trigger input had a falling edge (1 -> 0)
| + | |
| − | This mode is suitable when the target is using one of the GPIO pins as a trigger signal - if you have control over the target's source code, let it output a rising edge when the encryption or other operation begins.
| + | |
| − | | + | |
| − | === I/O Decoder ===
| + | |
| − | The I/O decoder examines the trigger signal, assumes that it is either UART or SPI traffic, and outputs a trigger signal when it detects a certain pattern on the line. In the capture software, the settings for this decoder are:
| + | |
| − | | + | |
| − | [[File:Cwpro-iodecoder.PNG]]
| + | |
| − | | + | |
| − | * '''Decode Type''': Which type of traffic is being captured in the trigger signal? Might be USART or SPI data.
| + | |
| − | * '''Trigger Data''': Which data are we searching for? This setting should be a list of bytes to be detected in order. For example, <code>['r', '0']</code> would detect the string "r0", and <code>[0x07]</code> would detect a bell character.
| + | |
| − | * '''Baud''': What baud rate does this line use? This needs to be set manually.
| + | |
| − | | + | |
| − | When using this trigger mode, target IO1/IO2 are probably the best inputs to use: these are normally the serial TX and RX lines. It's possible to enable either one of these to trigger on sending or receiving data, respectively.
| + | |
| − | | + | |
| − | === Sum of Absolute Differences (SAD) ===
| + | |
| − | Some targets don't have nice trigger signals to detect. Sad!
| + | |
| − | | + | |
| − | The Sum of Absolute Differences module has two 128 sample buffers. The FPGA stores the ADC's 128 most recent samples in one buffer and a fixed pattern in the other. Then, after every sample, it calculates
| + | |
| − | | + | |
| − | <math>
| + | |
| − | SAD
| + | |
| − | = \sum_{i=1}^{128} |x_{ADC,i} - x_{pattern,i}|
| + | |
| − | </math>
| + | |
| − | | + | |
| − | If this sum is below a fixed threshold, the output trigger signal will be set. This trigger module allows the ChipWhisperer to detect a specific pattern (for instance, an encryption operation) in a power trace without any other data.
| + | |
| − | | + | |
| − | The settings for the SAD module are:
| + | |
| − | | + | |
| − | [[File:Cwpro-sad.PNG]]
| + | |
| − | | + | |
| − | * '''Point Range''': The samples in the current trace to be used for the SAD module's fixed values. This range is forced to have a width of 128.
| + | |
| − | * '''Set SAD Reference from Current Trace''': Sets the fixed 128 samples to the current selection.
| + | |
| − | * '''SAD Reference vs. Cursor''': Shows the current output of the SAD calculation. Useful for setting the threshold - it's easy to capture a number of traces and check what typical values are for this SAD output.
| + | |
| − | * '''SAD Threshold''': The trigger point for the SAD module. A value of 0 indicates a perfect match. If this threshold is too low, noise will stop the trigger from appearing; if it's too high, the scope will trigger at random offsets.
| + | |
| − | | + | |
| − | Note that this SAD module does not play well with downsampling: the inputs to the SAD buffer are not downsampled. This means that downsampled traces cannot be used as a reference. If you want to use this trigger type, set up your SAD trigger with downsampling turned off first.
| + | |
| − | | + | |
| − | == SMA I/O ==
| + | |
| − | The Pro has an extra SMA connector intended to be used for additional trigger logic. It can be used either as a trigger input or output.
| + | |
| − | | + | |
| − | '''Input''': The Aux SMA trigger input can be used in the exact same manner as the other trigger inputs: the digital level is combined with the other active triggers (through an AND or OR gate) and this is used as the trigger signal. This is helpful for using other creative trigger signals. For example, if you have a custom target board, you could connect an FPGA output as an additional trigger signal. Alternatively, you could use a high-end oscilloscope's pattern detection as a trigger input.
| + | |
| − | | + | |
| − | '''Output''': When the trigger module produces a trigger signal, the ChipWhisperer can reproduce this signal on the Aux SMA. This allows an external oscilloscope to be used to capture traces alongside the ChipWhisperer.
| + | |
| − | | + | |
| − | = Touchscreen =
| + | |
| − | The touchscreen on the ChipWhisperer Pro shows various details about its status and current settings.
| + | |
| − | | + | |
| − | == Screen 1: Clock ==
| + | |
| − | The clock screen shows the status of the CLKGEN and ADC clocks along with the frequency counter.
| + | |
| − | | + | |
| − | '''TODO: picture'''
| + | |
| − | * '''CLKGEN''': Current frequency of CLKGEN clock in kHz
| + | |
| − | ** '''Source''': Input to CLKGEN DCM. Could be system clock or EXTCLK
| + | |
| − | ** '''DCM''': Lock status of CLKGEN DCM
| + | |
| − | ** '''Reset DCM''': Reset the CLKGEN output. Useful if clock has locked at the wrong frequency
| + | |
| − | * '''ADC Clock''': Current ADC sampling rate in kHz
| + | |
| − | ** '''Source''': Input to ADC DCM. Could be related to CLKGEN or EXTCLK
| + | |
| − | ** '''DCM''': Lock status of ADC DCM
| + | |
| − | ** '''Reset DCM''': Reset the ADC clock output
| + | |
| − | * '''Frequency Counter''': Current frequency measured by the frequency counter
| + | |
| − | ** '''Source''': Input to frequency counter. Could be either EXTCLK or CLKGEN
| + | |
| − | | + | |
| − | == Screen 2: Routing ==
| + | |
| − | The routing screen shows the status of the various I/O pins.
| + | |
| − | | + | |
| − | '''TODO: picture'''
| + | |
| − | * '''Aux Output''': Status of the aux SMA connections. Could be used as trigger input/output, glitch output, and/or clock output
| + | |
| − | * '''IO Pins''': Status of each of the IO pins on the 20 pin connector. Possible values depend on pin
| + | |
| − | * '''Target Power State''': Status of the 3.3 V output. Can be toggled here to reset target
| + | |
| − | * '''Target HS IO-Out''': Signal connected to high-speed output (HS2). Could be CLKGEN, glitch module, or disabled
| + | |
| − | | + | |
| − | == Screen 3: Trigger ==
| + | |
| − | The trigger screen shows the current settings for the trigger module.
| + | |
| − | | + | |
| − | '''TODO: picture'''
| + | |
| − | | + | |
| − | == Screen 4: Glitch ==
| + | |
| − | The glitch screen shows the current settings for the glitch module.
| + | |
| − | | + | |
| − | '''TODO: picture'''
| + | |
| − | | + | |
| − | | + | |
| − | - Pictures of screens
| + | |
| − | - Descriptions of displays
| + | |
| − | | + | |
| − | {{Template:Hardware}}
| + | |
