ChipWhisperer with new target board PSoC 62 Clock glitching

Embedded Security Glitching
1

I am trying to glitch this new target board PSoC 62 but not able to, whatever changes made in the simpleserial.c , no effective changes are seen when trying to run introduction to clock glitching file. i had to flash the target all that process is happening, i got the psoc62 hal layer file from a github source that particular file has a simpleserail.c file with some exceptions they havent used the commands used for version 2 , only the code lines related to version 1 is used, kindly help me out here what changes are to be made inorder to carry out glitching.

thank you

2

Hi,

simpleserial.c is unrelated to glitching - it’s just the serial protocol we use. I’m not sure what clock settings we use for the PSOC, but you might have to change the clock source for the CPUs (I think hal/psoc62/generated_source/psoc6sw-1.1/components/psoc6pdl/drivers/source/cy_sysclk.c has all the clock change functions).

Alternatively, the PSOC mentions that some of the clock muxes are glitch safe. I don’t think they go into detail about what that means, so there might be some sort of glitch resistance on this target. (https://www.infineon.com/dgdl/Infineon-PSoC_6_MCU_PSoC_62_Architecture_Technical_Reference_Manual-AdditionalTechnicalInformation-v08_00-EN.pdf?fileId=8ac78c8c7d0d8da4017d0f94758401d1&utm_source=cypress&utm_medium=referral&utm_campaign=202110_globe_en_all_integration-technical_reference_manual)

Alex

1 Like
3

Thank you!! @Alex_Dewar

4

Hi @Alex_Dewar , one more question, I am trying to make serial communication with the help of this PSoC 62 Target board to call an API and get the value of that APi for example

simpleserial_addcmd(‘p’, 5, password);

where password is the API I want call and get the result, this password API has a value which i want to receive. And I am not able to make that serial communication. Any idea what changes are to be made in order to get the result. and make the serial communication??

Thanks
Niharika

5

Hi,

You should use target.simpleserial_write('p', bytearray([N1, N2, N3, N4, N5]) in Python
where N1-5 are the 5 bytes of the password. Make sure you’re using the SimpleSerial class in Python,
and not the SimpleSerial2 class. The former should be selected if you run through with SS_VER=“SS_VER_1_1” in a notebook.

Alex

1 Like
6

Hi, I am doing the same,I tried to give invalid password or NULL

target.simpleserial_write(“g”, bytearray([]))

but No result, any changes to be made in the simpleserial.c file??

The above said works for stm32 target board but not the PSoC 62 Board. Kindly help.

Niharika

7

Have you had any successful serial communication with this target? If not, it could be that the baud rate isn’t actually coming out to 38400bps. Try printing some stuff just after init_uart() in main(), then looking for it in Python. You could automate this as follows (may require some adjusting, as I’ve used some similar code in the past, but don’t remember it exactly off the top of my head)

For example, at the beginning of main():

    platform_init();
	init_uart();
	trigger_setup();

	putch('h');
	putch('e');
	putch('l');
	putch('l');
	putch('o');
	putch('\n');

Then in Python after connecting and doing setup:

import time
target.baud = 9600
recv = ""
while not ("ello" in recv):
    scope.io.nrst = 0
    target.flush()
    time.sleep(0.05)
    scope.io.nrst = None
    time.sleep(0.05)
    recv = target.read()
    
    print("Got {} @ {}bps".format(recv, target.baud)
    target.baud += 1000

I’ll see if I can figure out what the actual baud rate is tomorrow. Let me know if the above works for you.

Alex

1 Like
8

okay! will work on this and let you know thank you :slightly_smiling_face:

9

Hi @Alex_Dewar , I tried to do the following changes you mentioned but no changes happened.

this is the link to which I created the .hex file and flashed onto the target board using Segger J Link. The main_cm4.c file, this has the functions to carry out the serial communication, problem here is there is blinky function which should make LEDs in the hardware to blink but it isn’t happening so I am getting a doubt if the flashing occurred correctly or not. If this works I think the remaining will work automatically. Can you let me know if this is working for you?? There are some changes made to main_cm0 file and main_cm4.c file am not able to upload an attachment.

so can you let me know which file did you use to generate .hex file??please share it with me.

Thanks
Niharika

10

It looks like you’re on a fork of ChipWhisperer - the correct one is GitHub - newaetech/chipwhisperer: ChipWhisperer - the complete open-source toolchain for side-channel power analysis and glitching attacks. Can you try the PSOC62 code in that repo instead?

Alex

1 Like
11

I tried to do it as you said but no result or changes. Not able to communicate serially with the PSOC 62 Target. Anything else you suggest?? Can you please check out the code in that link and let me know if there is anything wrong. In main_cm4.c file.

Thanks
Niharika

12

I’m not sure where this main_cm4.c you’re referring to is. If you’re using the code you linked to, I can’t help as it’s not our code.

Alex

13

Can you let me the procedure you carry out to do serial communication with PSoC 62 Target board. Like how did you flash the firmware onto the target, and so on. Which files did you use to do that. Would be really helpful.

Thanks
Niharika

14

You can just use the normal chipwhisperer build system. For example in simpleserial-aes:

make PLATFORM=CW308_PSOC62 CRYPTO_TARGET=TINYAES128C

I think you need to use a JTAG debugger to flash the target.

Alex

15

image
image1920×1080 142 KB

How to resolve this error??

Niharika

16

According to windows - What does ExitCode -1073741502 mean? - Stack Overflow, that error code is DLL Initialization Failed. My guess is that either make or something make needs (maybe rm?) is corrupted. Where did you get make from?

Alex

17

Make command wasn’t working so had to download winavr from internet.

Niharika

18

WinAVR hasn’t been updated in a long time and no longer works. You could try AVR-GCC 11.1.0 for Windows 32 and 64 bit – Zak's Electronics Blog ~* instead.

1 Like
19

Thank you !!

Niharika

20

Hi @Alex_Dewar , when I try to run this cell

%%bash -s “$PLATFORM” “$SS_VER”
cd …/…/…/hardware/victims/firmware/simpleserial-glitch
make PLATFORM=$1 CRYPTO_TARGET=NONE SS_VER=$2

it says Couldn’t find program: ‘bash’ . Any fix for this, tried adding the bin file location to environment variables but didn’t work. Help me out.

Thanks
Niharika