I made a small adapter board so CW312-format targets can run on the CW308 UFO. The UFO expects targets on its pin-header socket, while CW312 boards use a card-edge slot, so the Abductor bridges the two and handles the signal mapping in between. It’s open source (MIT), board files and docs are up on GitHub. Feedback welcome, especially on the signal mapping and the card-edge connector choice.
I made two versions: one with a right-angle connector and one without. We’ll see which one I like better….
Don’t even think about manufacturing this yet. I’m still testing it, and the final design may change. This repository is for informational purposes only for now.
When the PCB arrives, I’ll keep you posted on whether it works and whether signal integrity or anything else turns out to be an issue. Fingers crossed, we’ll see if we get lucky and it works with a wide range of targets….
It’s always better to design a custom target board for each specific use case… but when we don’t want to (or simply can’t) this could be a crap solution.
I had to trim a small part off the PCB so it wouldn’t interfere. If Abductor works, I think it’s a very small sacrifice…. there’s barely anything to cut off. I sanded the edge afterward… We’re still nowhere near the mounting hole.
Validation campaign complete: 3 targets, 2 board variants, full SCA / FI / debug suite
Hey all, quick wrap-up now that the Abductor validation is finished. Short version: the adapter carried a full side-channel, fault-injection and debug workload across three very different CW312 targets, on two board variants, and I could not find a single test where it behaved differently from running the target directly in a CW313.
Repo (KiCad v10 sources, six-layer ENIG gerbers, BOM, and every validation script + evidence dump + figure):
The bench
Husky Plus → CW308 UFO → Abductor → target, at chipwhisperer commit 3c8e4347. Every target was also re-run directly in a CW313 baseboard as an A/B control, and the whole suite was repeated on a second hardware variant, the Right-Angle Abductor.
sca101: instruction power differences, password SPA (recovered h0px3), Hamming-weight leakage, DPA full 16-byte key, and CPA full key in ~30 traces
fault101: voltage-glitch password bypass, a voltage-glitch memory dump that leaked the decrypted secret (“Don’t forget to buy milk!”), clock glitching, and the low-power crowbar path
Debug: full SWD takeover (halt, chip ID, flash/SRAM/registers) and full JTAG (TAP IDCODE 0x4ba00477 over TDI/TDO; DP IDR 0x2ba01477, chip ID 0x288b07e1)
Signal integrity: SNR 14.1 (11.5 dB), TVLA max |t| = 60.7
Coverage matrix: every routed pin either exercised functionally or continuity-checked (LEDs, GPIO3, CLKOUT, all rails)
iCE40 FPGA:
Bitstream config over SPI + AES known-answer test
Hardware-AES CPA, full 16/16 key (last-round HD model)
TVLA max |t| = 85
A full DFA with phoenixAES (round-8 model) via a clock glitch on the FPGA clock, 16/16 key
K82F mmCAU:
SWD flash + known-answer test
Strong leakage present (TVLA max |t| = 100.6), but first-order CPA did not break the mmCAU accelerator (up to 50k traces). The CW313 control shows the same non-recovery, so that is a property of the target, not the adapter degrading the signal.
Right-Angle variant:
All three targets re-run. Every key outcome reproduced (full SCA key recovery, fault injection, DFA, SWD/JTAG), with the longer, differently-routed traces showing no effect this testing could measure.
Bottom line
Within this setup and test set, no test resolved a difference between the Abductor and a target running directly in a CW313 beyond single-run scatter. The one exception is the SNR point estimate, which was actually slightly higher on the direct CW313 path (about 0.7 dB), and with one estimate per path a small effect there cannot be confirmed or excluded either way. Everything else (CPA/DPA key recovery, TVLA, glitch optima, debug reads) matched the direct connection across all three target classes.
Fair-warning caveats (please read “Scope and limitations” in the repo)
I am an enthusiast, not a professional SCA engineer. This is one operator on one bench, one physical specimen of each board, one Husky Plus, and mostly single-run figures that carry real run-to-run and re-assembly variance. Treat it as a careful engineering log, not a qualified test report. Corrections and reviews are genuinely welcome.
Small aside for anyone thinking of building one: the six-layer ENIG protos came back with a quality that honestly surprised me for a low-volume prototype run.
Everything (design + evidence + scripts) is here:
Thanks for the CW312 platform and the sca101 / fault101 / fault201 labs that made all of this straightforward to validate.
The Abductor is MIT licensed, so it is yours to fork, modify, sell, whatever you like. No strings.
Heads-up if you ever productize it: it is a six-layer ENIG board with a Samtec PCIe socket, so it is not cheap to build and would likely be a pricey SKU with thin margin unless you respin it cheaper (fewer layers, HASL, cheaper socket). I’m going to stick with the 6-layer version because I prefer it for signal integrity, and this design has a lot of traces…
Only a personal ask, not a license condition: if you ship it, please keep my little bacteria logo on the silkscreen.
And if anyone here or on the team wants a board, I can send one at PCB cost plus shipping, no markup. Just DM me.
