CW1173 ChipWhisperer-Lite

Accessing the Programmer

First, setup the ChipWhisperer as usual:

import chipwhisperer as cw
scope = cw.scope()
target = cw.target(scope)

Next, the AVR programmer can be accessed through the cw.programmers.AVRProgrammer object:

prog = cw.programmers.AVRProgrammer

Programming the Flash

Note to use the AVR programmer you may require a valid clock source for the AVR. It is suggested to use the default ChipWhisperer setup, which will generate a 7.37MHz clock:

scope.default_setup()

Note that NewAE's Notduino targets have the transmit and receive pins swapped compared to the usual targets. If you're using one of these targets, swap them using the API:

scope.io.tio1 = "serial_tx"
scope.io.tio2 = "serial_rx"

Next, try programming the device by calling cw.program_target():

cw.program_target(scope, prog, "<path to hex file")

The default SPI data rate for the programmer is too fast for devices which are running slower than 2 MHz. If programming a device with a clock source slower than 2 MHz, you will need to enable the "Slow Clock Mode". In "Slow Clock Mode" the entire SAM3U and FPGA clock is changed from 96 MHz to 12 MHz. Note the default fuse bytes for a virgin ATMega328P result in a 1 MHz clock, so you will need to use "slow clock mode" to program the correct fuse bytes, after which point you will not need to use "slow clock mode".

To enable slow clock mode, call program_target with an additional slow_clock = True parameter:

cw.program_target(scope, prog, "<path to hex file", slow_clock=True)

note

The 'slow clock mode' is used to provide a slower SPI clock than would otherwise be possible. When switching into 'slow clock mode' it will cause all DCM blocks in the FPGA to become unlocked. You will need to reset the DCM blocks, or simply call default_setup() again (this will reset the serial pins, so you'll have to swap them again if you're using a Notduino target).

Programming the Fuses

By default the AVR programmer allows you to modify the LOW fuse byte only, as this byte controls the clock source selection. To change the value of the fuse byte, you'll need to manually setup the programmer:

avr_programmer = prog(slow_clock=False) #call with slow_clock = True to enable the slow clock
avr_programmer.scope = scope
avr_programmer.open()
avr_programmer.find()

Once that's accomplished, the readFuse() and writeFuse() methods can be used to read and write the fuse bits, respectively:

fuse_vals = avr_programmer.readFuse(<value>)
avr_programmer.writeFuse(<value>, <lfuse>)

with <value> corresponding to one of the following: "low", "high", or "extended".

See an Online Fuse Calculator to better understand what the values mean.

tip

If programming a virgin ATMega328P device, the default low-fuse value of 62 results in the internal 8 MHz oscillator being divided down to 1 MHz. Any external clock is ignored.

The low fuse byte must be changed to D0 to use the external clock provided by the ChipWhisperer toolchain.

Troubleshooting

If you run into issues when programming the AVR, try the following troubleshooting methods:

• Ensure the ChipWhisperer is outputting a clock if the target requires one.
• Ensure you have the serial pins the right way around
• Ensure the fuse bits are set correctly.

Rev -03 or Later

Run the following python code once you have the scope and target set up:

prog = cw.programmers.STM32FProgrammer
cw.program_target(scope, prog, "<path to fw hex file>")

If you get errors during the programming process:

• Retry the programming process with a lower baud rate:

prog = cw.programmers.STM32FProgrammer
cw.program_target(scope, prog, "<path to fw hex file>", baud=38400)

• If using a CW308 based STM, try mounting a jumper between the "SH-" and "SH+" pins at J16 (to the left of the SMA connector) on the UFO board. Retry programming with the jumper mounted.

Rev -02 Boards

The Rev -02 boards did not have all programming connections present. They require some additional steps:

1. Setup the device as usual:

   scope = cw.scope()
   target = cw.target(scope)
   scope.default_setup()
   

2. Mount a jumper between the H1 and PDIC pins (again this is ONLY for the -02 rev).

   

3. Reset the ARM device either by pressing the reset button (newer UFO boards only), or by toggling power:

   import time
   scope.io.target_pwr = False
   time.sleep(1)
   scope.io.target_pwr = True
   

4. Program the device:

   prog = cw.programmers.STM32FProgrammer
   cw.program_target(scope, prog, "<path to fw hex file>")
   

5. The device should program, it may take a moment to fully program/verify on larger devices.
6. Remove the jumper between the H1/H2 pins.
7. Reset the ARM device either by pressing the reset button (newer UFO boards only), or by toggling power:

   import time
   scope.io.target_pwr = False
   time.sleep(1)
   scope.io.target_pwr = True
   

8-Pin SmartCard Connector

The CW1173 contains two 8-pin connectors, which use our standard 8-pin Smart-Card header pinout. One header connects to the SAM3U device (which has ISO-7816 drivers), one header connects to the FPGA. Note there is currently no firmware support for these devices, but the hardware is designed for any of the following:

• Emulating a smart card (use interposer board), or fuzzing a smart card reader
• Communicating to a smart card
• Sniffing traffic between a legitimate reader and smart card
• Side-channel analysis of smart card device

Header J7 (Connects to SAM3U):

Header J6 (Connects to FPGA):

Checking Firmware Version

The firmware version is printed at start-up. You will see a line that looks like this indicating the version of the SAM3U Firmware:

Found CW-Lite, Serial Number = 442031204630xxxxxxxxxxx
SAM3U Firmware version = 0.11 b0
Programmed FPGA

If your firmware version is outdated, a warning will be printed. You can also see the firmware version in the Config CW Firmware dialog:

Note the main version is 0.11 in this example. The "b0" indicates a "build" number. Typically this will be "build 0", but special versions will use a different build number to indicate a variant of a regular version.

Upgrading Firmware

See https://chipwhisperer.readthedocs.io/en/latest/api.html#firmware-update for instructions on how to update the SAM3U firmware.

Linux usbserial module Workaround

There is an issue in some versions of Linux, where the SAM3U is not assigned a serial port when it enters bootloader mode. Here are some steps to resolve this issue (Note. this is not a permanent fix, you must go through these steps each time you put your ChipWhisperer into bootloader mode.). These steps assume you've already put ChipWhisperer into bootloader mode.

1. Unplug your ChipWhisperer (Leave unplugged until instructed otherwise)
2. Reboot your computer
3. Once logged in again, open a terminal session
4. Run this command: sudo modprobe usbserial vendor=0x3eb product=0x6124
5. Plug your ChipWhisperer back in
6. Check that a serial port is now open using: ls -l /dev/ttyUSB*

You should now be able to program the bootloader from ChipWhisperer Capture through the port you created

Manual Update

If the above instructions fail, there is no big problem. The SAM3U chip contains a hardware-resident bootloader. You may need to follow instructions on the Manual SAM3U Firmware Update page (including using BOSSA) if you are unable to use the automatic system that is part of ChipWhisperer-Capture.