As of August 2020 the site you are on (wiki.newae.com) is deprecated, and content is now at rtfm.newae.com.

Difference between revisions of "CW308 UFO Target"

From ChipWhisperer Wiki
Jump to: navigation, search
(→‎I/O Connections)
(→‎I/O Connections: Update with 20pini cable)
Line 372: Line 372:
 
|-
 
|-
 
| 1
 
| 1
−
| +VUSB (5V)
+
| +5V
−
| O
+
| I
−
| Not Connected on ChipWhisperer-Lite.
+
| +5V from ChipWhisperer-Capture.
 
|-
 
|-
 
| 2
 
| 2
 
| GND
 
| GND
−
| O
+
| I
 
| System GND.
 
| System GND.
 
|-
 
|-
 
| 3
 
| 3
 
| +3.3V
 
| +3.3V
−
| O
+
| I
−
| +3.3V to Target Device, can be turned off, 200mA available.
+
| +3.3V from ChipWhisperer-Capture.
 
|-
 
|-
 
| 4
 
| 4
−
| FPGA-HS1
+
| HS1
−
| I/O
+
| O
−
| High Speed Input (normally clock in).
+
| High Speed output (normally clock in to ChipWhisperer-Capture).
 
|-
 
|-
 
| 5
 
| 5
−
| PROG-RESET
+
| nRST
 
| I/O
 
| I/O
 
| Target RESET Pin (AVR Programmer).
 
| Target RESET Pin (AVR Programmer).
 
|-
 
|-
 
| 6
 
| 6
−
| FPGA-HS2
+
| HS2
−
| I/O
+
| I
−
| High Speed Output (normally clock or glitch out).
+
| High Speed input (normally clock or glitch out from ChipWhisperer-Capture).
 
|-
 
|-
 
| 7
 
| 7
−
| PROG-MISO
+
| MISO
 
| I/O
 
| I/O
 
| SPI input: MISO (for SPI + AVR Programmer).
 
| SPI input: MISO (for SPI + AVR Programmer).
Line 408: Line 408:
 
| 8
 
| 8
 
| VTarget
 
| VTarget
−
| I
+
| O
−
| Drive this pin with desired I/O voltage in range 1.5V-5V.
+
| Set I/O voltage reference level.
 
|-
 
|-
 
| 9
 
| 9
−
| PROG-MOSI
+
| MOSI
 
| I/O
 
| I/O
 
| SPI output: MOSI (for SPI + AVR Programmer).
 
| SPI output: MOSI (for SPI + AVR Programmer).
 
|-
 
|-
 
| 10
 
| 10
−
| FPGA-TARG1
+
| TARG1
 
| I/O
 
| I/O
 
| TargetIO Pin 1 - Usually UART TX or RX.
 
| TargetIO Pin 1 - Usually UART TX or RX.
 
|-
 
|-
 
| 11
 
| 11
−
| PROG-SCK
+
| SCK
 
| I/O
 
| I/O
 
| SPI output: SCK (for SPI + AVR Programmer).
 
| SPI output: SCK (for SPI + AVR Programmer).
 
|-
 
|-
 
| 12
 
| 12
−
| FPGA-TARG2
+
| GPIO2
 
| I/O
 
| I/O
 
| TargetIO Pin 2 - Usually UART RX or TX.
 
| TargetIO Pin 2 - Usually UART RX or TX.
Line 437: Line 437:
 
|-
 
|-
 
| 14
 
| 14
−
| FPGA-TARG3
+
| GPIO3
 
| I/O
 
| I/O
−
| TargetIO Pin 3 - Usually bidirectional IO for smartcard.
+
| TargetIO Pin 3 - Extra I/O.
 
|-
 
|-
 
| 15
 
| 15
Line 447: Line 447:
 
|-
 
|-
 
| 16
 
| 16
−
| FPGA-TARG4
+
| GPIO4
 
| I/O
 
| I/O
−
| TargetIO Pin 4 - Usually trigger input.
+
| TargetIO Pin 4 - Usually trigger output.
 
|-
 
|-
 
| 17
 
| 17
Line 460: Line 460:
 
| +3.3V
 
| +3.3V
 
| O
 
| O
−
|
+
|<nowiki>+3.3V from ChipWhisperer-Capture.</nowiki>
  
 
|-
 
|-
Line 470: Line 470:
 
|-
 
|-
 
| 20
 
| 20
−
| +VUSB (5V)
+
| +5V
 
| O
 
| O
−
| Not Connected on ChipWhisperer-Lite.
+
| +5V from ChipWhisperer-Capture.
 
|}
 
|}
  

Revision as of 17:18, 23 September 2016

The CW308 UFO Board is a handy main-board for attacking all sorts of embedded targets. Released in 2016, it forms the basis for most of our upcoming target boards. It can be used stand-alone (with an oscilloscope) or with the ChipWhisperer-Capture hardware.

Overview

Cw308 fpga.png Cw308 top.png

Victim Board Connectors

The "victim board" fits into three 20-pin female headers. They provide both electrical and mechanical connections for the board. There is optional mounting holes which can be used if additional mechanical support is required (especially if you need a locked-down victim for use with an EM probe).

The following shows the dimensions of the main connector:

The CW308 victim board has contacts on a 100 mil spacing, allowing you to use regular prototype boards. Click for full size.
J7 (West, A) Function Direction Notes
1 Spare Not connected to main-board, can be used as spare I/O pin breakout.
2 GND
3 CLK-IN CW308 --> Victim Clock to victim.
4 GND
5 CLKOUT CW308 <-- Victim
6 GND
7 GPIO1
8 GPIO2
9 GPIO3
10 GPIO4
11 nRST CW308 --> Victim 100k pull-up to VREF.
12 SCK
13 MISO
14 MOSI
15 GND
16 GND
17 PDIC
18 PDID/CS
19 Spare
20 VREF CW308 <-- Victim Reference voltage for I/O. MUST be set to VCC-IO voltage (3.3V, etc) or I/O lines may not work.


J9 (South, B) Function Direction Notes
1 GND
2 JTAG_TRST Connects to 20-pin ARM JTAG header.
3 JTAG_TDI Connects to 20-pin ARM JTAG header.
4 JTAG_TDO Connects to 20-pin ARM JTAG header.
5 JTAG_TMS Connects to 20-pin ARM JTAG header.
6 JTAG_TCK Connects to 20-pin ARM JTAG header.
7 JTAG_VREF Connects to 20-pin ARM JTAG header. All JTAG_ pins have 100k pull-up to this pin. Must set to appropriate value.
8 JTAG_nRST Connects to 20-pin ARM JTAG header.
9 GND
10 GND
11 HDR1 J10, J12, J15: Pin 1
12 HDR2 J10, J12, J15: Pin 2
13 HDR3 J10, J12, J15: Pin 3
14 HDR4 J10, J12, J15: Pin 4
15 HDR5 J10, J12, J15: Pin 5
16 HDR6 J10, J12, J15: Pin 6
17 HDR7 J10, J12: Pin 7
18 HDR8 J10, J12: Pin 8
19 HDR9 J10: Pin 9
20 HDR10 J10: Pin 10


J11 (East, C) Function Direction Notes
1 GND
2 SHUNTL Low-Side Shunt Connection (connects to SMA)
3 SHUNTH High-Side Shunt Connection (power input side)
4 GND
5 FILT_HP CW308 --> Victim High-Power filter output (same as FILT_LP on this hardware)
6 FILT_LP CW308 --> Victim Low-Power filter output (same as FILT_HP on this hardware)
7 GND
8 FILTIN CW308 <-- Victim Input to power supply filter.
9 GND
10 GND
11 1.2V CW308 --> Victim 1.2V LDO Regulator output
12 1.8V CW308 --> Victim 1.8V LDO Regulator output
13 2.5V CW308 --> Victim 2.5V LDO Regulator output
14 3.3V CW308 --> Victim 3.3V LDO Regulator output OR 3.3V from 20-pin connector
15 5.0V CW308 --> Victim 5.0V from either DC-Power jack or 20-pin connector
16 GND
17 GND
18 LED1 CW308 <-- Victim Active-high buffered LED driver. 100k pull-down.
19 LED2 CW308 <-- Victim Active-high buffered LED driver. 100k pull-down.
20 LED3 CW308 <-- Victim Active-high buffered LED driver. 100k pull-down.

Removing / Replacing Victim Boards

The target board is removed and replaced using the removal tool. This helps avoid bending pins:

P1090067.jpg

The following shows the removal process:

Removal.gif

Adding a board involves carefully aligning the board and pushing down:

Addition.gif

The alignment should be carefully checked if resistance is found. You may need to adjust how the board is aligned, as you should be able to press down with minimal force.

The CW308 should be turned off when swapping victim boards.

I/O Connections

There are two main I/O connection points: the pin headers which duplicate the target board connections, and the 20-pin ChipWhisperer header.

The ChipWhisperer header pins (most of the pins on header J5) have diode protection to set a maximum voltage level. The maximum voltage is set by the voltage present on the middle pin of J4.

20-Pin Pinout

The pinout is as follows:

Number Name Dir Description
1 +5V I +5V from ChipWhisperer-Capture.
2 GND I System GND.
3 +3.3V I +3.3V from ChipWhisperer-Capture.
4 HS1 O High Speed output (normally clock in to ChipWhisperer-Capture).
5 nRST I/O Target RESET Pin (AVR Programmer).
6 HS2 I High Speed input (normally clock or glitch out from ChipWhisperer-Capture).
7 MISO I/O SPI input: MISO (for SPI + AVR Programmer).
8 VTarget O Set I/O voltage reference level.
9 MOSI I/O SPI output: MOSI (for SPI + AVR Programmer).
10 TARG1 I/O TargetIO Pin 1 - Usually UART TX or RX.
11 SCK I/O SPI output: SCK (for SPI + AVR Programmer).
12 GPIO2 I/O TargetIO Pin 2 - Usually UART RX or TX.
13 PROG-PDIC I/O PDI Programming Clock (XMEGA Programmer), or CS pin (SPI).
14 GPIO3 I/O TargetIO Pin 3 - Extra I/O.
15 PROG-PDID I/O PDI Programming Data (XMEGA Programmer).
16 GPIO4 I/O TargetIO Pin 4 - Usually trigger output.
17 GND O
18 +3.3V O +3.3V from ChipWhisperer-Capture.
19 GND O
20 +5V O +5V from ChipWhisperer-Capture.

Clock Network

Crystal Driver

The CW308 contains a crystal oscillator driver. This allows you to use a standard crystal to drive either the victim board or the connected ChipWhisperer. This also allows the use of the CW308 stand-alone, as it's possible to generate almost any frequency by simply putting an appropriate crystal into the socket.

P1090074.jpg

Clock Selection

The clock routing is selected using jumper J3. This allows the following use cases:

  • Routing crystal oscillator (X1) to victim CLKIN.
  • Routing crystal oscillator (X1) to ChipWhisperer HS-IN, then routing HS-OUT to victim CLKIN (for glitch insertion).
  • Routing CLKFB from victim to ChipWhisperer HS-IN.
  • Routing ChipWhisperer HS-OUT to victim CLKIN.

Cw308 clockrouting.png

Power Distribution

Cw308 switch.png

External Power Sources

There are two main sources to supply power to the CW308:

  • DC-input power jack (2.1mm barrel jack, center positive, 5.0V)
  • ChipWhisperer 20-pin connector (5.0V and 3.3V).

Note you can use the DC-input power jack alongside the ChipWhisperer power supply. The CW308 can switch the DC-power on/off, allowing the ChipWhisperer to still control the target power.


On-Board LDOs

There are five LDOs on-board the CW308. While they are mostly rated for 800mA, the board does not have sufficient thermal dissipation to operate at these conditions.

Four of the LDOs have fixed voltage settings: 1.2V, 1.8V, 2.5V, and 3.3V. The fifth LDO is adjustable, and is especially useful if you need to either (a) overcome the voltage drop of a shunt, or (b) feed a power supply into a device to turn off an internal regulator.

Adjustable Voltage Example

Programmer Connections

There are several headers that can be used as programming headers for the victim board. These are J10, J12, an J15. They are routed to pins 10 to 20 (H1 to H10) on the victim board connector J9. These connectors function is defined by the specific victim board mounted.

Cw308 programming.png

In addition there is a 20-pin JTAG header. This uses the standard JTAG ARM pinout.

Jumper Summary

J3: Clock selection.

J4: VREF selection.

J14: Filter input selection.

Schematic

The schematic is available in PDF format here: .

The following has a copy of schematic pages in image as well:

NAE-CW308-03 Schematic Page 1.png

NAE-CW308-03 Schematic Page 2.png

NAE-CW308-03 Schematic Page 3.png

NAE-CW308-03 Schematic Page 4.png

NAE-CW308-03 Schematic Page 5.png

Retrieved from "http://wiki.newae.com/index.php?title=CW308_UFO_Target&oldid=1264"