Hello All,
I am attempting to perform a basic clock glitching attack on an external target:
Target: TI TMS320C
I am using IO3 to reset the micro - hoping to use the target’s 30MHz oscillator for producing the glitch.
Issue:
I am unsure how to properly configure the Jumper clock selection header (J3) to accomplish this.
(https://wiki.newae.com/CW308_UFO_Target#Jumper_Summary)
My Guess:
Use the third (3) and fourth (4) positions to route the target clock into CLKFB, then HS-IN, and finally HS-OUT to the victim CLKIN. I have the target clock connected to CLKFB but I assume another connection might have to be made.
Target Clock <–> CLKFB
CLKFB --> HS-IN
HS-OUT --> CLKIN
Does this look right?
Hello,
Yup - CLKFB would be routed to CLKIN (HS1), then HS2/OUT routed to CLKIN on the target.
On the Jupyter side, just be sure you configure the glitch input to use “target” clock (which uses ‘extclk’, which is HS1) instead of the default, which is CLKGEN. It would now pick up your HS1 clock, do the glitch stuff you want, then route it out to HS2 (assuming you configure HS2 as ‘glitch’ output).
Confusingly you can also setup CLKGEN to use EXTCLK as the “core source”, which is only normally used when you want to do additional clock multiplications on the extclk first (sounds like not needed in your case).
It’s easier with the diagrams - https://chipwhisperer.readthedocs.io/en/latest/api.html . There are two block diagrams (one for the glitch clock, one for the clkgen) on that page that hopefully makes more sense.