Clock syncronization to internal multiplications PLLs


I’m new to the CW and the SCA area.
I Want to attempt VCC glitching and/or Power analysis on a microcontroller who’s CPU clock is not directly driven by the external oscillator…

The specific MCU starts off with an internal oscillator let’s call it CLKINT, and then software switches to clock src that is “crystal times x” (let’s call it HSCLK)- the MCU has an internal PLL and multiplies/devides the external oscillating crystal and uses it to drive the CPU CLOCK.

With respect to both glitching and power analysis, I have few questions:

  1. How, and if, can I synchronize the CW platform to bee in sync with CLKINT
  2. How can I synchronize the CW platform after the device has switched to HSCLK
  3. Is CLK glitching possible when the clock is being multiplied and the MCU uses an internal PLL?

For the above I would be using the CW-Lite hardware



Glad to hear that you’re interested in SCA!

  1. CLKINT: this depends on the microcontroller you’re using. If you can find a clock output pin (maybe one that’s meant for crystal feedback) then you can route it to the ChipWhisperer’s clock signal. If not, then you probably can’t sync the CW-Lite with the internally-clocked MCU.
  2. HSCLK: connect the crystal to the ChipWhisperer’s clock input. Then, you can use the CWCapture settings in CLKGEN Setup to multiply this crystal frequency to match your MCU’s PLL settings.
  3. Glitching: this is certainly possible as long as you can sync the ChipWhisperer clock with the microcontroller (ie: as long as #2 works).

Curious to see how this works - let me know!


Thank you for the reply and information

For some reason I thought the multipliers/deviders are only relevant for the cw 96Mhz clock, and not for any external oscillator.
Currently, we’re i’m trying just by matching frequency… If it’ll fail ill try the above.

Will update if i have news

Right - the CLKGEN clock on the ChipWhisperer can use the multiplier/divider with either source (the 96 MHz system clock or an external clock).

Matching frequency probably won’t work well for side channel analysis - even a small difference in frequencies will cause the traces to look different and will move your glitch timings around.

As you mentioned, i can sync the cw clock to the target reference clock. But I cannot do this the other way around, as I understand, since CLKGEN only contains a single set of multipliers/deviders, and so I can’t generate 2 different clocks with the cw (1 for reference for target and cw and the other the working clock of the cw)

Am i right?

My target has a 8Mhz crystal on it, any probe (1x or 10x) of an osciloscope on the crystal output causes to target (CLK?) to fail.
When trying to add series resistor only > ~600 Ohm resistor didn’t kill the target.
But, It looks as under these circumstances the amplitude of the signal is ~200mv which is not enough for the FPGA to pick-up(?).

I May try an alternative method of supplying my clock to the target, BUT I do not understand How can I drive CLKGEN to 40Mhz(8*5) while sending 8Mhz on HS2/O…

B.T.W. My target multiplies the crystal freq. by 5.