CW-Lite and CW305 - ADC Lock Fail

Embedded Security ChipWhisperer Hardware
1

Hello,

(UPDATE: Problem solved. I was using a USB hub for powering both of the boards. It appears it couldn’t draw necessary amount of current. Proper powering solved my problem. )

I’ve received CW-Lite and CW305 boards recently. I have installed Instant Chipwhisperer VM and pulled the last version of source codes. I have tried to attack the XMega and I retrieved cipherkey. I have followed “ChipWhisperer-Lite (CW1173) Quick-Start Guide: Win 7, AES Attack” video.

However, I got troubles when trying to attack CW305 board. I followed “CW305: Power Analysis Attack against FPGA Implementation of AES-128” video. At first I made necessary connections. Then I started the CWCapture application, opened example script as shown as in the video. Then I get this warning:

INFO - Running Script: CW305 Artix Target w/ ChipWhisperer-Lite INFO - Found ChipWhisperer-Lite, Serial Number = 44203120473539413030393130323038 INFO - SAM3U Firmware version = 0.11 b0 INFO - FPGA programmed INFO - OpenADC Found, Connecting INFO - Found CW305 Artix FPGA Board, Serial Number = 4420312043304a383330313239313033 INFO - SAM3U Firmware version = 0.20 b0 WARNING - No samples received. Either very long offset, or no ADC clock (try "Reset ADC DCM"). If you need such a long offset, manually update "nosampletimeout" limit in source code. WARNING - No samples received. Either very long offset, or no ADC clock (try "Reset ADC DCM"). If you need such a long offset, manually update "nosampletimeout" limit in source code. INFO - Finished Script: CW305 Artix Target w/ ChipWhisperer-Lite

By the way, ADC Lock Failed Led on the CW-Lite is on. Then I start to program FPGA. But before that, FPGA_DONE Led is off. Shouldn’t it be on because the FPGA is not yet programmed. And after I program the FPGA with pre-built bit file successfully (according to Debug Logging screen), FPGA_DONE Led is off (as it should be), but LED7(indicates USB clock is running) and LED5 are off. Shouldn’t they blink according to the video guide? I have set S1 and S2 switch groups correctly.

Finally, when I try to capture a power measurement, I got an error:
“WARNING - No samples received. Either very long offset, or no ADC clock (try “Reset ADC DCM”). If you need such a long offset, manually update “nosampletimeout” limit in source code.”
I have tried to “RESET ADC DCM”, but nothing has changed and I am still having the same error.

What should I do? Is there anything wrong with the board?

2

Hi varici,
That video is quite out of date, as it was recorded with v3 of Chipwhisperer and still shows the assembla wiki. You might have more success following the written part of wiki.newae.com/Tutorial_B5_Brea … ghtforward
This tutorial should go over everything you need to get started. I just made sure all the steps worked out, so this should solve the problems you are having. Let me know how it goes!
Cheers,
Franz

3

Hi fheubach,
Your tutorial link is kinda broken. I have followed this tutorial too: wiki.newae.com/Tutorial_CW305-1 … _a_Project
There is no difference between the video and the written tutorial. I am getting same error.

4

Problem solved. I was using a USB hub for powering both of the boards. It appears it couldn’t draw necessary amount of current. Proper powering solved my problem.

5

Hi varici,
Sorry about the link, it is missing the bracket at the end. Tutorial B5 Breaking AES
I happy you found a solution that worked. Thank you for making the solution clear in the initial post!
Cheers,
Franz

6

Hi varici,

I have the same problem here. I connect only the CW-Lite and run the simpleserial and ADC Lock failed. Could you explain the solution more detailed? Thank you.

7

Powering your board with a USB cable connected to your computer could lead some problems. We should use an USB hub with external power. This solved my problem.

8

Hi varici,

Thank you for your reply. But we still need the cable for communicating with computer. The CW-Lite does not have other port. Or do you mean the CW305 board? It has a pure DC 5V input port.

9

Hello,

You should be able to run the CWLite off the USB for your computer. Correct me if I’m wrong, but I believe varici ran into issues running the CWLite and the CW305 off of the same USB hub.

Your issue is caused by the ADC’s DCM not being locked. From your original post, I’d guess that you haven’t done anything after running “connect_cwlite_simpleserial.py”, which only connects to the CWLite and doesn’t do any clock setup. In that case, the default clock frequency into the ADC is higher than its DCM can handle, which is why it’s not locked. Try running setup_cw_xmega.py. You may have to click the “Reset ADC DCM” button in Scope Settings after running the script as well.

Alex

10

Hi Alex,

Thank you for your reply. I did not explain the whole thing in my reply. I could run attacks on xmega and the ADC LED did not flash. But when I run attacks on CW305, it flashes.

But I think we need to connect the CW Lite to the computer, otherwise you will find it “DIS” shown in the Capture tool. And we need to connect the CW305 to computer through another wire. This used to work for me, but it does not. And I have the exactly same problem as varici in his original post.

11

So, if I’ve got this right, the red ADC lock failed light comes on when you try to run attacks on the CW305. You’re right in that you definitely need to connect the CWLite to the computer (basically, that’s what CW Capture is communicating with), but you should only need to connect the CW305 to a computer to provide power to the board and to reconfigure the FPGA. All information that needs to be sent to the CW305 during the attack should be sent through the CWLite.

In varici’s case (and likely yours as well), the power draw of the CW305 is causing issues with the computer’s ability to provide power to the CWLite. What does your USB setup look like? Are you running the CW305 and the CWLite from different USB ports on your computer, or through USB hubs? If you’re running them through hubs, you might need them to have their own dedicated USB ports. If they have their own ports, you might be able to solve this by powering the CW305 through a wall charger.

Alex

12

Hi Alex,

The ADC LED comes on from that time when I run the “connect_cwlite_simpleserial.py” and it has never been off since then.

The CW-Lite and CW305 has their own ports on computer. But the CW305 can only choose connection from computer or DC input. This makes it impossible to use it with other power supply. Or maybe am I wrong?

After capturing the trace, the red and blue LEDs are on(LED5 and LED7), the green LED is off(LED6, which indicates the encryption clock).

Yang

13

Hi Yang,

Can you tell me the steps you’re taking to run an attack?

Alex

14

Hi Alex,

First, I connect the boards following the steps in tutorial:
https://wiki.newae.com/Tutorial_CW305-1_Building_a_Project,
and the usb wires connected to two ports on computer.

Second, I do the following steps in CaptureV4.0.2: run the “connect_cwlite_simpleserial.py”, in generic settings tab change the Target module to CW305, click on the “Target Connect” button, in the target settings tab choose the example bit file and click program FPGA, run “setup_cwlite_cw305.py”, and click capture 1 trace.

And the warning shows: "WARNING - No samples received. Either very long offset, or no ADC clock (try “Reset ADC DCM”). If you need such a long offset, manually update “nosampletimeout” limit in source code. "

Yang

15

Hi Yang,

Looking at the setup script for the CW305, it looks like it actually uses the clock from the CW305 for the CWLite’s ADC clock. Since the ADC DCM doesn’t lock, that points to an issue with the clock from the CW305. I believe you’ll need (on switch S2), J16 to be set to 0 and K16 to be set to 1. If everything’s setup right, under ADC Clock->Freq Counter, you should see the frequency of the clock from the CW305. If Source is “EXTCLK x4 via DCM” and DCM Locked isn’t checked, try hitting the Reset DCM button a few times.

EDIT: S2 is on the CW305

Also looks like I’m wrong about communication, it seems like that does have to be done over USB to the CW305. Sorry about the confusion.

Alex

16

Hi Alex,

I solved it. It was someone has changed the PLL settings of CW305. Now it workes. Your answer inspired me to check every setting. Thank you so much.

Yang

17

Hi,

I am getting the following error when running my python script (PA_HW_CW305_1-Attacking_AES_on_an_FPGA):

Traceback (most recent call last):
File “D:\ChipWhisperer5_64\projects\testcapture.py”, line 121, in
assert (scope.clock.adc_locked), “ADC failed to lock”
AssertionError: ADC failed to lock

See my settings below:

  1. J16: Set to 0
  2. K16: Set to 1
  3. K15: Set to 1
  4. L14: Set to 1

The Scope settings on my Python script:
scope = cw.scope()
scope.gain.db = 25
scope.adc.samples = 129
scope.adc.offset = 0
scope.adc.basic_mode = “rising_edge”
scope.clock.adc_src = “extclk_x4”
scope.io.hs2 = “disabled”

The PLL settings on my Python script:
target.vccint_set(1.0)
target.pll.pll_enable_set(True)
target.pll.pll_outenable_set(False, 0)
target.pll.pll_outenable_set(True, 1)
target.pll.pll_outenable_set(False, 2)

target.pll.pll_outsource_set(“PLL0”, 0)

target.pll.pll_outfreq_set(10E6, 1)

target.clkusbautooff = True
target.clksleeptime = 1

Simply I re-run the scope.clock.reset_adc(), but it should not fix the error.

18

What does scope.clock show?
Sometimes, reset_adc() needs to be called a few times; can you try re-running it several times to see if it ever succeeds?

Jean-Pierre

19

How to check the scope.clock in the CW lite?

Yes, I re-run reset_adc() several times, but I am getting the same error.

Sometime it is running correctly without this error (i.e., 1 out of 20). but most of the times I am getting this same error when I am running the same script.

20

scope.clock is just what you’d run in Jupyter, it will report the clock settings and the measured clock frequencies. Run that command and let me know what it shows.

It’s a bit odd that reset_adc() should fail at such a high rate. If you don’t like having to re-run it manually until it succeeds, you can simply put it in a for loop that you break out of as soon as you get a successful lock:

tries = 100
for i in range(tries)
    scope.reset_adc()
    if scope.clock.adc_locked:
        break
if not scope.clock.adc_locked:
    print("Couldn't lock")