Changes

= Performing the Timing Attack =So far, we've set up our ChipWhisperer to automatically reset the target, send it a password attempt of our choice, and record a power trace while the target processes the password. Now, we'll write a Python script to automatically try different passwords and use these power traces to discover the password stored on the target. == Scripting Communications the Setup ==Our first step will be to write a script that automatically sets up the ChipWhisperer Capture software with all of the settings we've tested above. We'll do this by modifying an existing script with our own settings.

<li>Make a copy of the an existing ChipWhisperer script. You can find it The example scripts are located at <code>chipwhisperer\software\chipwhisperer\capture\scripts</code>, ; for example , the default one for the XMEGA device is called <code>cwlite-simpleserialxmega.py</code> for the XMEGA device. Copy Make a copy of this to another directory that you will use for the attackscript and put it somewhere memorable.</li><li><p>Rename the script something else - for example , <code>cwlite-passwordcrack.py</code>, - and open it for editing. You'll notice the following is that a main large chunk of the code, where is used to set the parameters are set:</p>

<p>Those parameters come from the ''Scripting Parameters'' tab. Switch over to it and notice how when you change this tab logs all of the text for exampleparameter changes, it tells showing you how to change the required parameter name to do this via parameters through the API call:</p>

<p>Note that commands run via the script are also printed, so you can see where the values being set are coming from too. </p></li> <li><p>At this point , close the ''ChipWhisperer-Capture'' window, as so we will can confirm the script still works.</p></li><li><p>Run the new script (which doesn't have any changes yet)from the command line. You may have to open a console with Python in the path:</p>

<li>Once again on the ''Target Settings'' tab, delete the various commands. Note Make a note of the resulting ''Script Commands'' which you will need to enter to achieve this same goal.</li><li>Close ChipWhisperer-Capture.</li><li><p>Edit the Continue editing your script. First, first find the line setting the Trigger Offset:</p>

<li><p>Next, append the required commands to clear the simpleserial commandsand to enable the automatic resets:</p>

['Target ConnectionSimple Serial', 'Load Key Command', u''], ['Target ConnectionSimple Serial', 'Go Command', u''], ['Target ConnectionSimple Serial', 'Output Format', u''],   ['Generic Settings', 'Auxiliary Module', 'Reset AVR/XMEGA via CW-Lite'], ['Reset AVR/XMEGA via CW-Lite', 'Delay (Post-Arm)', 1200],

<p>Note the newline is actually escaped, to set the text equivalent of what will be printed. This will result in an actual newline going out across the serial port.</p><p>Set that command at some point after in your call to <code>capscript.auxChanged()</codep><li>. Close any open ChipWhisperer-Capture windows, and run the script as before. You should connect to the target, and be able to press ''Capture 1'' and see the correct waveform.</p></li>  == Running a Single Capture ==With our settings prepared, the next step is to use our script to record and analyze a power trace. We need to be able to get the trace data into our Python script so we can analyze it for the timing attack. == Attacking a Single Letter ==Now that we can record one power trace, we can start the timing attack. Our goal here is to automatically find the first letter of the Super Secret (tm) password. == Attacking the Full Password ==The last step is to attack the entire password, one letter at a time.