Automatically Triggering Glitch using Target IO4 pin


#1

I am using a CW1173_ChipWhisperer-Lite and trying to trigger a glitch based on the Target IO4 pin’s falling edge. I see no glitches in the ClockXOR or ClockOR outputs.

I did the operations/settings below

1.Switch the ADC Clock Source as being CLKGEN x4.
2. Press Reset ADC DCM, confirm the frequency is 29.5 MHz as expected.
3. Switch the Trigger Setup --> Mode to be Falling Edge
4. Switch the Trigger Setup --> Total Samples to be 1000

I tried experimenting with different gain settings (both low and high) and it didn’t make any difference. I don’t fully understand how to change this based on different targets. I would appreciate any inputs on this. I have verified that the input on Target IO4 line works as expected with an oscilloscope

Other info:
I am able to setup and verify that manual clock glitching works
The Enable only signal from Glitch module is just noise.
My target is a development board SPC564A-disp


#2

Hi br1234,

Just to confirm, you’re at the Automatically Triggering Glitch section of Tutorial A2, right? The part you’re referring to is basically just making sure you can capture power traces. The list a little afterwards, where you change the Glitch Trigger to “Ext Trigger:Single Shot” is what actually changes glitching to being trigger based.


#3

Thank you for your response. Yes you are right I don’t need to change those settings for triggering a glitch. I went back and changed just the Glitch Trigget to Ext Trigger:Single and Ext Trigger:Continous and I still dont see any glitches in the output. My Trigger to CW is connected to pin 16 FPGA-TARG4. The trigger is active low reset signal from the target device I intend to hack.

Below are the rest of my settings
[Scope Settings]
[[ChipWhisperer/OpenADC]]
Connection = NewAE USB (CWLite/CW1200)
Auto-Refresh DCM Status = True
[[[NewAE USB (CWLite/CW1200)]]]
[[[[ChipWisperer-Lite USB]]]]
[[ChipWhisperer/OpenADC]]
[[[Serial Port (LX9)]]]
Selected Port =
[[ChipWhisperer/OpenADC]]
[[[OpenADC]]]
[[[[HW Information]]]]
[[[OpenADC]]]
[[[[Gain Setting]]]]
Mode = low
Setting = 0
[[[OpenADC]]]
[[[[Trigger Setup]]]]
Mode = low
Timeout (secs) = 2
Offset = 0
Pre-Trigger Samples = 0
Total Samples = 24400
Downsample Factor = 1
[[[OpenADC]]]
[[[[Clock Setup]]]]
[[[[[ADC Clock]]]]]
Source = CLKGEN x1 via DCM
Phase Adjust = 0
[[[[Clock Setup]]]]
Freq Counter Src = EXTCLK Input
[[[[[CLKGEN Settings]]]]]
Input Source = system
Input Frequency = 10000000.0
Multiply = 2
Divide = 16
Desired Frequency = 12000000
[[ChipWhisperer/OpenADC]]
[[[CW Extra]]]
[[[[CW Extra Settings]]]]
[[[[[Trigger Pins]]]]]
Target IO1 (Serial TXD) = False
Target IO2 (Serial RXD) = False
Target IO3 (SmartCard Serial) = False
Target IO4 (Trigger Line) = True
Collection Mode = OR
[[[[CW Extra Settings]]]]
Trigger Module = Basic (Edge/Level)
Clock Source = Target IO-IN
Target HS IO-Out = Glitch Module
HS-Glitch Out Enable (High Power) = False
HS-Glitch Out Enable (Low Power) = False
[[[[[Target IOn Pins]]]]]
Target IO1 = Serial TXD
Target IO2 = Serial RXD
Target IO3 = High-Z
Target IO4 = High-Z
[[[[CW Extra Settings]]]]
[[[[[Target IOn GPIO Mode]]]]]
Target IO1: GPIO = Disabled
Target IO2: GPIO = Disabled
Target IO3: GPIO = Disabled
Target IO4: GPIO = Disabled
nRST: GPIO = Default
PDID: GPIO = Default
PDIC: GPIO = Default
[[[[CW Extra Settings]]]]
Target Power State = True
[[[CW Extra]]]
[[[[Glitch Module]]]]
Clock Source = CLKGEN
Glitch Width (as % of period) = 39.84375
Glitch Width (fine adjust) = 0
Glitch Offset (as % of period) = 10.15625
Glitch Offset (fine adjust) = 0
Glitch Trigger = Ext Trigger:Continous
Single-Shot Arm = After Scope Arm
Ext Trigger Offset = 0
Repeat = 50
Output Mode = Clock XORd


#4

I don’t see anything wrong with your settings at first glance. Are you arming the ChipWhisperer by capturing a trace (the green triangle in the top left part of CW Capture)? That needs to be done before the glitch module is active. That will also tell you if the ChipWhisperer is picking up the trigger event, since you’ll get a trace.

Alex


#5

I clicked on the green triangle to capture a trace as you suggested. I see a power trace view window but I actually want to view the voltage at the Target IO4 pin. How do I connect the trigger connected to pin 16 of CW Lite board to OpenADC channel 1 on CW?
I have set the target module as ‘Simple Serial’ under ‘Generic Settings’. Do I need CW305 (Artix-7 board) in order to see if the Chipwhisperer is picking up the trace?
Note: I do have a PicoScope 3000 Series hooked up and I can see that the trigger to the CW on pin16 works.


#6

That the ChipWhisperer captured the trace (unless you got a timeout) tells you that it’s triggering correctly. Did you see a glitch when you hit the capture button?

If you want to see in real time whether the trigger is being picked up, you can check “Trigger Active Count”. If it’s steadily climbing, the ChipWhisper is being triggered. You also probably don’t want to hook the OpenADC up to your trigger pin, as it’s looking for small changes in voltage happening over small periods of time.

Alex


#7

I didn’t see a glitch when I hit the capture button. I see that the Trigger Active Count increases even when there isn’t a signal connected to pin16. I’m not sure what I am missing here.
This is my physical setup:
CW has GND from the target board connected to Pin2, the output from the glitch module (Clock XORd) is connected to the XTAL of the target device and Pin 16 is connected to the active low reset signal from the target board.
I am using a Glitch Width and Glitch offset of 10.2% each.

I am talking to the Chipwhisperer using the VMware release “Chipwhisperer 4.0.1 Lubuntu 64-bit”.


#8

What does your actual clock setup look like? If you’re using an external clock, the ChipWhisperer needs to be between the clock source and the target by taking the clock source as an input on HS1. It then needs to output to the device’s clock input. If you’re using the ChipWhisperer’s clock to drive the device, you’ll need to switch your clock source back to being “System”.

Additionally, you can also try hitting the “Reset DCM” button in the glitch module.

Alex


#9

I am using the chipwhisperer’s clock to drive the device. What do you mean by this? "you’ll need to switch your clock source back to being “System” I did set up the Glitch module to use Clock Gen output. I have tried reset DCM and glitch module several times, it still doesn’t glitch on external trigger.


#10

Sorry, I misread your post with your settings.

I did some testing and it seems like the glitch module won’t accept high and low trigger modes (though the capture part will still work). Instead, you’ll need to use “Rising Edge” or “Falling Edge”. The rest of your settings from your earlier post should be fine. I’d recommend using rising edge to use the end of reset as your reference point, since everything interesting should be happening after that point. “Glitch Only” as an output mode will allow you to measure the glitch pretty easily, since HS2 will only go high when the glitch is active.

Hopefully that resolves your issue, if not let me know. I’ll check with Colin that that’s intended behaviour, and either case I’ll update the wiki so that’s clear.

Alex


#11

I spoke with Colin, and he said that the trigger for the glitch module is separate and should only work with rising edge, regardless of what the ADC’s trigger setting is. I’m not sure why triggering for the glitch module stops entirely if it’s set to Low or High, but hopefully that will work with what you want to do.

Alex