Approved_users, administrator
366
edits
Changes
Created page with "{{Warningbox|This tutorial has been updated for ChipWhisperer 4.0.0 release. If you are using 3.x.x see the "V3" link in the sidebar.}} {{Infobox tutorial |name..."
{{Warningbox|This tutorial has been updated for ChipWhisperer 4.0.0 release. If you are using 3.x.x see the "V3" link in the sidebar.}}
{{Infobox tutorial
|name = B1: Building a SimpleSerial Project
|image =
|caption =
|software versions =
|capture hardware = CW-Lite, CW-Lite 2-Part, CW-Pro
|Target Device =
|Target Architecture = XMEGA/ARM/Other
|Hardware Crypto = No
|Purchase Hardware =
}}
This tutorial will introduce you to the 'simpleserial' communications system. It will show you how to perform different operations on data based on input from the ChipWhisperer software. This can be used for building your own system which you wish to 'break'.
For users of the ChipWhisperer Lite with ARM target, you'll want to ensure you have the latest updates to the ChipWhisperer platform. This can be done by using the ChipWhisperer Git Update program, or by using git to checkout the develop branch and pulling any updates.
{{TOC|limit=3}}
<h2> What is SimpleSerial </h2>
[[SimpleSerial]] is the communications protocol used for almost all of the ChipWhisperer demo project. It's a very basic serial protocol which can be easily implemented on most systems. This system communicates using a standard asynchronous serial protocol, 38400 baud, 8-N-1.
All messages are sent in ASCII-text, and are normally terminated with a line-feed ('\n'). This allows you to interact with the simpleserial system over a standard terminal emulator.
The following message types are defined:
; <code>x</code>
: Sending a 'x' resets the buffers. This does not require a line-feed termination. It is suggested to always send a stream of x's to initilize the system in case the device was already in some other mode due to noise/corruption.
; <code>k00112233445566778899AABBCCDDEEFF\\n</code>
: Loads the encryption key <code>00112233445566778899AABBCCDDEEFF</code> into the system. If not called the system may use some default key.
; <code>pAABBCCDDEEFF00112233445566778899\\n</code>
: Encrypts the data <code>AABBCCDDEEFF00112233445566778899</code> with the key loaded with the 'k' command. The system will respond with a string starting with r, as shown next.
; <code>rCBBD4A2B34F2571758FF6A797E09859D\\n</code>
: This is the response from the system. If data has been encrypted with a 'p' for example, the system will respond with the 'r' sequence automatically. So sending the earlier example means the result of the encryption was <code>cbbd4a2b34f2571758ff6a797e09859d</code>.
<h2> Building the Basic Example </h2>For this example, we'll be working off of <code>simpleserial-base</code> firmware, which by default just echos the 16 bytes we send to the target back to us.{{CollapsibleSection
|intro = === Building for CWLite with XMEGA Target ===
|content= Building for XMEGA}}
{{CollapsibleSection
|intro = === Building for CWLite with Arm Target ===
|content= Building for Arm}}
{{CollapsibleSection
|intro = === Building for Other Targets ===
|content= Building for Other Targets}}
<h2> Modifying the Basic Example </h2>
At this point we want to modify the system to perform 'something' with the data, such that we can confirm the system is working. To do so, open the file <code>simpleserial-base.c</code> with a code editor such as ''Programmer's Notepad'' (which ships with WinAVR).
<ol style="list-style-type: decimal;">
<li><p>Find the following code block towards the end of the file:</p>
<syntaxhighlight lang="c">/**********************************
* Start user-specific code here. */
trigger_high();
//16 hex bytes held in 'pt' were sent
//from the computer. Store your response
//back into 'pt', which will send 16 bytes
//back to computer. Can ignore of course if
//not needed
trigger_low();
/* End user-specific code here. *
********************************/</syntaxhighlight></li>
<li><p>Modify it to increment the value of each sent data byte:</p>
<syntaxhighlight lang="c">/**********************************
* Start user-specific code here. */
trigger_high();
//16 hex bytes held in 'pt' were sent
//from the computer. Store your response
//back into 'pt', which will send 16 bytes
//back to computer. Can ignore of course if
//not needed
for(int i = 0; i < 16; i++){
pt[i]++;
}
trigger_low();
/* End user-specific code here. *
********************************/</syntaxhighlight></li>
<li>Rebuild the example using the <code>make</code> command. Remember you can press the up arrow on the keyboard to get recently typed commands in most OSes.</li></ol>
== Hardware Setup ==
{{CollapsibleSection
|intro = === CW1173 (Lite) Hardware Setup ===
|content= CWLite HW Setup}}
{{CollapsibleSection
|intro = === CW1200 (Pro) Hardware Setup ===
|content= CW1200 HW Setup}}
{{CollapsibleSection
|intro = === CW308 (UFO) Hardware Setup ===
|content= CW308 HW Setup}}
== Programming the Target ==
{{CollapsibleSection
|intro = === Programming the XMEGA Target ===
|content= Programming XMEGA}}
{{CollapsibleSection
|intro = === Programming the STM32F3 (CW303 Arm) Target ===
|content= Programming Arm}}
{{CollapsibleSection
|intro = === Programming Other Targets ===
|content= Programming Other}}
== Completing the Tutorial ==
Now that the target has the modified firmware, there's only a few steps left to completing the tutorial. Note that if you've closed ChipWhisperer Capture since programming the device, you'll need to rerun the connect_cwlite_simpleserial.py and target setup scripts:
# Open the status monitor under <i>Tools > Encryption Status Monitor</i>.
# Resize the monitor window. The monitor will show sent & received data to the target.
# Hit the ''Run 1'' button ([[File:Capture One Button.PNG|image|link=http://wiki.newae.com/File:Capture_One_Button.PNG]]). You may have to hit it a few times, as the very first serial data is often lost. You should see data populate in the ''Text Out'' field of the monitor window. Note that each byte of the ''Text In'' is incremented in the ''Text Out'' field.
<h2> Conclusion </h2>
In this tutorial you have learned how to build a custom program for the microcontroller on the ChipWhisperer target board. You have programmed the built .hex file into the microcontroller, and confirmed communications with the ChipWhisperer device.
In future labs you will build on this knowledge to attack specific instructions.
<h2> Troubleshooting </h2>
Issues with compilation:
<blockquote><ol style="list-style-type: decimal;">
<li><p>You may have to generate the .dep and objdir directories manually before make will work:</p>
<pre>mkdir .dep
mkdir objdir</pre></li>
<li>On Windows 8, you may get an error like fork: resyntaxhighlight temporarily unavailable. This requires you to install an updated mysys.dll. Download from http://www.madwizard.org/download/electronics/msys-1.0-vista64.zip, unzip file, and copy the .dll to <code>C:\WinAVR-20100110\utils\bin</code>, replacing the existing file.</li>
<li>For the AVR Studio USB Drivers, you'll need to download a [https://gallery.atmel.com/Products/Details/004ccabd-e18e-431a-8557-83deaea23341 Special Update] from Atmel.</li>
<li>You may wish to use the "ChipWhisperer Virtual Machine" on newer Windows systems, which does not require any of the above setup.</li></ol>
</blockquote>
== Links ==
{{Template:Tutorials}}
[[Category:Tutorials]]
{{Infobox tutorial
|name = B1: Building a SimpleSerial Project
|image =
|caption =
|software versions =
|capture hardware = CW-Lite, CW-Lite 2-Part, CW-Pro
|Target Device =
|Target Architecture = XMEGA/ARM/Other
|Hardware Crypto = No
|Purchase Hardware =
}}
This tutorial will introduce you to the 'simpleserial' communications system. It will show you how to perform different operations on data based on input from the ChipWhisperer software. This can be used for building your own system which you wish to 'break'.
For users of the ChipWhisperer Lite with ARM target, you'll want to ensure you have the latest updates to the ChipWhisperer platform. This can be done by using the ChipWhisperer Git Update program, or by using git to checkout the develop branch and pulling any updates.
{{TOC|limit=3}}
<h2> What is SimpleSerial </h2>
[[SimpleSerial]] is the communications protocol used for almost all of the ChipWhisperer demo project. It's a very basic serial protocol which can be easily implemented on most systems. This system communicates using a standard asynchronous serial protocol, 38400 baud, 8-N-1.
All messages are sent in ASCII-text, and are normally terminated with a line-feed ('\n'). This allows you to interact with the simpleserial system over a standard terminal emulator.
The following message types are defined:
; <code>x</code>
: Sending a 'x' resets the buffers. This does not require a line-feed termination. It is suggested to always send a stream of x's to initilize the system in case the device was already in some other mode due to noise/corruption.
; <code>k00112233445566778899AABBCCDDEEFF\\n</code>
: Loads the encryption key <code>00112233445566778899AABBCCDDEEFF</code> into the system. If not called the system may use some default key.
; <code>pAABBCCDDEEFF00112233445566778899\\n</code>
: Encrypts the data <code>AABBCCDDEEFF00112233445566778899</code> with the key loaded with the 'k' command. The system will respond with a string starting with r, as shown next.
; <code>rCBBD4A2B34F2571758FF6A797E09859D\\n</code>
: This is the response from the system. If data has been encrypted with a 'p' for example, the system will respond with the 'r' sequence automatically. So sending the earlier example means the result of the encryption was <code>cbbd4a2b34f2571758ff6a797e09859d</code>.
<h2> Building the Basic Example </h2>For this example, we'll be working off of <code>simpleserial-base</code> firmware, which by default just echos the 16 bytes we send to the target back to us.{{CollapsibleSection
|intro = === Building for CWLite with XMEGA Target ===
|content= Building for XMEGA}}
{{CollapsibleSection
|intro = === Building for CWLite with Arm Target ===
|content= Building for Arm}}
{{CollapsibleSection
|intro = === Building for Other Targets ===
|content= Building for Other Targets}}
<h2> Modifying the Basic Example </h2>
At this point we want to modify the system to perform 'something' with the data, such that we can confirm the system is working. To do so, open the file <code>simpleserial-base.c</code> with a code editor such as ''Programmer's Notepad'' (which ships with WinAVR).
<ol style="list-style-type: decimal;">
<li><p>Find the following code block towards the end of the file:</p>
<syntaxhighlight lang="c">/**********************************
* Start user-specific code here. */
trigger_high();
//16 hex bytes held in 'pt' were sent
//from the computer. Store your response
//back into 'pt', which will send 16 bytes
//back to computer. Can ignore of course if
//not needed
trigger_low();
/* End user-specific code here. *
********************************/</syntaxhighlight></li>
<li><p>Modify it to increment the value of each sent data byte:</p>
<syntaxhighlight lang="c">/**********************************
* Start user-specific code here. */
trigger_high();
//16 hex bytes held in 'pt' were sent
//from the computer. Store your response
//back into 'pt', which will send 16 bytes
//back to computer. Can ignore of course if
//not needed
for(int i = 0; i < 16; i++){
pt[i]++;
}
trigger_low();
/* End user-specific code here. *
********************************/</syntaxhighlight></li>
<li>Rebuild the example using the <code>make</code> command. Remember you can press the up arrow on the keyboard to get recently typed commands in most OSes.</li></ol>
== Hardware Setup ==
{{CollapsibleSection
|intro = === CW1173 (Lite) Hardware Setup ===
|content= CWLite HW Setup}}
{{CollapsibleSection
|intro = === CW1200 (Pro) Hardware Setup ===
|content= CW1200 HW Setup}}
{{CollapsibleSection
|intro = === CW308 (UFO) Hardware Setup ===
|content= CW308 HW Setup}}
== Programming the Target ==
{{CollapsibleSection
|intro = === Programming the XMEGA Target ===
|content= Programming XMEGA}}
{{CollapsibleSection
|intro = === Programming the STM32F3 (CW303 Arm) Target ===
|content= Programming Arm}}
{{CollapsibleSection
|intro = === Programming Other Targets ===
|content= Programming Other}}
== Completing the Tutorial ==
Now that the target has the modified firmware, there's only a few steps left to completing the tutorial. Note that if you've closed ChipWhisperer Capture since programming the device, you'll need to rerun the connect_cwlite_simpleserial.py and target setup scripts:
# Open the status monitor under <i>Tools > Encryption Status Monitor</i>.
# Resize the monitor window. The monitor will show sent & received data to the target.
# Hit the ''Run 1'' button ([[File:Capture One Button.PNG|image|link=http://wiki.newae.com/File:Capture_One_Button.PNG]]). You may have to hit it a few times, as the very first serial data is often lost. You should see data populate in the ''Text Out'' field of the monitor window. Note that each byte of the ''Text In'' is incremented in the ''Text Out'' field.
<h2> Conclusion </h2>
In this tutorial you have learned how to build a custom program for the microcontroller on the ChipWhisperer target board. You have programmed the built .hex file into the microcontroller, and confirmed communications with the ChipWhisperer device.
In future labs you will build on this knowledge to attack specific instructions.
<h2> Troubleshooting </h2>
Issues with compilation:
<blockquote><ol style="list-style-type: decimal;">
<li><p>You may have to generate the .dep and objdir directories manually before make will work:</p>
<pre>mkdir .dep
mkdir objdir</pre></li>
<li>On Windows 8, you may get an error like fork: resyntaxhighlight temporarily unavailable. This requires you to install an updated mysys.dll. Download from http://www.madwizard.org/download/electronics/msys-1.0-vista64.zip, unzip file, and copy the .dll to <code>C:\WinAVR-20100110\utils\bin</code>, replacing the existing file.</li>
<li>For the AVR Studio USB Drivers, you'll need to download a [https://gallery.atmel.com/Products/Details/004ccabd-e18e-431a-8557-83deaea23341 Special Update] from Atmel.</li>
<li>You may wish to use the "ChipWhisperer Virtual Machine" on newer Windows systems, which does not require any of the above setup.</li></ol>
</blockquote>
== Links ==
{{Template:Tutorials}}
[[Category:Tutorials]]