Clock glitching on external crystal

Embedded Security Glitching
1

Hello everybody,

I executed the tutorials on chipwhisperer lite about clock/vcc glitching, but now I would like to test on some real life scenario. I’m working on JN5169 ((datasheet)) chipset and I would like to bypass the standard programming protection.

The chipset is connected via XTAL_IN and XTAL_OUT to a 32Mhz crystal used as reference oscillator.

I’m pretty a n00b in electronics, but I would like to understand which is the right path to proceed to get the attack working.

I need to remove the crystal and connect CW to the clock pins or I have to connect CW in parallel of the crystal (in which pin XTAL_IN or XTAL_OUT?)? I should use the glitch pin of CW right?

The tutorial are well documented in the “software” part, but they doesn’t give a lot of information about the “hardware” part. For example the tutorial about the LPC1114 doesn’t give any information on why the capacitors are removed. It would be very useful if also the hardware part are approached in the tutorials.

Thank you in advance

inode

2

Hi Inode,

One route is to try taking out the crystal and feeding in your own actual clock as described here: https://www.maximintegrated.com/en/design/technical-documents/app-notes/3/3582.html. However, quickly looking over the datasheet (I could be wrong here), I believe the max voltage at XTAL_In is ~2V, which is well below the ChipWhisperer’s IO voltage (3.3V), so if you were to go this route, you’d at least need to level shift the clock. You might also try grounding the XTAL_IN pin using the VCC glitch port like in https://blog.gg8.se/wordpress/2014/12/09/dumping-the-boot-rom-of-the-gameboy-clone-game-fighter/.

That being said, I’d really recommend trying voltage glitching for a few reasons

  1. Issues with glitching a XTAL_IN port as described above
  2. There’s a clock divider circuit in the chip
  3. There’s also an internal oscillator, which the chip might be running off of for the boot process

For the LPC1114 glitch, the capacitors are removed to prevent them from filtering out the glitch. Bypass capacitors like the ones we removed are put there to prevent high frequency fluctuations on the power rail, which is exactly what we’re trying to do by voltage glitching the target.

Alex

3

Thank you Alex. I will do some test and let you know if I’m able to do it.

inode