I’ve spent the last couple weeks playing with the ChipSHOUTER and understanding how it works. My setup mounts the 1mm CCW probe tip over a 12" SMA hose (I know it’s preferred to mount the Shouter directly… But it seems to work OK!) onto an XY positioner and connects up to an Ubuntu host machine. I was able to see results without issue with the Simple EMFI and Ballistic Gel DUTs by manually triggering the EM pulse, either with the convenient big red button or through the microcontroller API.
This all went well, but progressing further quickly revealed a significant difficulty spike. In order to inject a pulse on-demand in response to a stimulus, one must use a ChipWhisperer. This first forced me to learn how my ChipWhisperer Lite works, but with the strong tutorials in place I managed to figure out how to proceed after a couple days. My DUT pulls a GPIO pin high, sleeps for 2us, and then enters the typical “acc = 0; for i < 500; for j < 500; acc += 1” loop associated with EMFI testing. The ChipWhisperer looks for this pin on TIO4, and triggers accordingly.
My understanding of the design of the ChipSHOUTER is that it is a teaching and analysis platform first, and a fault injection system second. It teaches you the principles of EMFI by showing you how it reacts to DUTs. It can also characterize faults on a platform with simple scripting. But in practice, the microcontroller is not helpful when mounting an actual EMFI attack, since it cannot respond to external stimuli other than the Python API and the big red button. I can’t remember where this was written, but Colin O’Flynn said somewhere that 80% of his actual ChipSHOUTER usage was with a ChipWhisperer attached. That’s why I’m taking the ChipWhisperer approach-- it seems to be the way, by design, to perform a useful EMFI attack, at the cost of giving up the useful learning features.
So with my setup and methodology hopefully explained well enough, allow me to introduce my problem: I have very little control over the width of the pulse injected. By connecting the external trigger signal to the ChipWhisperers “glitch” signal with the included SMA cable (exactly as shown in Figure 4 of MIN()imum Failure: EMFI Attacks against USB Stacks) I can observe a pulse of no shorter than 750ns. This pulse is extremely powerful and effective, managing to corrupt most registers on my DUT to the same random value and therefore cause exceptions, but I want subtler results like a simple incorrect addition. I can increase the length of the pulse by increasing scope.glitch.repeat but cannot shorten it below a value of 1. Note that I can observe pulses of the same length by manually triggering the Shouter with a 750ns width (i.e. going through the microcontroller.)
This forum post seems to have a similar problem to my own to a less extreme extent. It suggests using the HS2 signal on the advanced breakout board. Now, I do have this advanced breakout board, but I don’t yet have the connector on the ChipWhisperer Lite to connect it-- that’ll be arriving tomorrow in the mail-- so I jerry-rigged a way to attach an SMA connection to the alternate breakout HS2 breakout point on the row of connections behind the main connector which I have soldered some headers on to. (Specifically, I used an oscilloscope probe at 10X attenuation and an adapter.)
This worked for a short period of time-- I was able to pulse at around 90ns granularity or so (that is, 90ns pulse width, 180ns and so on.) However, after two hours, the Shouter started emitting faults whenever I attempted to pulse, and after that time it would simply either fault the moment I attached the HS2 connection or do nothing at all when pulsing.
This is a picture of the signals I receive from A. the glitch signal and B. the HS2 signal. Something is clearly up with that glitch signal, but the HS2 signal looks OK. At this point, I’m at a loss as to how to proceed-- The ChipWhisperer can’t seem to make the ChipSHOUTER happy in any of the cases I present it. I must be doing something wildly wrong here.
Here is the code I’m using to test pulses being sent.
from chipshouter import ChipSHOUTER
import chipwhisperer as cw
import time
cs = ChipSHOUTER('/dev/ttyUSB0')
# Setup for manual trigger per the docs
cs.hwtrig_mode = 0
cs.hwtrig_term = 0
if not cs.armed:
cs.armed = True
time.sleep(2)
scope = cw.scope()
scope.default_setup()
scope.glitch.output = 'enable_only'
scope.glitch.clk_src = "clkgen"
scope.io.hs2 = "glitch"
scope.glitch.width = 2
scope.glitch.repeat = 1
scope.glitch.trigger_src = 'manual'
scope.io.glitch_lp = True
scope.arm()
while True:
res = input("Glitch: ")
if res == '':
pass
elif res == 'w':
scope.glitch.width = int(input('a'))
else:
scope.glitch.repeat = int(res)
scope.glitch.manual_trigger()
