Chipwhisperer lite board hardware setup error

Sriram · June 21, 2022, 7:31am

[quote=“Sriram, post:1, topic:3348, full:true”]

How to resolve this error.

jpthibault · June 21, 2022, 2:53pm

Do you have the scope connected in a different notebook? You’ll have to disconnect it from other notebook (scope.dis(), or simply restart the kernel on the other notebook) before you can connect in another notebook.

If that’s not the case and it still fails can you copy and paste the full error message that you get when you run scope = cw.scope().

Sriram · June 22, 2022, 9:49am

When executing the command below given in the hardware set up in jupyter notebook, the following error occurs. Previously scope was not detected, after updating the firmware the scope gets detected.
How to resolve this error. Kindly help me fix this. I’ve been spending 2 days on it.
I am using the chipwhisperer through the virtual box currently.

Thank you.

%%bash
cd …/hardware/victims/firmware/simpleserial-base/
make PLATFORM= CRYPTO_TARGET=CWLITEXMEGA

SS_VER set to SS_VER_1_1
…/./hal/Makefile.hal:241: *** Invalid or empty PLATFORM: . Known platforms:
±------------------------------------------------------+
| PLATFORM | DESCRIPTION |
+=======================================================+
| AVR/XMEGA Targets (8-Bit RISC) |
+=======================================================+
±------------------------------------------------------+
| CWLITEXMEGA | CW-Lite XMEGA (Alias for CW303) |
±------------------------------------------------------+
| CW301_AVR | Multi-Target Board, AVR Target |
±------------------------------------------------------+
| CW303 | XMEGA Target (CWLite), Also works |
| | for CW308T-XMEGA |
±------------------------------------------------------+
| CW304 | ATMega328P (NOTDUINO), Also works |
| | for CW308T-AVR |
±------------------------------------------------------+
| CW308_MEGARF | ATMega2564RFR2 Target for CW308T |
±------------------------------------------------------+
+=======================================================+

ARM Cortex-M Targets (Generic) |
+=======================================================+
±------------------------------------------------------+
| CWLITEARM | CW-Lite Arm (Alias for CW308_STM32F3) |
±------------------------------------------------------+
| CWNANO | CW-Lite Nano (STM32F0_NANO) |
±------------------------------------------------------+
| CW308_STM32F0 | CW308T-STM32F0 (ST Micro STM32F0) |
±------------------------------------------------------+
| CW308_STM32F1 | CW308T-STM32F1 (ST Micro STM32F1) |
±------------------------------------------------------+
| CW308_STM32F2 | CW308T-STM32F2 (ST Micro STM32F2) |
±------------------------------------------------------+
| CW308_STM32F3 | CW308T-STM32F3 (ST Micro STM32F3) |
±------------------------------------------------------+
| CW308_STM32F4 | CW308T-STM32F4 (ST Micro STM32F405) |
±------------------------------------------------------+
+=======================================================+
ARM Cortex-M Targets (Support CRYPTO_TARGET=HWAES) |
+=======================================================+
±------------------------------------------------------+
| CW308_CC2538 | CW308T-CC2538 (TI CC2538) |
±------------------------------------------------------+
| CW308_ | CW308T-EFM32GG11 |
| EFM32GG11 | (Silicon Labs Giant Gecko) |
±------------------------------------------------------+
| CW308_ | CW-Lite EFM32TG11B |
| EFM32TG11B | (Silicon Labs Tiny Geko) |
±------------------------------------------------------+
| CW308_ | CW308T-EFR32MG21 (A version without |
| EFR32MG21A | ‘secure vault’) |
±------------------------------------------------------+
| CW308_ | CW308T-IMXRT1062 (iMX RT1062) |
| IMXRT1062 | NXP “Cross-Over” Microcontroller |
±------------------------------------------------------+
| CW308_K24F | CW308T-K24F (NXP Kinetis K24F) |
±------------------------------------------------------+
| CW308_K82F | CW308T-K82F (NXP Kinetis K82F) |
±------------------------------------------------------+
| CW308_LPC55S6X| CW308T-LPC55S69 (NXP LPC55S69) |
±------------------------------------------------------+
| CW308_NRF52 | CW308T-NRF52840 (Nordic Semi) |
±------------------------------------------------------+
| CW308_PSOC62 | CW308T-PSOC62 (Cypress PSOC 62) |
±------------------------------------------------------+
| CW308_SAM4L | CW308T-SAM4L (Atmel SAM4L) |
±------------------------------------------------------+
| CW308_SAML11 | CW-Lite SAML11 (Atmel SAML11) |
±------------------------------------------------------+
| CW308_STM32F2 | CW308T-STM32F2HWC (ST Micro STM32F215)|
±------------------------------------------------------+
| CW308_STM32F4 | CW308T-STM32F4HWC (ST Micro STM32F415)|
±------------------------------------------------------+
| CW308_STM32L4 | CW308T-STM32L4 (ST Micro STM32L443) |
±------------------------------------------------------+
| CW308_STM32L5 | CW308T-STM32L5HWC (ST Micro STM32L562)|
±------------------------------------------------------+
+=======================================================+
Other 32-bit Architecture |
+=======================================================+
±------------------------------------------------------+
| CW308_AURIX | CW-Lite AURIX (Infineon TC233A) |
±------------------------------------------------------+
| CW308_FE310 | CW308T-FE310-G002 (RISC-V) |
±------------------------------------------------------+
| CW308_ | CW308T-MPC5676R (NXP MPC5676R) |
| MPC5676R | |
±--------------|---------------------------------------+
| CW308_NEORV32 | CW308/CW312-iCE40 with neorv32 |
| | (RISC-V) soft-core processor. |
±--------------|---------------------------------------+

Options to define platform:
(1) Run make with PLATFORM specified as follows:
make PLATFORM=CW304

(2) Save a file called Makefile. platform with contents:
PLATFORM=CW304
. Stop.

CalledProcessError Traceback (most recent call last)
Input In [30], in <cell line: 1>()
----> 1 get_ipython().run_cell_magic(‘bash’, ‘’, ‘cd …/hardware/victims/firmware/simpleserial-base/\nmake PLATFORM= CRYPTO_TARGET=CWLITEXMEGA\n’)

File ~/.pyenv/versions/3.9.7/envs/cw/lib/python3.9/site-packages/IPython/core/interactiveshell.py:2358, in InteractiveShell.run_cell_magic(self, magic_name, line, cell)
2356 with self.builtin_trap:
2357 args = (magic_arg_s, cell)
→ 2358 result = fn(*args, **kwargs)
2359 return result

File ~/.pyenv/versions/3.9.7/envs/cw/lib/python3.9/site-packages/IPython/core/magics/script.py:153, in ScriptMagics._make_script_magic..named_script_magic(line, cell)
151 else:
152 line = script
→ 153 return self.shebang(line, cell)

File ~/.pyenv/versions/3.9.7/envs/cw/lib/python3.9/site-packages/IPython/core/magics/script.py:305, in ScriptMagics.shebang(self, line, cell)
300 if args.raise_error and p.returncode != 0:
301 # If we get here and p.returncode is still None, we must have
302 # killed it but not yet seen its return code. We don’t wait for it,
303 # in case it’s stuck in uninterruptible sleep. -9 = SIGKILL
304 rc = p.returncode or -9
→ 305 raise CalledProcessError(rc, cell)

CalledProcessError: Command ‘b’cd …/hardware/victims/firmware/simpleserial-base/\nmake PLATFORM= CRYPTO_TARGET=CWLITEXMEGA\n’’ returned non-zero exit status 2.

esanfelix · June 22, 2022, 10:07am

You’re supposed to pass a valid PLATFORM to the makefile. You seem to be calling it like this:

make PLATFORM= CRYPTO_TARGET=CWLITEXMEGA

You can build that example for the CWLITEXMEGA platform as follows:

make PLATFORM=CWLITEXMEGA CRYPTO_TARGET=NONE

Sriram · June 22, 2022, 10:39am

THANK YOU esanfelix. It worked.

After this in the next command I face the following error, could you please tell me how to rectify this error. I’m a beginner in this field which takes time for me to sort out things. Your reply would mean a lot to me.
Thank you!

cw.program_target(scope, cw.programmers.XMEGAProgrammer, “path/to/firmware.hex”)
#cw.program_target(scope, cw.programmers.STM32FProgrammer, “path/to/firmware.hex”)
#cw.program_target(scope, cw.programmers.AVRProgrammer, “path/to/firmware.hex”)

FileNotFoundError Traceback (most recent call last)
Input In [38], in <cell line: 1>()
----> 1 cw.program_target(scope, cw.programmers.XMEGAProgrammer, “path/to/firmware.hex”)

File ~/work/projects/chipwhisperer/software/chipwhisperer/init.py:128, in program_target(scope, prog_type, fw_path, **kwargs)
126 prog.find()
127 prog.erase()
→ 128 prog.program(fw_path, memtype=“flash”, verify=True)
129 prog.close()
130 except:

File ~/work/projects/chipwhisperer/software/chipwhisperer/capture/api/programmers.py:121, in save_and_restore_pins..func_wrapper(self, *args, **kwargs)
119 self.scope.io.nrst = ‘high_z’
120 try:
→ 121 val = func(self, *args, **kwargs)
122 finally:
123 target_logger.debug(‘Restoring pdic, pdid, and nrst pin configuration’)

File ~/work/projects/chipwhisperer/software/chipwhisperer/capture/api/programmers.py:269, in XMEGAProgrammer.program(self, filename, memtype, verify)
267 Programmer.lastFlashedFile = filename
268 xmega = self.xmegaprog()
→ 269 xmega.program(filename, memtype, verify)

File ~/work/projects/chipwhisperer/software/chipwhisperer/hardware/naeusb/programmer_xmega.py:268, in XMEGAPDI.program(self, filename, memtype, verify, logfunc, waitfunc)
265 “”“Programs memory type, dealing with opening filename as either .hex or .bin file”""
266 self.lastFlashedFile = filename
→ 268 fdata, fsize = FileReader(filename)
270 startaddr = self._chip.memtypes[memtype][“offset”]
271 maxsize = self._chip.memtypes[memtype][“size”]

File ~/work/projects/chipwhisperer/software/chipwhisperer/capture/utils/programming_files.py:30, in FileReader(filename)
28 def FileReader(filename):
29 if filename.lower().endswith(".hex") or filename.lower().endswith(".ihex"):
—> 30 f = IntelHex(filename)
31 fdata = f.tobinarray(0)
32 fsize = f.maxaddr() - f.minaddr()

File ~/work/projects/chipwhisperer/software/chipwhisperer/capture/utils/IntelHex.py:99, in IntelHex.init(self, source)
96 if source is not None:
97 if isinstance(source, StrType) or getattr(source, “read”, None):
98 # load hex file
—> 99 self.loadhex(source)
100 elif isinstance(source, dict):
101 self.fromdict(source)

File ~/work/projects/chipwhisperer/software/chipwhisperer/capture/utils/IntelHex.py:208, in IntelHex.loadhex(self, fobj)
201 “”“Load hex file into internal buffer. This is not necessary
202 if object was initialized with source set. This will overwrite
203 addresses if object was already initialized.
204
205 @param fobj file name or file-like object
206 “””
207 if getattr(fobj, “read”, None) is None:
→ 208 fobj = open(fobj, “r”)
209 fclose = fobj.close
210 else:

FileNotFoundError: [Errno 2] No such file or directory: ‘path/to/firmware.hex’

esanfelix · June 22, 2022, 1:35pm

path/to/firmware.hex is a placeholder… You need to provide the path to the .hex file that the make command generates.

Sriram · June 22, 2022, 5:07pm

the following error occurs, where will be that .hex file which needed to be add to the path.

cw.program_target(scope, cw.programmers.XMEGAProgrammer, “C:\Users\MYPC\chipwhisperer-5.6.1.tar\hardware\victims\firmware”)
#cw.program_target(scope, cw.programmers.STM32FProgrammer, “path/to/firmware.hex”)
#cw.program_target(scope, cw.programmers.AVRProgrammer, “path/to/firmware.hex”)

Input In [47]
cw.program_target(scope, cw.programmers.XMEGAProgrammer, “C:\Users\MYPC\chipwhisperer-5.6.1.tar\hardware\victims\firmware”)
^
SyntaxError: (unicode error) ‘unicodeescape’ codec can’t decode bytes in position 2-3: truncated \UXXXXXXXX escape

Alex_Dewar · June 23, 2022, 9:15pm

Try adding an r before the "" ie r"C:\...".

Sriram · June 29, 2022, 4:03pm

what is that path to firmware.hex file. where will it be available in the downloaded source code?

jpthibault · June 29, 2022, 9:17pm

You’ll find the .hex file in the same place where you ran the make command.
If we take Lab 2_1A as an example, this would be
hardware/victims/firmware/simpleserial-base2/*.hex, starting from the root directory of your ChipWhisperer installation.

Sriram · July 9, 2022, 1:56pm

Dear people, I don’t have a clear picture of how to proceed with the Chipwhisperer target analysis, I have the following doubt

For this virtual box chipwhisperer setup, after setting up a hardware example in the

chipwhisperer1240×842 173 KB

Jupyter notebook in the local host 8888, how should I communicate with the target?
Does separate chipwhisperer software like capture and analyzer needs to be installed?
I’m stuck with how to communicate with Atmel Xmega target in the chipwhisperer lite board (NewAE NAE-CW1173-2PART).
Also in future I need to communicate with the Esp8266 target, what I need to perform the attack on that target. UFO Target board?

jpthibault · July 11, 2022, 12:45pm

Did you get anything back from the read commands earlier in that notebook? If so, then you’re communicating with the target. Our SimpleSerial protocol communicates with the target using the IO1 and IO2 lines.

No.

Follow our courses to learn. If you can’t figure out the parts that the notebooks ask you to (e.g. where it says “fill in the rest”), then you’ll notice that some (not all) of the course notebooks also have a solution notebook (filename starts with “SOLN”).

We don’t have an ESP8266 target board, but we do have this ESP32 target board. I’m not sure how similar these are and whether it would be useful to start with our ESP32 before attempting a third-party ESP8266. It depends what you aim to do.

Hope this helps,
Jean-Pierre

Sriram · August 23, 2022, 7:56am

when i run the example introduction to clock glitching program in the jupyter notebook I got the following error.
can you please tell me how to clear that error?

complete error message:
INFO: Found ChipWhisperer😍

USBErrorBusy Traceback (most recent call last)
File /tmp/ipykernel_8825/989384780.py:2, in <cell line: 2>()
1 import chipwhisperer as cw
----> 2 scope = cw.scope()

File ~/work/projects/chipwhisperer/software/chipwhisperer/init.py:337, in scope(scope_type, name, sn, idProduct, bitstream, force, prog_speed, **kwargs)
335 rtn : scopes.ScopeTypes = scope_type()
336 try:
→ 337 rtn.con(**kwargs)
338 except IOError:
339 scope_logger.error(“ChipWhisperer error state detected. Resetting and retrying connection…”)

File ~/work/projects/chipwhisperer/software/chipwhisperer/capture/scopes/OpenADC.py:512, in OpenADC.con(self, sn, idProduct, bitstream, force, prog_speed, **kwargs)
509 self._saved_sn = sn
510 self.scopetype = OpenADCInterface_NAEUSBChip()
→ 512 self.scopetype.con(sn, idProduct, bitstream, force, prog_speed, **kwargs)
513 self.sc = OpenADCInterface(self.scopetype.ser) # important to instantiate this before other FPGA components, since this does an FPGA reset
514 self.hwinfo = HWInformation(self.sc)

File ~/work/projects/chipwhisperer/software/chipwhisperer/capture/scopes/openadc_interface/naeusbchip.py:64, in OpenADCInterface_NAEUSBChip.con(self, sn, idProduct, bitstream, force, prog_speed, **kwargs)
62 else:
63 nae_products = [0xACE2, 0xACE3, 0xACE5]
—> 64 found_id = self.ser.con(idProduct=nae_products, serial_number=sn, **kwargs)
65 if force:
66 self.fpga.eraseFPGA()

File ~/work/projects/chipwhisperer/software/chipwhisperer/hardware/naeusb/naeusb.py:681, in NAEUSB.con(self, idProduct, connect_to_first, serial_number, hw_location, **kwargs)
676 def con(self, idProduct : Tuple[int]=(0xACE2,), connect_to_first : bool=False,
677 serial_number : Optional[str]=None, hw_location : Optional[Tuple[int, int]]=None, **kwargs) → int:
678 “”"
679 Connect to device using default VID/PID
680 “”"
→ 681 self.usbtx.open(idProduct=idProduct, serial_number=serial_number, connect_to_first=True, hw_location=hw_location)
684 self.snum=self.usbtx.sn
685 fwver = self.readFwVersion()

File ~/work/projects/chipwhisperer/software/chipwhisperer/hardware/naeusb/naeusb.py:385, in NAEUSB_Backend.open(self, serial_number, idProduct, connect_to_first, hw_location)
382 self._usbdev = self.handle
384 # claim bulk interface, may not be necessary?
→ 385 self.handle.claimInterface(0)
387 self.sn = self.handle.getSerialNumber()
388 self.pid = self.device.getProductID()

File ~/.pyenv/versions/3.9.7/envs/cw/lib/python3.9/site-packages/libusb1-3.0.0-py3.9.egg/usb1/init.py:1146, in USBDeviceHandle.claimInterface(self, interface)
1136 def claimInterface(self, interface):
1137 “”"
1138 Claim (= get exclusive access to) given interface number. Required to
1139 receive/send data.
(…)
1144 # handle.releaseInterface(0) gets automatically called
1145 “”"
→ 1146 mayRaiseUSBError(
1147 libusb1.libusb_claim_interface(self.__handle, interface),
1148 )
1149 return _ReleaseInterface(self, interface)

File ~/.pyenv/versions/3.9.7/envs/cw/lib/python3.9/site-packages/libusb1-3.0.0-py3.9.egg/usb1/init.py:127, in mayRaiseUSBError(value, __raiseUSBError)
121 def mayRaiseUSBError(
122 value,
123 # Avoid globals lookup on call to work during interpreter shutdown.
124 __raiseUSBError=raiseUSBError,
125 ):
126 if value < 0:
→ 127 __raiseUSBError(value)
128 return value

File ~/.pyenv/versions/3.9.7/envs/cw/lib/python3.9/site-packages/libusb1-3.0.0-py3.9.egg/usb1/init.py:119, in raiseUSBError(value, __STATUS_TO_EXCEPTION_DICT, __USBError)
113 def raiseUSBError(
114 value,
115 # Avoid globals lookup on call to work during interpreter shutdown.
116 __STATUS_TO_EXCEPTION_DICT=STATUS_TO_EXCEPTION_DICT,
117 __USBError=USBError,
118 ): # pylint: disable=dangerous-default-value
→ 119 raise __STATUS_TO_EXCEPTION_DICT.get(value, __USBError)(value)

USBErrorBusy: LIBUSB_ERROR_BUSY [-6]

USBErrorBusy Traceback (most recent call last)
Input In [55], in <cell line: 1>()
----> 1 get_ipython().run_line_magic(‘run’, ‘“…/…/Setup_Scripts/Setup_Generic.ipynb”’)

File ~/.pyenv/versions/3.9.7/envs/cw/lib/python3.9/site-packages/IPython/core/interactiveshell.py:2305, in InteractiveShell.run_line_magic(self, magic_name, line, _stack_depth)
2303 kwargs[‘local_ns’] = self.get_local_scope(stack_depth)
2304 with self.builtin_trap:
→ 2305 result = fn(*args, **kwargs)
2306 return result

File ~/.pyenv/versions/3.9.7/envs/cw/lib/python3.9/site-packages/IPython/core/magics/execution.py:717, in ExecutionMagics.run(self, parameter_s, runner, file_finder)
715 with preserve_keys(self.shell.user_ns, ‘file’):
716 self.shell.user_ns[‘file’] = filename
→ 717 self.shell.safe_execfile_ipy(filename, raise_exceptions=True)
718 return
720 # Control the response to exit() calls made by the script being run

File ~/.pyenv/versions/3.9.7/envs/cw/lib/python3.9/site-packages/IPython/core/interactiveshell.py:2811, in InteractiveShell.safe_execfile_ipy(self, fname, shell_futures, raise_exceptions)
2809 result = self.run_cell(cell, silent=True, shell_futures=shell_futures)
2810 if raise_exceptions:
→ 2811 result.raise_error()
2812 elif not result.success:
2813 break

File ~/.pyenv/versions/3.9.7/envs/cw/lib/python3.9/site-packages/IPython/core/interactiveshell.py:251, in ExecutionResult.raise_error(self)
249 raise self.error_before_exec
250 if self.error_in_exec is not None:
→ 251 raise self.error_in_exec

[... skipping hidden 1 frame]

File /tmp/ipykernel_8825/989384780.py:2, in <cell line: 2>()
1 import chipwhisperer as cw
----> 2 scope = cw.scope()