Hello i´m working with the Chip Whisperer Lite and now i´ve broken off the Arm target and connected my own target. I want to attack my target with voltage glitching. My Jupyter Code is similar to the “Fault 2_1 Introduction to Voltage Glitching” example except that i do not communicate with the target over simple serial, i just use GPIO´s (High/Low) for attack results.
Here some settings i use:
scope.clock.adc_src = “clkgen_x1”
scope.glitch.clk_src = “clkgen”
scope.glitch.output = “glitch_only”
scope.glitch.trigger_src = “ext_single”
I use the following pins of the 20 pin connector J1: IO1(changed to high_z), IO2(changed to high_z), IO3(changed to high_z), IO4(Trigger), Glitch Pin(VCCGlitch), Measure Pin(ANIN), GND, nRST
I´ve implemented the trigger low/high on my own target and also i can use the nRST pin for my target to reboot it, it´s working!
Now there are a couple more pins on the 20 pin connector J1, do i need the other pins for the Chip Whisperer to work properly and can i just leave them unconnected?
Am i right that i don´t need the pins: MISO, MOSI, Sck, PC(PDIC), PD(PDID), VREF, HS1/I, HS2/O?
And another Question: Is it better/easier to glitch when i use the HS2/O as clock for my target or can i use the own clock of the target? The same for the Voltage of the target?
ChipWhisperer doesn’t need most of these other pins (most of these are for programming the target).
HS1/HS2 are the exception, and that leads into your 2nd question. This is up to you, you need to decide how you want to clock the target. CW is designed for two scenarios:
CW generates the target clock on HS2.
Target generates its own clock and provides it to CW on HS1.
If you don’t do this, then you won’t be able to glitch synchronously, which may make it harder to succeed.
Any pin you don’t need can be left unconnected.
You can power the target however you want, but keep in mind that when you glitch, the VCCGLITCH line, which goes to your target’s VDD, will be pulled down to ground via the MOSFETs. Have a look at the last page of the CW-lite schematic to see how we handle that for our target.
Thanks for the quick and good reply.
So you mean, if I use the voltage from the CW, I have to be careful not to pull the voltage of the CW itself to ground?
And what is the function of the VREF pin?
Have a look at the schematic that I linked to. In the case of our Arm target, SJ7 connects VREF to the +3.3V line. It gives options for targets where you want these to be connected (e.g. say you want the voltage glitch to affect one of the target’s supply voltage but not the other). So it just gives extra flexibility.
No, the target’s. What’s at risk is the target and the CW’s MOSFETs.