{"post_stream":{"posts":[{"id":4237,"name":"","username":"fridgyylife","avatar_template":"/letter_avatar_proxy/v4/letter/f/c37758/{size}.png","created_at":"2020-02-07T20:49:44.024Z","cooked":"\u003cp\u003eHi, I’m trying to voltage glitch an Stm32f103 to gain access to the flash memory and dump the firmware. I’m basing my thinking on this glitch paper \u003ca href=\"https://www.google.com/url?sa=t\u0026amp;source=web\u0026amp;rct=j\u0026amp;url=https://tches.iacr.org/index.php/TCHES/article/download/7390/6562/\u0026amp;ved=2ahUKEwi087W0p8DnAhV30TgGHVQ8BPkQFjABegQIBRAM\u0026amp;usg=AOvVaw3Yf850otJLHvHHJiRQLcVi\" rel=\"nofollow noopener\"\u003ehttps://www.google.com/url?sa=t\u0026amp;source=web\u0026amp;rct=j\u0026amp;url=https://tches.iacr.org/index.php/TCHES/article/download/7390/6562/\u0026amp;ved=2ahUKEwi087W0p8DnAhV30TgGHVQ8BPkQFjABegQIBRAM\u0026amp;usg=AOvVaw3Yf850otJLHvHHJiRQLcVi\u003c/a\u003e\u003cbr\u003e\nAnyway I somehow have to coordinate the read Flash command via openocd and stlink v2 adaprer and use it as a trigger for the chip whisperer lite. Does anybody have any ideas on how I might go about this or if there is an easier way to gain flash access.\u003c/p\u003e","post_number":1,"post_type":1,"posts_count":24,"updated_at":"2020-02-07T20:55:10.758Z","reply_count":0,"reply_to_post_number":null,"quote_count":0,"incoming_link_count":1900,"reads":77,"readers_count":76,"score":9480.4,"yours":false,"topic_id":1799,"topic_slug":"breaking-crp-level-1-stm32f103","display_username":"","primary_group_name":null,"flair_name":null,"flair_url":null,"flair_bg_color":null,"flair_color":null,"flair_group_id":null,"badges_granted":[],"version":2,"can_edit":false,"can_delete":false,"can_recover":false,"can_see_hidden_post":false,"can_wiki":false,"link_counts":[{"url":"https://www.google.com/url?sa=t\u0026source=web\u0026rct=j\u0026url=https://tches.iacr.org/index.php/TCHES/article/download/7390/6562/\u0026ved=2ahUKEwi087W0p8DnAhV30TgGHVQ8BPkQFjABegQIBRAM\u0026usg=AOvVaw3Yf850otJLHvHHJiRQLcVi","internal":false,"reflection":false,"clicks":178}],"read":true,"user_title":null,"bookmarked":false,"actions_summary":[],"moderator":false,"admin":false,"staff":false,"user_id":914,"hidden":false,"trust_level":1,"deleted_at":null,"user_deleted":false,"edit_reason":null,"can_view_edit_history":true,"wiki":false,"post_url":"/t/breaking-crp-level-1-stm32f103/1799/1","reactions":[],"current_user_reaction":null,"reaction_users_count":0,"current_user_used_main_reaction":false,"can_accept_answer":false,"can_unaccept_answer":false,"accepted_answer":false,"topic_accepted_answer":null},{"id":4241,"name":"Jean-Pierre Thibault","username":"jpthibault","avatar_template":"/user_avatar/forum.newae.com/jpthibault/{size}/209_2.png","created_at":"2020-02-08T02:44:01.930Z","cooked":"\u003cp\u003eHi,\u003c/p\u003e\n\u003cp\u003eIdeally you would have an FPGA to passively observe the JTAG traffic and issue a trigger to your ChipWhisperer at or around the “right time”.\u003cbr\u003e\nBut all you really need is a constant time reference that you can use to time your glitch, since you can offset and sweep from there with the ChipWhisperer. I’m not sure what’s the simplest way to do that, I’m just pointing you in (hopefully) the right direction.\u003cbr\u003e\nOne option is to adapt our \u003ca href=\"https://github.com/newaetech/phywhispererusb\"\u003ePhyWhisperer-USB\u003c/a\u003e  for your purposes, as explained \u003ca href=\"https://newae.discoursehosting.net/t/i2c-protocol-aware-glitching/1783\"\u003ehere\u003c/a\u003e.\u003cbr\u003e\nYou might also get some ideas from \u003ca href=\"https://toothless.co/blog/bootloader-bypass-part1/\"\u003eDmitry’s bootloader bypass tutorial\u003c/a\u003e.\u003c/p\u003e\n\u003cp\u003eJean-Pierre\u003c/p\u003e","post_number":2,"post_type":1,"posts_count":24,"updated_at":"2020-02-08T02:44:01.930Z","reply_count":1,"reply_to_post_number":null,"quote_count":0,"incoming_link_count":48,"reads":76,"readers_count":75,"score":260.2,"yours":false,"topic_id":1799,"topic_slug":"breaking-crp-level-1-stm32f103","display_username":"Jean-Pierre Thibault","primary_group_name":null,"flair_name":null,"flair_url":null,"flair_bg_color":null,"flair_color":null,"flair_group_id":null,"badges_granted":[],"version":1,"can_edit":false,"can_delete":false,"can_recover":false,"can_see_hidden_post":false,"can_wiki":false,"link_counts":[{"url":"https://toothless.co/blog/bootloader-bypass-part1/","internal":false,"reflection":false,"clicks":85},{"url":"https://github.com/newaetech/phywhispererusb","internal":false,"reflection":false,"title":"GitHub - newaetech/phywhispererusb: PhyWhisperer-USB: Hardware USB Trigger","clicks":27},{"url":"http://forum.newae.com/t/i2c-protocol-aware-glitching/1783","internal":true,"reflection":false,"title":"I2C Protocol Aware Glitching","clicks":20}],"read":true,"user_title":null,"bookmarked":false,"actions_summary":[],"moderator":true,"admin":false,"staff":true,"user_id":776,"hidden":false,"trust_level":4,"deleted_at":null,"user_deleted":false,"edit_reason":null,"can_view_edit_history":true,"wiki":false,"post_url":"/t/breaking-crp-level-1-stm32f103/1799/2","reactions":[],"current_user_reaction":null,"reaction_users_count":0,"current_user_used_main_reaction":false,"can_accept_answer":false,"can_unaccept_answer":false,"accepted_answer":false,"topic_accepted_answer":null},{"id":4244,"name":"","username":"fridgyylife","avatar_template":"/letter_avatar_proxy/v4/letter/f/c37758/{size}.png","created_at":"2020-02-08T08:57:51.752Z","cooked":"\u003cp\u003eOK so your suggesting to use a phy whisperer USB hooked up to my stlink v2. Sniff the USB line of the stlink and wait for the read Flash message and use it as a trigger for chip whisperer?\u003c/p\u003e","post_number":3,"post_type":1,"posts_count":24,"updated_at":"2020-02-08T08:57:51.752Z","reply_count":1,"reply_to_post_number":2,"quote_count":0,"incoming_link_count":4,"reads":72,"readers_count":71,"score":39.4,"yours":false,"topic_id":1799,"topic_slug":"breaking-crp-level-1-stm32f103","display_username":"","primary_group_name":null,"flair_name":null,"flair_url":null,"flair_bg_color":null,"flair_color":null,"flair_group_id":null,"badges_granted":[],"version":1,"can_edit":false,"can_delete":false,"can_recover":false,"can_see_hidden_post":false,"can_wiki":false,"read":true,"user_title":null,"reply_to_user":{"id":776,"username":"jpthibault","name":"Jean-Pierre Thibault","avatar_template":"/user_avatar/forum.newae.com/jpthibault/{size}/209_2.png"},"bookmarked":false,"actions_summary":[],"moderator":false,"admin":false,"staff":false,"user_id":914,"hidden":false,"trust_level":1,"deleted_at":null,"user_deleted":false,"edit_reason":null,"can_view_edit_history":true,"wiki":false,"post_url":"/t/breaking-crp-level-1-stm32f103/1799/3","reactions":[],"current_user_reaction":null,"reaction_users_count":0,"current_user_used_main_reaction":false,"can_accept_answer":false,"can_unaccept_answer":false,"accepted_answer":false,"topic_accepted_answer":null},{"id":4245,"name":"Jean-Pierre Thibault","username":"jpthibault","avatar_template":"/user_avatar/forum.newae.com/jpthibault/{size}/209_2.png","created_at":"2020-02-08T13:40:03.771Z","cooked":"\u003cp\u003eThat might work but I don’t know whether the USB traffic can serve as a constant time reference?\u003cbr\u003e\nIdeally you’d customize the PhyWhisperer FPGA to sniff the JTAG itself. It’s got a bank of 8 I/Os that were put there for these kinds of situations. But it does require you to customize the FPGA bitfile yourself.\u003c/p\u003e\n\u003cp\u003eJean-Pierre\u003c/p\u003e","post_number":4,"post_type":1,"posts_count":24,"updated_at":"2020-02-08T13:40:03.771Z","reply_count":0,"reply_to_post_number":3,"quote_count":0,"incoming_link_count":36,"reads":73,"readers_count":72,"score":194.6,"yours":false,"topic_id":1799,"topic_slug":"breaking-crp-level-1-stm32f103","display_username":"Jean-Pierre Thibault","primary_group_name":null,"flair_name":null,"flair_url":null,"flair_bg_color":null,"flair_color":null,"flair_group_id":null,"badges_granted":[],"version":1,"can_edit":false,"can_delete":false,"can_recover":false,"can_see_hidden_post":false,"can_wiki":false,"read":true,"user_title":null,"reply_to_user":{"id":914,"username":"fridgyylife","name":"","avatar_template":"/letter_avatar_proxy/v4/letter/f/c37758/{size}.png"},"bookmarked":false,"actions_summary":[],"moderator":true,"admin":false,"staff":true,"user_id":776,"hidden":false,"trust_level":4,"deleted_at":null,"user_deleted":false,"edit_reason":null,"can_view_edit_history":true,"wiki":false,"post_url":"/t/breaking-crp-level-1-stm32f103/1799/4","reactions":[],"current_user_reaction":null,"reaction_users_count":0,"current_user_used_main_reaction":false,"can_accept_answer":false,"can_unaccept_answer":false,"accepted_answer":false,"topic_accepted_answer":null},{"id":4265,"name":"Nikita Shadrin","username":"NikSha","avatar_template":"/letter_avatar_proxy/v4/letter/n/a587f6/{size}.png","created_at":"2020-02-12T14:56:29.097Z","cooked":"\u003cp\u003eHello, fridgyylife\u003c/p\u003e\n\u003cp\u003eI has sucessful break crp level 1 on STM32F103 and script this here\u003c/p\u003e\u003caside class=\"onebox allowlistedgeneric\" data-onebox-src=\"https://habr.com/ru/companies/ntc-vulkan/articles/483732/\"\u003e\n  \u003cheader class=\"source\"\u003e\n      \u003cimg src=\"https://forum.newae.com/uploads/db3022/original/2X/0/05b4f202bb2963f420743a0ab7863dd2dd31484f.png\" class=\"site-icon\" data-dominant-color=\"97BFD2\" width=\"16\" height=\"16\"\u003e\n\n      \u003ca href=\"https://habr.com/ru/companies/ntc-vulkan/articles/483732/\" target=\"_blank\" rel=\"noopener nofollow ugc\"\u003eХабр\u003c/a\u003e\n  \u003c/header\u003e\n\n  \u003carticle class=\"onebox-body\"\u003e\n    \u003cdiv class=\"aspect-image\" style=\"--aspect-ratio:690/361;\"\u003e\u003cimg src=\"https://forum.newae.com/uploads/db3022/optimized/2X/e/e6082ce7f4cb295abb0deafb59bedc5fbb76f232_2_690x252.jpeg\" class=\"thumbnail\" data-dominant-color=\"C5C1C4\" width=\"690\" height=\"252\"\u003e\u003c/div\u003e\n\n\u003ch3\u003e\u003ca href=\"https://habr.com/ru/companies/ntc-vulkan/articles/483732/\" target=\"_blank\" rel=\"noopener nofollow ugc\"\u003eСчитывание защищенной прошивки из флеш-памяти STM32F1xx с использованием...\u003c/a\u003e\u003c/h3\u003e\n\n  \u003cp\u003eВ предыдущей статье мы разбирались с Vcc-glitch-атаками при помощи ChipWhisperer. Нашей дальнейшей целью стало поэтапное изучение процесса считывания защищенной прошивки микроконтроллеров. С помощью...\u003c/p\u003e\n\n\n  \u003c/article\u003e\n\n  \u003cdiv class=\"onebox-metadata\"\u003e\n    \n    \n  \u003c/div\u003e\n\n  \u003cdiv style=\"clear: both\"\u003e\u003c/div\u003e\n\u003c/aside\u003e\n\n\u003cp\u003eBest reguad,\u003cbr\u003e\nNik.\u003c/p\u003e","post_number":5,"post_type":1,"posts_count":24,"updated_at":"2020-02-12T14:56:29.097Z","reply_count":4,"reply_to_post_number":null,"quote_count":0,"incoming_link_count":22,"reads":69,"readers_count":68,"score":218.8,"yours":false,"topic_id":1799,"topic_slug":"breaking-crp-level-1-stm32f103","display_username":"Nikita Shadrin","primary_group_name":null,"flair_name":null,"flair_url":null,"flair_bg_color":null,"flair_color":null,"flair_group_id":null,"badges_granted":[],"version":1,"can_edit":false,"can_delete":false,"can_recover":false,"can_see_hidden_post":false,"can_wiki":false,"link_counts":[{"url":"https://habr.com/ru/companies/ntc-vulkan/articles/483732/","internal":false,"reflection":false,"title":"Считывание защищенной прошивки из флеш-памяти STM32F1xx с использованием ChipWhisperer / Хабр","clicks":108}],"read":true,"user_title":null,"bookmarked":false,"actions_summary":[{"id":2,"count":3}],"moderator":false,"admin":false,"staff":false,"user_id":746,"hidden":false,"trust_level":2,"deleted_at":null,"user_deleted":false,"edit_reason":null,"can_view_edit_history":true,"wiki":false,"post_url":"/t/breaking-crp-level-1-stm32f103/1799/5","reactions":[{"id":"heart","type":"emoji","count":3}],"current_user_reaction":null,"reaction_users_count":3,"current_user_used_main_reaction":false,"can_accept_answer":false,"can_unaccept_answer":false,"accepted_answer":false,"topic_accepted_answer":null},{"id":4743,"name":"Zefram","username":"zefram","avatar_template":"/letter_avatar_proxy/v4/letter/z/c67d28/{size}.png","created_at":"2020-06-14T17:16:16.207Z","cooked":"\u003cp\u003eHello I’m looking for to described metod for gain access to the flash memory at Stm32f103 . Do you can that now? Could you send me how to do that? Thanks.\u003c/p\u003e","post_number":6,"post_type":1,"posts_count":24,"updated_at":"2020-06-14T17:16:16.207Z","reply_count":0,"reply_to_post_number":null,"quote_count":0,"incoming_link_count":8,"reads":65,"readers_count":64,"score":53.0,"yours":false,"topic_id":1799,"topic_slug":"breaking-crp-level-1-stm32f103","display_username":"Zefram","primary_group_name":null,"flair_name":null,"flair_url":null,"flair_bg_color":null,"flair_color":null,"flair_group_id":null,"badges_granted":[],"version":1,"can_edit":false,"can_delete":false,"can_recover":false,"can_see_hidden_post":false,"can_wiki":false,"read":true,"user_title":null,"bookmarked":false,"actions_summary":[],"moderator":false,"admin":false,"staff":false,"user_id":975,"hidden":false,"trust_level":0,"deleted_at":null,"user_deleted":false,"edit_reason":null,"can_view_edit_history":true,"wiki":false,"post_url":"/t/breaking-crp-level-1-stm32f103/1799/6","reactions":[],"current_user_reaction":null,"reaction_users_count":0,"current_user_used_main_reaction":false,"can_accept_answer":false,"can_unaccept_answer":false,"accepted_answer":false,"topic_accepted_answer":null},{"id":5048,"name":"","username":"raxrip","avatar_template":"/letter_avatar_proxy/v4/letter/r/53a042/{size}.png","created_at":"2020-09-02T13:20:13.105Z","cooked":"\u003cp\u003eI am trying to do the “same” attack on my stm32f2 (set to rdp1) chip only that I attack the bootloader read mem cmd (0x11). (Like this Russian dud in the link above)\u003cbr\u003e\nBy sending the read command 0x11, 0xEE and then glitch just before I get the respond (nack) I from time to time hit the correct location where rdp is checked and I get an ack.\u003cbr\u003e\nI have set my trigger to tio2 (serial tx) and I arm the scope after sending 0x11 but before sending 0xEE.\u003cbr\u003e\nMy problem is that the time used to sending the byte 0xEE is not constant and after sending all bits I see my trigger point is off by 100 to 1000 clock cycles (clock @ 96mhz)\u003cbr\u003e\nFrom time to time (like after 50 to 100k glitches) I hit something that trigger a chip erase etc and after this I read only 0x00 bytes from the lower part of the chip flash.\u003c/p\u003e\n\u003cp\u003eDoes anyone know how I can set the trigger on the last bit transmitted over serial instead of the first bit so that I get a more accurate trigger point? (Or perhaps there is a better way to trigger?)\u003cbr\u003e\nAtm my offset is ~14000 clocks at 57600 bps serial speed (8E1) and if I could trigger the last bit I might reduce this offset to like ~1400 ish. I believe that the trigger could be a bit more accurate if I could do this.\u003c/p\u003e","post_number":7,"post_type":1,"posts_count":24,"updated_at":"2020-09-02T13:20:13.105Z","reply_count":1,"reply_to_post_number":null,"quote_count":0,"incoming_link_count":7,"reads":61,"readers_count":60,"score":52.2,"yours":false,"topic_id":1799,"topic_slug":"breaking-crp-level-1-stm32f103","display_username":"","primary_group_name":null,"flair_name":null,"flair_url":null,"flair_bg_color":null,"flair_color":null,"flair_group_id":null,"badges_granted":[],"version":1,"can_edit":false,"can_delete":false,"can_recover":false,"can_see_hidden_post":false,"can_wiki":false,"read":true,"user_title":null,"bookmarked":false,"actions_summary":[],"moderator":false,"admin":false,"staff":false,"user_id":999,"hidden":false,"trust_level":1,"deleted_at":null,"user_deleted":false,"edit_reason":null,"can_view_edit_history":true,"wiki":false,"post_url":"/t/breaking-crp-level-1-stm32f103/1799/7","reactions":[],"current_user_reaction":null,"reaction_users_count":0,"current_user_used_main_reaction":false,"can_accept_answer":false,"can_unaccept_answer":false,"accepted_answer":false,"topic_accepted_answer":null},{"id":5049,"name":"Adewar","username":"Alex_Dewar","avatar_template":"/letter_avatar_proxy/v4/letter/a/ea5d25/{size}.png","created_at":"2020-09-02T13:34:13.955Z","cooked":"\u003cp\u003eIt would be pretty tough to do that with the Lite, but the Pro does have an actual UART trigger. The same thing can be accomplished by using the trigger output of an oscilloscope if it has a UART trigger as well.\u003c/p\u003e","post_number":8,"post_type":1,"posts_count":24,"updated_at":"2020-09-02T13:34:13.955Z","reply_count":1,"reply_to_post_number":7,"quote_count":0,"incoming_link_count":1,"reads":58,"readers_count":57,"score":21.6,"yours":false,"topic_id":1799,"topic_slug":"breaking-crp-level-1-stm32f103","display_username":"Adewar","primary_group_name":null,"flair_name":null,"flair_url":null,"flair_bg_color":null,"flair_color":null,"flair_group_id":null,"badges_granted":[],"version":1,"can_edit":false,"can_delete":false,"can_recover":false,"can_see_hidden_post":false,"can_wiki":false,"read":true,"user_title":null,"reply_to_user":{"id":999,"username":"raxrip","name":"","avatar_template":"/letter_avatar_proxy/v4/letter/r/53a042/{size}.png"},"bookmarked":false,"actions_summary":[],"moderator":true,"admin":true,"staff":true,"user_id":512,"hidden":false,"trust_level":4,"deleted_at":null,"user_deleted":false,"edit_reason":null,"can_view_edit_history":true,"wiki":false,"post_url":"/t/breaking-crp-level-1-stm32f103/1799/8","reactions":[],"current_user_reaction":null,"reaction_users_count":0,"current_user_used_main_reaction":false,"can_accept_answer":false,"can_unaccept_answer":false,"accepted_answer":false,"topic_accepted_answer":null},{"id":5050,"name":"","username":"raxrip","avatar_template":"/letter_avatar_proxy/v4/letter/r/53a042/{size}.png","created_at":"2020-09-02T14:04:53.433Z","cooked":"\u003cp\u003eThat was one fast respond \u003cimg src=\"https://newae.discoursehosting.net/images/emoji/twitter/slight_smile.png?v=9\" title=\":slight_smile:\" class=\"emoji\" alt=\":slight_smile:\"\u003e\u003c/p\u003e\n\u003cp\u003eSo I guess there is no way to have like a trigger counter and after arm then trigger when trigger counter is equal to 10 ish?\u003cbr\u003e\nI do believe there is such a counter in there some place?\u003c/p\u003e","post_number":9,"post_type":1,"posts_count":24,"updated_at":"2020-09-02T14:04:53.433Z","reply_count":1,"reply_to_post_number":8,"quote_count":0,"incoming_link_count":4,"reads":58,"readers_count":57,"score":36.6,"yours":false,"topic_id":1799,"topic_slug":"breaking-crp-level-1-stm32f103","display_username":"","primary_group_name":null,"flair_name":null,"flair_url":null,"flair_bg_color":null,"flair_color":null,"flair_group_id":null,"badges_granted":[],"version":1,"can_edit":false,"can_delete":false,"can_recover":false,"can_see_hidden_post":false,"can_wiki":false,"read":true,"user_title":null,"reply_to_user":{"id":512,"username":"Alex_Dewar","name":"Adewar","avatar_template":"/letter_avatar_proxy/v4/letter/a/ea5d25/{size}.png"},"bookmarked":false,"actions_summary":[],"moderator":false,"admin":false,"staff":false,"user_id":999,"hidden":false,"trust_level":1,"deleted_at":null,"user_deleted":false,"edit_reason":null,"can_view_edit_history":true,"wiki":false,"post_url":"/t/breaking-crp-level-1-stm32f103/1799/9","reactions":[],"current_user_reaction":null,"reaction_users_count":0,"current_user_used_main_reaction":false,"can_accept_answer":false,"can_unaccept_answer":false,"accepted_answer":false,"topic_accepted_answer":null},{"id":5051,"name":"Adewar","username":"Alex_Dewar","avatar_template":"/letter_avatar_proxy/v4/letter/a/ea5d25/{size}.png","created_at":"2020-09-02T14:10:29.707Z","cooked":"\u003cp\u003eThere is a cycle counter between ADC trigger events (that’s \u003ccode\u003escope.adc.trig_count\u003c/code\u003e), but not a trigger counter itself. Your idea I think would be possible, but would require modifying the FPGA code.\u003c/p\u003e","post_number":10,"post_type":1,"posts_count":24,"updated_at":"2020-09-02T14:10:46.331Z","reply_count":1,"reply_to_post_number":9,"quote_count":0,"incoming_link_count":2,"reads":57,"readers_count":56,"score":26.4,"yours":false,"topic_id":1799,"topic_slug":"breaking-crp-level-1-stm32f103","display_username":"Adewar","primary_group_name":null,"flair_name":null,"flair_url":null,"flair_bg_color":null,"flair_color":null,"flair_group_id":null,"badges_granted":[],"version":1,"can_edit":false,"can_delete":false,"can_recover":false,"can_see_hidden_post":false,"can_wiki":false,"read":true,"user_title":null,"reply_to_user":{"id":999,"username":"raxrip","name":"","avatar_template":"/letter_avatar_proxy/v4/letter/r/53a042/{size}.png"},"bookmarked":false,"actions_summary":[],"moderator":true,"admin":true,"staff":true,"user_id":512,"hidden":false,"trust_level":4,"deleted_at":null,"user_deleted":false,"edit_reason":null,"can_view_edit_history":true,"wiki":false,"post_url":"/t/breaking-crp-level-1-stm32f103/1799/10","reactions":[],"current_user_reaction":null,"reaction_users_count":0,"current_user_used_main_reaction":false,"can_accept_answer":false,"can_unaccept_answer":false,"accepted_answer":false,"topic_accepted_answer":null},{"id":5052,"name":"","username":"raxrip","avatar_template":"/letter_avatar_proxy/v4/letter/r/53a042/{size}.png","created_at":"2020-09-02T14:20:43.750Z","cooked":"\u003cp\u003eI am pretty new to this so for me to mod the FPGA is probably not the best idea \u003cimg src=\"https://newae.discoursehosting.net/images/emoji/twitter/slight_smile.png?v=9\" title=\":slight_smile:\" class=\"emoji\" alt=\":slight_smile:\"\u003e\u003cbr\u003e\nBut perhaps this is something that others also could use and could be a nice feature for an upcoming update?\u003cbr\u003e\nBtw. Will the FPGA be updated automatically when I pull new updates from git or do I have to manually update it?\u003c/p\u003e\n\u003cp\u003eAnyway. That idea using the scope / something else as a trigger was a good one.\u003cbr\u003e\nI can use some external STM/Nucleo chip set up with an interrupt on a pin and let it could the bits transmitted over serial for so to trigger the CW when last bit is to be transmitter.\u003c/p\u003e\n\u003cp\u003eThank you for your help \u003cimg src=\"https://newae.discoursehosting.net/images/emoji/twitter/slight_smile.png?v=9\" title=\":slight_smile:\" class=\"emoji\" alt=\":slight_smile:\"\u003e\u003c/p\u003e","post_number":11,"post_type":1,"posts_count":24,"updated_at":"2020-09-02T14:20:43.750Z","reply_count":1,"reply_to_post_number":10,"quote_count":0,"incoming_link_count":5,"reads":55,"readers_count":54,"score":41.0,"yours":false,"topic_id":1799,"topic_slug":"breaking-crp-level-1-stm32f103","display_username":"","primary_group_name":null,"flair_name":null,"flair_url":null,"flair_bg_color":null,"flair_color":null,"flair_group_id":null,"badges_granted":[],"version":1,"can_edit":false,"can_delete":false,"can_recover":false,"can_see_hidden_post":false,"can_wiki":false,"read":true,"user_title":null,"reply_to_user":{"id":512,"username":"Alex_Dewar","name":"Adewar","avatar_template":"/letter_avatar_proxy/v4/letter/a/ea5d25/{size}.png"},"bookmarked":false,"actions_summary":[],"moderator":false,"admin":false,"staff":false,"user_id":999,"hidden":false,"trust_level":1,"deleted_at":null,"user_deleted":false,"edit_reason":null,"can_view_edit_history":true,"wiki":false,"post_url":"/t/breaking-crp-level-1-stm32f103/1799/11","reactions":[],"current_user_reaction":null,"reaction_users_count":0,"current_user_used_main_reaction":false,"can_accept_answer":false,"can_unaccept_answer":false,"accepted_answer":false,"topic_accepted_answer":null},{"id":5053,"name":"Adewar","username":"Alex_Dewar","avatar_template":"/letter_avatar_proxy/v4/letter/a/ea5d25/{size}.png","created_at":"2020-09-02T14:37:04.929Z","cooked":"\u003cp\u003eThe FPGA gets reprogrammed every time you power cycle + connect, so as long as you’re on the latest software update, you should have the latest FPGA code. I believe we have updates/fixes for the FPGA somewhere (probably far away) in the pipeline, so we’ll keep this in mind when we take a look at that \u003cimg src=\"https://newae.discoursehosting.net/images/emoji/twitter/slight_smile.png?v=9\" title=\":slight_smile:\" class=\"emoji\" alt=\":slight_smile:\"\u003e .\u003c/p\u003e","post_number":12,"post_type":1,"posts_count":24,"updated_at":"2020-09-02T14:37:04.929Z","reply_count":0,"reply_to_post_number":11,"quote_count":0,"incoming_link_count":2,"reads":56,"readers_count":55,"score":21.2,"yours":false,"topic_id":1799,"topic_slug":"breaking-crp-level-1-stm32f103","display_username":"Adewar","primary_group_name":null,"flair_name":null,"flair_url":null,"flair_bg_color":null,"flair_color":null,"flair_group_id":null,"badges_granted":[],"version":1,"can_edit":false,"can_delete":false,"can_recover":false,"can_see_hidden_post":false,"can_wiki":false,"read":true,"user_title":null,"reply_to_user":{"id":999,"username":"raxrip","name":"","avatar_template":"/letter_avatar_proxy/v4/letter/r/53a042/{size}.png"},"bookmarked":false,"actions_summary":[],"moderator":true,"admin":true,"staff":true,"user_id":512,"hidden":false,"trust_level":4,"deleted_at":null,"user_deleted":false,"edit_reason":null,"can_view_edit_history":true,"wiki":false,"post_url":"/t/breaking-crp-level-1-stm32f103/1799/12","reactions":[],"current_user_reaction":null,"reaction_users_count":0,"current_user_used_main_reaction":false,"can_accept_answer":false,"can_unaccept_answer":false,"accepted_answer":false,"topic_accepted_answer":null},{"id":5180,"name":"","username":"raxrip","avatar_template":"/letter_avatar_proxy/v4/letter/r/53a042/{size}.png","created_at":"2020-09-22T15:09:34.621Z","cooked":"\u003cp\u003eI have implemented CAN bus support and this is much more stable now that I can control the external clock. I run the hs2 at 24MHz and by counting the number of rising edges I see in the CAN msg I send I am able to set a trigger on the last edge just before CAN EOF (7 recessive bit) is sent. (Coz of bit stuffing I calc this number at runtime)\u003cbr\u003e\nThis will trigger the CW to glitch with an offset of 1560 clock cycles and my range is from 1560 -\u0026gt; 1562. This is way more stable compared to using serial.\u003cbr\u003e\nBut now since I run the clock at 24 Mhz I loos a bit of resolution and I would think that if I could run the glitcher at 96Mhz and the hs2 at 24Mhz I would get an even better glitch offset.\u003cbr\u003e\nThe reason for this is that from one chip to another I see that going from 1560 to 1561 is to fare and the result is only zero when I read a block (256 bytes).\u003cbr\u003e\nI can get around this by adding a nop or two just before I trigger CW but I think if I could run the glitcher at 96Mhz I could drop these nops.\u003c/p\u003e\n\u003cp\u003eQ1) Is it possible to set the internal clock on the CW to say 96Mhz and still be able to use hs2 to clock the STM chip at 24MHz?\u003c/p\u003e\n\u003cp\u003eI have had great success with both “glitch_only” and “enable_only” but the last one was better when running at 96 MHz using a repeat of 3. This is a bit smaller I think compared to repeat 1 at 24Mhz. Using the “glitch_only” I can set a smaller width and a bit different offset if I understand this correctly but I am still a bit confused about the negative width and offset.\u003c/p\u003e\n\u003cp\u003eLets say a the start of a clock is when the edge is rising and the middle is where it goes down and the end is where the next clock start (rising again)\u003c/p\u003e\n\u003cp\u003eQ2) Will offset -50 be at the start? And offset 0 in the middle? And offset +50 at the end?\u003cbr\u003e\nIf so then say I have a offset of -40 then how can I have a negative width? Will a with of -10 in this case be the same as using offset -50 and a width of +10 (Just like a negative width goes backwards in time)?\u003c/p\u003e","post_number":13,"post_type":1,"posts_count":24,"updated_at":"2020-09-22T15:09:34.621Z","reply_count":2,"reply_to_post_number":null,"quote_count":0,"incoming_link_count":33,"reads":56,"readers_count":55,"score":186.2,"yours":false,"topic_id":1799,"topic_slug":"breaking-crp-level-1-stm32f103","display_username":"","primary_group_name":null,"flair_name":null,"flair_url":null,"flair_bg_color":null,"flair_color":null,"flair_group_id":null,"badges_granted":[],"version":1,"can_edit":false,"can_delete":false,"can_recover":false,"can_see_hidden_post":false,"can_wiki":false,"read":true,"user_title":null,"bookmarked":false,"actions_summary":[],"moderator":false,"admin":false,"staff":false,"user_id":999,"hidden":false,"trust_level":1,"deleted_at":null,"user_deleted":false,"edit_reason":null,"can_view_edit_history":true,"wiki":false,"post_url":"/t/breaking-crp-level-1-stm32f103/1799/13","reactions":[],"current_user_reaction":null,"reaction_users_count":0,"current_user_used_main_reaction":false,"can_accept_answer":false,"can_unaccept_answer":false,"accepted_answer":false,"topic_accepted_answer":null},{"id":5194,"name":"Adewar","username":"Alex_Dewar","avatar_template":"/letter_avatar_proxy/v4/letter/a/ea5d25/{size}.png","created_at":"2020-09-24T12:04:12.045Z","cooked":"\u003col\u003e\n\u003cli\u003e\n\u003cp\u003eI think you could generate the clock externally and feed it into both the STM and the ChipWhisperer, which would allow you to use the CW’s clkgen to generate whatever clock you wanted.\u003c/p\u003e\n\u003c/li\u003e\n\u003cli\u003e\n\u003cp\u003eThe enable signal for the glitch will start on the falling edge of the delayed glitch clock. This diagram might make things a little clearer:\u003c/p\u003e\n\u003c/li\u003e\n\u003c/ol\u003e\n\u003cp\u003e\u003cdiv class=\"lightbox-wrapper\"\u003e\u003ca class=\"lightbox\" href=\"https://forum.newae.com/uploads/db3022/original/1X/23a69b11f7e70adb0d5098cd587a2c045b02cec3.png\" data-download-href=\"https://forum.newae.com/uploads/db3022/23a69b11f7e70adb0d5098cd587a2c045b02cec3\" title=\"\"\u003e\u003cimg src=\"https://forum.newae.com/uploads/db3022/optimized/1X/23a69b11f7e70adb0d5098cd587a2c045b02cec3_2_690x248.png\" alt=\"\" data-base62-sha1=\"55nF57Ml89k6UOON4SWKhcHYx2P\" role=\"presentation\" width=\"690\" height=\"248\" srcset=\"https://forum.newae.com/uploads/db3022/optimized/1X/23a69b11f7e70adb0d5098cd587a2c045b02cec3_2_690x248.png, https://forum.newae.com/uploads/db3022/optimized/1X/23a69b11f7e70adb0d5098cd587a2c045b02cec3_2_1035x372.png 1.5x, https://forum.newae.com/uploads/db3022/optimized/1X/23a69b11f7e70adb0d5098cd587a2c045b02cec3_2_1380x496.png 2x\" data-dominant-color=\"F9F6F7\"\u003e\u003cdiv class=\"meta\"\u003e\u003csvg class=\"fa d-icon d-icon-far-image svg-icon\" aria-hidden=\"true\"\u003e\u003cuse href=\"#far-image\"\u003e\u003c/use\u003e\u003c/svg\u003e\u003cspan class=\"filename\"\u003e\u003c/span\u003e\u003cspan class=\"informations\"\u003e2502×902 139 KB\u003c/span\u003e\u003csvg class=\"fa d-icon d-icon-discourse-expand svg-icon\" aria-hidden=\"true\"\u003e\u003cuse href=\"#discourse-expand\"\u003e\u003c/use\u003e\u003c/svg\u003e\u003c/div\u003e\u003c/a\u003e\u003c/div\u003e\u003c/p\u003e\n\u003cp\u003eThough move the rising edge of the enable signal to the falling edge of \u003cspan class=\"hashtag-raw\"\u003e#1\u003c/span\u003e due to recent changes.\u003c/p\u003e\n\u003cp\u003eAlex\u003c/p\u003e","post_number":14,"post_type":1,"posts_count":24,"updated_at":"2020-09-24T12:09:18.098Z","reply_count":0,"reply_to_post_number":13,"quote_count":0,"incoming_link_count":13,"reads":57,"readers_count":56,"score":76.4,"yours":false,"topic_id":1799,"topic_slug":"breaking-crp-level-1-stm32f103","display_username":"Adewar","primary_group_name":null,"flair_name":null,"flair_url":null,"flair_bg_color":null,"flair_color":null,"flair_group_id":null,"badges_granted":[],"version":2,"can_edit":false,"can_delete":false,"can_recover":false,"can_see_hidden_post":false,"can_wiki":false,"read":true,"user_title":null,"reply_to_user":{"id":999,"username":"raxrip","name":"","avatar_template":"/letter_avatar_proxy/v4/letter/r/53a042/{size}.png"},"bookmarked":false,"actions_summary":[],"moderator":true,"admin":true,"staff":true,"user_id":512,"hidden":false,"trust_level":4,"deleted_at":null,"user_deleted":false,"edit_reason":"downloaded local copies of images","can_view_edit_history":true,"wiki":false,"post_url":"/t/breaking-crp-level-1-stm32f103/1799/14","reactions":[],"current_user_reaction":null,"reaction_users_count":0,"current_user_used_main_reaction":false,"can_accept_answer":false,"can_unaccept_answer":false,"accepted_answer":false,"topic_accepted_answer":null},{"id":5891,"name":"","username":"FabFurlough","avatar_template":"/letter_avatar_proxy/v4/letter/f/a8b319/{size}.png","created_at":"2021-02-28T19:16:29.312Z","cooked":"\u003cp\u003eNik,\u003c/p\u003e\n\u003cp\u003eWhere can I get the jupyter notebook that you used for this?\u003c/p\u003e","post_number":15,"post_type":1,"posts_count":24,"updated_at":"2021-02-28T19:16:29.312Z","reply_count":0,"reply_to_post_number":5,"quote_count":0,"incoming_link_count":5,"reads":48,"readers_count":47,"score":34.6,"yours":false,"topic_id":1799,"topic_slug":"breaking-crp-level-1-stm32f103","display_username":"","primary_group_name":null,"flair_name":null,"flair_url":null,"flair_bg_color":null,"flair_color":null,"flair_group_id":null,"badges_granted":[],"version":1,"can_edit":false,"can_delete":false,"can_recover":false,"can_see_hidden_post":false,"can_wiki":false,"read":true,"user_title":null,"reply_to_user":{"id":746,"username":"NikSha","name":"Nikita Shadrin","avatar_template":"/letter_avatar_proxy/v4/letter/n/a587f6/{size}.png"},"bookmarked":false,"actions_summary":[],"moderator":false,"admin":false,"staff":false,"user_id":1082,"hidden":false,"trust_level":0,"deleted_at":null,"user_deleted":false,"edit_reason":null,"can_view_edit_history":true,"wiki":false,"post_url":"/t/breaking-crp-level-1-stm32f103/1799/15","reactions":[],"current_user_reaction":null,"reaction_users_count":0,"current_user_used_main_reaction":false,"can_accept_answer":false,"can_unaccept_answer":false,"accepted_answer":false,"topic_accepted_answer":null},{"id":7083,"name":"Gabor","username":"mrx23dot","avatar_template":"/letter_avatar_proxy/v4/letter/m/b5e925/{size}.png","created_at":"2021-09-03T12:38:27.745Z","cooked":"\u003cp\u003eHello,\u003cbr\u003e\nCould someone explain exactly where to put the glitch?\u003c/p\u003e\n\u003cp\u003e0x11 - 0xEE - ACK\u003c/p\u003e\n\u003cp\u003eIs it after 0x11 shifted out but 0xEE not started yet?\u003cbr\u003e\nOr is it during 0xEE?\u003cbr\u003e\nOr is it after 0xEE and before ACK received?\u003c/p\u003e\n\u003cp\u003eAlso with some timing that worked for you.\u003c/p\u003e\n\u003cp\u003eThank you!\u003c/p\u003e","post_number":17,"post_type":1,"posts_count":24,"updated_at":"2021-09-03T12:38:27.745Z","reply_count":1,"reply_to_post_number":null,"quote_count":0,"incoming_link_count":2,"reads":48,"readers_count":47,"score":24.6,"yours":false,"topic_id":1799,"topic_slug":"breaking-crp-level-1-stm32f103","display_username":"Gabor","primary_group_name":null,"flair_name":null,"flair_url":null,"flair_bg_color":null,"flair_color":null,"flair_group_id":null,"badges_granted":[],"version":1,"can_edit":false,"can_delete":false,"can_recover":false,"can_see_hidden_post":false,"can_wiki":false,"read":true,"user_title":"","bookmarked":false,"actions_summary":[],"moderator":false,"admin":false,"staff":false,"user_id":1188,"hidden":false,"trust_level":0,"deleted_at":null,"user_deleted":false,"edit_reason":null,"can_view_edit_history":true,"wiki":false,"post_url":"/t/breaking-crp-level-1-stm32f103/1799/17","reactions":[],"current_user_reaction":null,"reaction_users_count":0,"current_user_used_main_reaction":false,"can_accept_answer":false,"can_unaccept_answer":false,"accepted_answer":false,"topic_accepted_answer":null},{"id":7369,"name":null,"username":"Nick","avatar_template":"/letter_avatar_proxy/v4/letter/n/f9ae1b/{size}.png","created_at":"2021-10-18T18:05:18.014Z","cooked":"\u003cp\u003eHi, I know this is quite late but would you happen to have the notebook available for download?\u003c/p\u003e\n\u003cp\u003eThanks,\u003c/p\u003e\n\u003cp\u003eNick\u003c/p\u003e","post_number":18,"post_type":1,"posts_count":24,"updated_at":"2021-10-18T18:05:18.014Z","reply_count":0,"reply_to_post_number":5,"quote_count":0,"incoming_link_count":0,"reads":41,"readers_count":40,"score":8.2,"yours":false,"topic_id":1799,"topic_slug":"breaking-crp-level-1-stm32f103","display_username":null,"primary_group_name":null,"flair_name":null,"flair_url":null,"flair_bg_color":null,"flair_color":null,"flair_group_id":null,"badges_granted":[],"version":1,"can_edit":false,"can_delete":false,"can_recover":false,"can_see_hidden_post":false,"can_wiki":false,"read":true,"user_title":null,"reply_to_user":{"id":746,"username":"NikSha","name":"Nikita Shadrin","avatar_template":"/letter_avatar_proxy/v4/letter/n/a587f6/{size}.png"},"bookmarked":false,"actions_summary":[],"moderator":false,"admin":false,"staff":false,"user_id":1177,"hidden":false,"trust_level":1,"deleted_at":null,"user_deleted":false,"edit_reason":null,"can_view_edit_history":true,"wiki":false,"post_url":"/t/breaking-crp-level-1-stm32f103/1799/18","reactions":[],"current_user_reaction":null,"reaction_users_count":0,"current_user_used_main_reaction":false,"can_accept_answer":false,"can_unaccept_answer":false,"accepted_answer":false,"topic_accepted_answer":null},{"id":7375,"name":"","username":"Andy","avatar_template":"/user_avatar/forum.newae.com/andy/{size}/1036_2.png","created_at":"2021-10-19T16:31:46.082Z","cooked":"\u003cp\u003eDid you ever manage to get it more stable and not erase itself while dumping? I am currently trying to read out some firmware and I am slowly but surely descending into a black pit of despair because no matter what I do, the chip erases itself after a handful of successful glitches all the time.\u003c/p\u003e\n\u003cp\u003eI can also see a some jitter between the CAN message arriving at the target and the response that is sent out. I suspect that this is the reason I am occasionally hitting the wrong spot that triggers the chip erase. I just fear that this isn’t something I can prevent.\u003c/p\u003e","post_number":19,"post_type":1,"posts_count":24,"updated_at":"2021-10-19T16:31:46.082Z","reply_count":1,"reply_to_post_number":13,"quote_count":0,"incoming_link_count":4,"reads":42,"readers_count":41,"score":33.4,"yours":false,"topic_id":1799,"topic_slug":"breaking-crp-level-1-stm32f103","display_username":"","primary_group_name":null,"flair_name":null,"flair_url":null,"flair_bg_color":null,"flair_color":null,"flair_group_id":null,"badges_granted":[],"version":1,"can_edit":false,"can_delete":false,"can_recover":false,"can_see_hidden_post":false,"can_wiki":false,"read":true,"user_title":null,"reply_to_user":{"id":999,"username":"raxrip","name":"","avatar_template":"/letter_avatar_proxy/v4/letter/r/53a042/{size}.png"},"bookmarked":false,"actions_summary":[],"moderator":false,"admin":false,"staff":false,"user_id":1216,"hidden":false,"trust_level":1,"deleted_at":null,"user_deleted":false,"edit_reason":null,"can_view_edit_history":true,"wiki":false,"post_url":"/t/breaking-crp-level-1-stm32f103/1799/19","reactions":[],"current_user_reaction":null,"reaction_users_count":0,"current_user_used_main_reaction":false,"can_accept_answer":false,"can_unaccept_answer":false,"accepted_answer":false,"topic_accepted_answer":null},{"id":7510,"name":"","username":"raxrip","avatar_template":"/letter_avatar_proxy/v4/letter/r/53a042/{size}.png","created_at":"2021-11-04T19:51:01.671Z","cooked":"\u003cp\u003eMy glitcher is pretty stable now and I can read out a lot of 256 bytes block before I hit a chip erase. (My targets are the STM32F2 and STM32F4 where the F4 needed even more stable glitches)\u003cbr\u003e\nI use CAN only (USART is way to unstable) and just after I send a CAN msg I power cycle the chip for so to try again. If a chip erase is triggered then only the first sector is erased and this is why I dump this sector 2-3 times before I continue. (from time to time I get the wrong data on these addresses)\u003cbr\u003e\nUsing this approach I can see that the first sector is erased but the rest of the chip’s content is intact. Dumping the F4 1meg version takes like ~20hrs and only the first sector will be erased.\u003cbr\u003e\nSo not the best solution but it “works”. And yes. I believe I could be unlucky and hit an erase before finishing the first sector but that have never happened to me yet \u003cimg src=\"https://newae.discoursehosting.net/images/emoji/twitter/slight_smile.png?v=9\" title=\":slight_smile:\" class=\"emoji\" alt=\":slight_smile:\"\u003e\u003c/p\u003e\n\u003cp\u003eI ordered a lot of chips from AliExpress coz I could see that many of these “brand new” chips came with RDP1 set. I could then dump these chips and see the original content…\u003c/p\u003e\n\u003cp\u003eHop this helps.\u003c/p\u003e","post_number":20,"post_type":1,"posts_count":24,"updated_at":"2021-11-04T19:51:01.671Z","reply_count":1,"reply_to_post_number":19,"quote_count":0,"incoming_link_count":19,"reads":42,"readers_count":41,"score":103.4,"yours":false,"topic_id":1799,"topic_slug":"breaking-crp-level-1-stm32f103","display_username":"","primary_group_name":null,"flair_name":null,"flair_url":null,"flair_bg_color":null,"flair_color":null,"flair_group_id":null,"badges_granted":[],"version":1,"can_edit":false,"can_delete":false,"can_recover":false,"can_see_hidden_post":false,"can_wiki":false,"read":true,"user_title":null,"reply_to_user":{"id":1216,"username":"Andy","name":"","avatar_template":"/user_avatar/forum.newae.com/andy/{size}/1036_2.png"},"bookmarked":false,"actions_summary":[],"moderator":false,"admin":false,"staff":false,"user_id":999,"hidden":false,"trust_level":1,"deleted_at":null,"user_deleted":false,"edit_reason":null,"can_view_edit_history":true,"wiki":false,"post_url":"/t/breaking-crp-level-1-stm32f103/1799/20","reactions":[],"current_user_reaction":null,"reaction_users_count":0,"current_user_used_main_reaction":false,"can_accept_answer":false,"can_unaccept_answer":false,"accepted_answer":false,"topic_accepted_answer":null},{"id":7511,"name":"","username":"raxrip","avatar_template":"/letter_avatar_proxy/v4/letter/r/53a042/{size}.png","created_at":"2021-11-04T20:28:09.492Z","cooked":"\u003cp\u003e\u003cdiv class=\"lightbox-wrapper\"\u003e\u003ca class=\"lightbox\" href=\"https://forum.newae.com/uploads/db3022/original/2X/d/de228fcf3ac6f2ce85a6551e9c82f2b57590ff11.png\" data-download-href=\"https://forum.newae.com/uploads/db3022/de228fcf3ac6f2ce85a6551e9c82f2b57590ff11\" title=\"UsART_Glitch\"\u003e\u003cimg src=\"https://forum.newae.com/uploads/db3022/optimized/2X/d/de228fcf3ac6f2ce85a6551e9c82f2b57590ff11_2_667x500.png\" alt=\"UsART_Glitch\" data-base62-sha1=\"vH62Tmokm5uV4rRgy7X8xMlmJTH\" width=\"667\" height=\"500\" srcset=\"https://forum.newae.com/uploads/db3022/optimized/2X/d/de228fcf3ac6f2ce85a6551e9c82f2b57590ff11_2_667x500.png, https://forum.newae.com/uploads/db3022/original/2X/d/de228fcf3ac6f2ce85a6551e9c82f2b57590ff11.png 1.5x, https://forum.newae.com/uploads/db3022/original/2X/d/de228fcf3ac6f2ce85a6551e9c82f2b57590ff11.png 2x\" data-dominant-color=\"6B6A67\"\u003e\u003cdiv class=\"meta\"\u003e\u003csvg class=\"fa d-icon d-icon-far-image svg-icon\" aria-hidden=\"true\"\u003e\u003cuse href=\"#far-image\"\u003e\u003c/use\u003e\u003c/svg\u003e\u003cspan class=\"filename\"\u003eUsART_Glitch\u003c/span\u003e\u003cspan class=\"informations\"\u003e800×599 628 KB\u003c/span\u003e\u003csvg class=\"fa d-icon d-icon-discourse-expand svg-icon\" aria-hidden=\"true\"\u003e\u003cuse href=\"#discourse-expand\"\u003e\u003c/use\u003e\u003c/svg\u003e\u003c/div\u003e\u003c/a\u003e\u003c/div\u003e\u003c/p\u003e\n\u003cp\u003eYou can see the end of the 0xEE byte and just after this the blue spike is where the CW is triggered. The green dip is where I placed the glitch but again, for the F2 and F4 this was way to unstable for me and triggered a chip erase pretty often.\u003c/p\u003e","post_number":21,"post_type":1,"posts_count":24,"updated_at":"2021-11-04T20:28:09.492Z","reply_count":0,"reply_to_post_number":17,"quote_count":0,"incoming_link_count":9,"reads":42,"readers_count":41,"score":53.4,"yours":false,"topic_id":1799,"topic_slug":"breaking-crp-level-1-stm32f103","display_username":"","primary_group_name":null,"flair_name":null,"flair_url":null,"flair_bg_color":null,"flair_color":null,"flair_group_id":null,"badges_granted":[],"version":1,"can_edit":false,"can_delete":false,"can_recover":false,"can_see_hidden_post":false,"can_wiki":false,"read":true,"user_title":null,"reply_to_user":{"id":1188,"username":"mrx23dot","name":"Gabor","avatar_template":"/letter_avatar_proxy/v4/letter/m/b5e925/{size}.png"},"bookmarked":false,"actions_summary":[],"moderator":false,"admin":false,"staff":false,"user_id":999,"hidden":false,"trust_level":1,"deleted_at":null,"user_deleted":false,"edit_reason":null,"can_view_edit_history":true,"wiki":false,"post_url":"/t/breaking-crp-level-1-stm32f103/1799/21","reactions":[],"current_user_reaction":null,"reaction_users_count":0,"current_user_used_main_reaction":false,"can_accept_answer":false,"can_unaccept_answer":false,"accepted_answer":false,"topic_accepted_answer":null}],"stream":[4237,4241,4244,4245,4265,4743,5048,5049,5050,5051,5052,5053,5180,5194,5891,7083,7369,7375,7510,7511,7516,7518,10043,13728]},"timeline_lookup":[[1,2460],[5,2456],[6,2333],[7,2253],[13,2233],[14,2231],[15,2073],[16,1887],[17,1842],[18,1841],[19,1824],[23,1453],[24,821]],"fancy_title":"Breaking crp level 1 stm32f103","id":1799,"title":"Breaking crp level 1 stm32f103","posts_count":24,"created_at":"2020-02-07T20:49:43.871Z","views":5040,"reply_count":17,"like_count":3,"last_posted_at":"2024-08-03T20:41:12.658Z","visible":true,"closed":false,"archived":false,"has_summary":false,"archetype":"regular","slug":"breaking-crp-level-1-stm32f103","category_id":1,"word_count":2467,"deleted_at":null,"user_id":914,"featured_link":null,"pinned_globally":false,"pinned_at":null,"pinned_until":null,"image_url":null,"slow_mode_seconds":0,"draft":null,"draft_key":"topic_1799","draft_sequence":null,"unpinned":null,"pinned":false,"current_post_number":1,"highest_post_number":25,"deleted_by":null,"actions_summary":[{"id":4,"count":0,"hidden":false,"can_act":false},{"id":8,"count":0,"hidden":false,"can_act":false},{"id":10,"count":0,"hidden":false,"can_act":false},{"id":7,"count":0,"hidden":false,"can_act":false}],"chunk_size":20,"bookmarked":false,"topic_timer":null,"message_bus_last_id":0,"participant_count":12,"show_read_indicator":false,"thumbnails":null,"slow_mode_enabled_until":null,"tags_disable_ads":false,"summarizable":false,"has_cached_summary":false,"valid_reactions":["heart","+1","laughing","open_mouth","clap","confetti_ball","hugs"],"has_accepted_answer":false,"can_create_shared_issue":false,"shared_issue_visible":false,"discourse_zendesk_plugin_zendesk_id":null,"discourse_zendesk_plugin_zendesk_url":"https://your-url.zendesk.com/agent/tickets/","details":{"can_edit":false,"notification_level":1,"participants":[{"id":999,"username":"raxrip","name":"","avatar_template":"/letter_avatar_proxy/v4/letter/r/53a042/{size}.png","post_count":7,"primary_group_name":null,"flair_name":null,"flair_url":null,"flair_color":null,"flair_bg_color":null,"flair_group_id":null,"trust_level":1},{"id":512,"username":"Alex_Dewar","name":"Adewar","avatar_template":"/letter_avatar_proxy/v4/letter/a/ea5d25/{size}.png","post_count":4,"primary_group_name":null,"flair_name":null,"flair_url":null,"flair_color":null,"flair_bg_color":null,"flair_group_id":null,"admin":true,"moderator":true,"trust_level":4},{"id":776,"username":"jpthibault","name":"Jean-Pierre Thibault","avatar_template":"/user_avatar/forum.newae.com/jpthibault/{size}/209_2.png","post_count":2,"primary_group_name":null,"flair_name":null,"flair_url":null,"flair_color":null,"flair_bg_color":null,"flair_group_id":null,"moderator":true,"trust_level":4},{"id":1216,"username":"Andy","name":"","avatar_template":"/user_avatar/forum.newae.com/andy/{size}/1036_2.png","post_count":2,"primary_group_name":null,"flair_name":null,"flair_url":null,"flair_color":null,"flair_bg_color":null,"flair_group_id":null,"trust_level":1},{"id":914,"username":"fridgyylife","name":"","avatar_template":"/letter_avatar_proxy/v4/letter/f/c37758/{size}.png","post_count":2,"primary_group_name":null,"flair_name":null,"flair_url":null,"flair_color":null,"flair_bg_color":null,"flair_group_id":null,"trust_level":1},{"id":1188,"username":"mrx23dot","name":"Gabor","avatar_template":"/letter_avatar_proxy/v4/letter/m/b5e925/{size}.png","post_count":1,"primary_group_name":null,"flair_name":null,"flair_url":null,"flair_color":null,"flair_bg_color":null,"flair_group_id":null,"trust_level":0},{"id":1424,"username":"heisenberg_88","name":"heisenberg_88","avatar_template":"/letter_avatar_proxy/v4/letter/h/e0b2c6/{size}.png","post_count":1,"primary_group_name":null,"flair_name":null,"flair_url":null,"flair_color":null,"flair_bg_color":null,"flair_group_id":null,"trust_level":1},{"id":1933,"username":"manizzle","name":"","avatar_template":"/letter_avatar_proxy/v4/letter/m/e0b2c6/{size}.png","post_count":1,"primary_group_name":null,"flair_name":null,"flair_url":null,"flair_color":null,"flair_bg_color":null,"flair_group_id":null,"trust_level":1},{"id":746,"username":"NikSha","name":"Nikita Shadrin","avatar_template":"/letter_avatar_proxy/v4/letter/n/a587f6/{size}.png","post_count":1,"primary_group_name":null,"flair_name":null,"flair_url":null,"flair_color":null,"flair_bg_color":null,"flair_group_id":null,"trust_level":2},{"id":975,"username":"zefram","name":"Zefram","avatar_template":"/letter_avatar_proxy/v4/letter/z/c67d28/{size}.png","post_count":1,"primary_group_name":null,"flair_name":null,"flair_url":null,"flair_color":null,"flair_bg_color":null,"flair_group_id":null,"trust_level":0},{"id":1082,"username":"FabFurlough","name":"","avatar_template":"/letter_avatar_proxy/v4/letter/f/a8b319/{size}.png","post_count":1,"primary_group_name":null,"flair_name":null,"flair_url":null,"flair_color":null,"flair_bg_color":null,"flair_group_id":null,"trust_level":0},{"id":1177,"username":"Nick","name":null,"avatar_template":"/letter_avatar_proxy/v4/letter/n/f9ae1b/{size}.png","post_count":1,"primary_group_name":null,"flair_name":null,"flair_url":null,"flair_color":null,"flair_bg_color":null,"flair_group_id":null,"trust_level":1}],"created_by":{"id":914,"username":"fridgyylife","name":"","avatar_template":"/letter_avatar_proxy/v4/letter/f/c37758/{size}.png"},"last_poster":{"id":1933,"username":"manizzle","name":"","avatar_template":"/letter_avatar_proxy/v4/letter/m/e0b2c6/{size}.png"},"links":[{"url":"https://www.google.com/url?sa=t\u0026source=web\u0026rct=j\u0026url=https://tches.iacr.org/index.php/TCHES/article/download/7390/6562/\u0026ved=2ahUKEwi087W0p8DnAhV30TgGHVQ8BPkQFjABegQIBRAM\u0026usg=AOvVaw3Yf850otJLHvHHJiRQLcVi","title":null,"internal":false,"attachment":false,"reflection":false,"clicks":178,"user_id":914,"domain":"www.google.com","root_domain":"google.com"},{"url":"https://habr.com/ru/companies/ntc-vulkan/articles/483732/","title":"Считывание защищенной прошивки из флеш-памяти STM32F1xx с использованием ChipWhisperer / Хабр","internal":false,"attachment":false,"reflection":false,"clicks":108,"user_id":746,"domain":"habr.com","root_domain":"habr.com"},{"url":"https://toothless.co/blog/bootloader-bypass-part1/","title":null,"internal":false,"attachment":false,"reflection":false,"clicks":85,"user_id":776,"domain":"toothless.co","root_domain":"toothless.co"},{"url":"https://github.com/newaetech/phywhispererusb","title":"GitHub - newaetech/phywhispererusb: PhyWhisperer-USB: Hardware USB Trigger","internal":false,"attachment":false,"reflection":false,"clicks":27,"user_id":776,"domain":"github.com","root_domain":"github.com"},{"url":"https://forum.newae.com/t/i2c-protocol-aware-glitching/1783","title":"I2C Protocol Aware Glitching","internal":true,"attachment":false,"reflection":false,"clicks":20,"user_id":776,"domain":"forum.newae.com","root_domain":"newae.com"}]},"bookmarks":[]}