Attacking target at 64 Mhz

Hi all,

I am trying to attack a board that runs at 64Mhz. The issue is that the board does not allow to modify the cpu clock nor access the internal clock.

So far I output an 8 Mhz signal for the target, it is generated with a timer and used for the ADC clock. I do the sampling with ext_x4 at 32Mhz.

I would like to ask you if this can be considered a correct way to synchronize?
If synchronized sampling can overcome a 50% undersampling?
Can used the signal generated with the CW in the place of a crystal?

Thanks in advance.


Hello. Are you trying overclock CW up too 130Mhz?
But when you capturing in this mode CW may producing some traces with overflow ADC values(need produce resync for clear dataset from bad traces)

I think the OP would be sampling at 32 MHz, no overclocking. Sorry answering this got missed, but yes, that’s one possible way to acquire the target traces. It would be better if you could get a 64 MHz clock from the target, obviously.

Overclocking CW > 105 MHz is really not recommended. You’re going beyond the ADC spec, and you’re running the FPGA faster than what it’s rated for. Even if it appears to work fine, it may not work later if the temperature changes (either due to environmental differences, or CW itself heating up during a long capture campaign). It might be obvious that some traces are bad, but that’s not guaranteed. Some samples might get dropped, some may get mis-sampled, some bits of the ADC output might bleed from one sample to the next… how do you detect that? I wouldn’t do it.