As of August 2020 the site you are on ( is deprecated, and content is now at


Jump to: navigation, search

Tutorial A3 VCC Glitch Attacks

1,208 bytes added, 16:24, 12 April 2018
Addition of the script to the files
<ol/liOptionally, you can also configure the power measurement setup too:</ol>
=== Monitoring Glitch Insertion ===
<p>Finally, configure the Glitch Explorer:</p>
  <blockquote> <ol style="list-style-type: lower-alpha;"> <li>Set the ''Normal Response'' to <code>s.endswith(&quot;hello\nA&quot;) and (len(s) &lt; 12)</code></li> <li>Set the ''Successful Response'' to <code>&quot;1234&quot; in s</code></li> </ol> </blockquote>  <p>You can test the updated color-coding seems to be working too with a few ''Capture 1'' events.</p> </li>  <li> <p>Using the following table, set the ''Glitch Width (as % of period)'' and ''Repeat'' on the ''Scope Settings'' tab:</p>
{| class="wikitable"
! Parameter
| 10
</li> <li> <p>Finally, let's configure the Glitch Explorer to give us the required sweep of the ''Offset'' parameter.<ol style="list-style-type: lower-alpha;"><li>Adjust the and ''Glitch Offset (as % of period)Width'' up or down parameters by 1 in running the ''Glitch Module'' settings. We do this only to get the required string printed to the ''Script Commands'' output.</licode><li>Set the ''Tuning Parameters'' to ''1'' in the Glitch</licode><li><p>Set . The starting, stopping and step attributes can be changed for both parameters by editing the parameters as appropriate:script</p>{| class <syntaxhighlight lang=python>"wikitable""Glitch Explorer example to modify clock offset & width.! Option! ValueTo use this be sure to set 'Output Format' as $GLITCH$ so data is passed through.|-"""| Name| Offsetclass IterateGlitchWidthOffset(object):| def __init__(self, ge_window): self._starting_offset = -40| Script Command self._starting_width = -40| ['Glitch Module' self.ge_window = ge_window  def reset_glitch_to_default(self, 'Glitch Offset scope, target, project): """ Set glitch settings to defaults. """ self.offset = self._starting_offset self.width = self._starting_width  def change_glitch_parameters(as % of periodself, scope, target, project)']:|- """ Example of simple glitch parameter modification function. """| Data Format # This value is minimum clock offset/width increment| Float scope.glitch.offset += 0.390624|-| Range if scope.glitch.offset > 40:| -49 scope.glitch.offset = self._starting_offset scope.glitch.width += 0.390624  if scope.glitch.width > 40: 49|- scope.glitch.width = self._starting_width| Value| -49 # Write data to scope|- #scope.glitch.width = self.width| Step #scope.glitch.offset = self.offset| 0 #You MUST tell the glitch explorer about the updated settings if self.5ge_window:|- self.ge_window.add_data("Glitch Width", scope.glitch.width)| Repeat self.ge_window.add_data("Glitch Offset",scope.glitch.offset)| 1|}glitch_iterator = IterateGlitchWidthOffset(self.glitch_explorer)self.aux_list.register(glitch_iterator.change_glitch_parameters, "before_trace")#self.aux_list.register(glitch_iterator.reset_glitch_to_default, "before_capture") </li></olsyntaxhighlight> </li>  <li> <p>On the ''General Settings'' tab:</p> <blockquote> <ol style="list-style-type: lower-alpha;"> <li>Ensure the ''Trace Format'' is set to ''None'' (i.e., no traces will be written to disk).</li> <li>Set the ''Number of Traces'' to 200.</li></ol> </blockquote> </li> <li>Press the ''Capture Multi'' button. You will get a warning as there is no trace writer, but can just hit ''Continue Anyway'', since we do not want to store traces to disk.</li> <li> <p>Hopefully you will determine some useful parameters for glitching this target:</p> <blockquote> <p>[[File:ge-success.png|image]]</p> </blockquote> </li> <li>Try reducing the ''Repeat'' parameter in the ''Glitch Module'' settings. See how few cycles you can glitch while still achieving a reliable glitch.</li></ol>
Once you have the glitch parameter determined, you can work on trying to recreate some of the previous tutorials such as glitching passed the password prompt.

Navigation menu