VCC glitching STM32 board

Embedded Security Glitching
1

Hi is there any issues with VCC glitching after breaking CW1173 board to 2 parts and soldering SMC/IDC connectors etc ?

I have no issue with clock glitching but VCC seems to not work on ARM STM32 board. I write script to go over all params and didn’t find success glitch for glitch-simple.c using glitch1() function.

Tried lower/high glitch, different repeats higher/lower, and also modify via script width/offset/ext_offset/ and no success after 5000 tries or so. I see glitches inserted in power trace, so this should not be issue with initial setup.

Regards

2

Hi. I’m just wondering if you have managed to get the VCC glitch to work on the CW1173 before breaking it into 2 parts.

Regards,
Melvin.

3

Hi,

I’ve found the following settings to work well with the following setup:

  • STM32F3 target on CW308 board
  • 15cm SMA Cable
  • Offset around -20, width around 20
  • ext_offset = 2186 (lots others should work as well, this is just the one I’ve been using)
  • glitch_lp = True

I’d recommend starting with glitch_infinite() to minimize the need to change ext_offset (with glitch1(), there’s only a few instructions that will provide success when glitched, but with glitch_infinite(), there’s lots). Keep repeat on 1 (anything higher will usually cause the target to crash). In addition, make sure you try each glitch location multiple times, since your best settings may only produce glitches ~30% of the time.

Alex