CW-Lite VCC glitching

Okay, here are the screen shots of the scope configuration. I’m also including a commented log of the resulting Python commands, as that might be easier to look at.

[code]# These come up automatically
[‘Glitch Explorer’, ‘Recordings’, ‘Notes’, ‘’]
[‘Key/Text Pattern’, ‘Fixed Encryption Key’, ‘2b 7e 15 16 28 ae d2 a6 ab f7 15 88 09 cf 4f 3c’]
[‘Key/Text Pattern’, ‘Fixed Plaintext Key’, ‘00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F’]

Enter these in the GUI

[‘Generic Settings’, ‘Scope Module’, ‘ChipWhisperer/OpenADC’]
[‘Generic Settings’, ‘Target Module’, ‘Simple Serial’]
[‘OpenADC Interface’, ‘connection’, ‘ChipWhisperer Lite’]
[‘Target Connection’, ‘connection’, ‘ChipWhisperer-Lite’]

Then push Connect Scope and Connect Target, and these come up automatically

[‘OpenADC’, ‘Trigger Setup’, ‘Total Samples’, 24573]
[‘OpenADC’, ‘Clock Setup’, ‘ADC Clock’, ‘Source’, ‘CLKGEN x1 via DCM’]
[‘OpenADC’, ‘Clock Setup’, ‘CLKGEN Settings’, ‘Multiply’, 1]
[‘OpenADC’, ‘Clock Setup’, ‘CLKGEN Settings’, ‘Divide’, 1]
[‘Glitch Module’, ‘Glitch Width (as % of period)’, OrderedDict([(‘readonly’, False)])]
[‘Glitch Module’, ‘Glitch Width (as % of period)’, (0.0, 49.80392156862745)]
[‘Glitch Module’, ‘Glitch Offset (as % of period)’, OrderedDict([(‘readonly’, False)])]
[‘Glitch Module’, ‘Glitch Offset (as % of period)’, (-49.80392156862745, 49.411764705882355)]
[‘Glitch Module’, ‘Repeat’, 1]
[‘Glitch Module’, ‘Output Mode’, ‘Clock XORd’]
[‘CW Extra’, ‘CW Extra Settings’, ‘Trigger Pins’, ‘Target IO1 (Serial TXD)’, False]
[‘CW Extra’, ‘CW Extra Settings’, ‘Trigger Pins’, ‘Target IO2 (Serial RXD)’, False]
[‘CW Extra’, ‘CW Extra Settings’, ‘Trigger Pins’, ‘Target IO3 (SmartCard Serial)’, False]
[‘CW Extra’, ‘CW Extra Settings’, ‘Trigger Pins’, ‘Collection Mode’, ‘OR’]
[‘Glitch Module’, ‘Glitch Width (fine adjust)’, 0]
[‘Glitch Module’, ‘Glitch Offset (fine adjust)’, 0]

Then enter these in the GUI

[‘OpenADC’, ‘Clock Setup’, ‘Freq Counter Src’, ‘CLKGEN Output’]
[‘OpenADC’, ‘Clock Setup’, ‘CLKGEN Settings’, ‘Multiply’, 2]
[‘OpenADC’, ‘Clock Setup’, ‘CLKGEN Settings’, ‘Divide’, 26]
[‘OpenADC’, ‘Clock Setup’, ‘CLKGEN Settings’, ‘Desired Frequency’, 7370000.0]
[‘Glitch Module’, ‘Clock Source’, ‘CLKGEN’]
[‘CW Extra’, ‘CW Extra Settings’, ‘Target HS IO-Out’, ‘Glitch Module’]
[‘CW Extra’, ‘CW Extra Settings’, ‘Target IOn Pins’, ‘Target IO1’, ‘Serial RXD’]
[‘CW Extra’, ‘CW Extra Settings’, ‘Target IOn Pins’, ‘Target IO2’, ‘Serial TXD’]
[‘Glitch Module’, ‘Glitch Width (as % of period)’, 10.0]
[‘Glitch Module’, ‘Glitch Offset (as % of period)’, 10.0]
[‘Generic Settings’, ‘Auxiliary Module’, ‘Reset AVR/XMEGA via CW-Lite’]
[‘Target Connection’, ‘Load Key Command’, u’‘]
[‘Target Connection’, ‘Go Command’, u’‘]
[‘Target Connection’, ‘Output Format’, u’']
[‘OpenADC’, ‘Clock Setup’, ‘ADC Clock’, ‘Source’, ‘CLKGEN x4 via DCM’]
[‘OpenADC’, ‘Clock Setup’, ‘ADC Clock’, ‘Reset ADC DCM’, None]
[‘OpenADC’, ‘Trigger Setup’, ‘Mode’, ‘rising edge’]
[‘OpenADC’, ‘Trigger Setup’, ‘Total Samples’, 1000]
[‘OpenADC’, ‘Gain Setting’, ‘Setting’, 40]
[‘Glitch Module’, ‘Glitch Trigger’, ‘Ext Trigger:Single-Shot’]
[‘Glitch Module’, ‘Repeat’, 5]

Then I press Capture 1 - trigger but no glitches

So I put in this

[‘Glitch Module’, ‘Glitch Trigger’, ‘Ext Trigger:Continous’]

And press Capture 1 - trigger and glitches

[/code]

I don’t know how much to dwell on the weird trace data. I don’t think it’s causing any immediate problem with the glitching, but it could be indicating something else going wrong, and it would definitely cause problems with analog/SAD triggering, I think.

Well, back to attacking the XMega with Glitch Explorer. Can I get a weaker XMega? I think the one I have is too robust : )

I have no solution to your problem still… but as a note I’ve updated the VCC Glitching tutorial at newae.com/sidechannel/cwdocs/tut … chvcc.html (be sure to Ctrl-Refresh to clear your Cache).

For the past few days I’ve been having trouble getting the XMEGA to VCC glitch, so did this tutorial with the NOTDuino. When I first built the CW-Lite I had confirmed the XMEGA VCC glitch worked OK, so I know it’s possible, but might take a very long (day or two) run with the Glitch Explorer to figure out all the permutations. Of course I can no longer find my notes from that original glitch attempt, although I’m 80% sure I did record that stuff somewhere.

Anyway in the mean-time I really wanted to get the VCC glitching tutorial pushed out, so switch to the NOTDuino today so I could finish it!

hello Collyn
i will add some question to that thread because it has something to do with xmega so…
i wanna try to glitch xmega with vcc and clk glitches no matter if this tutorial doesnt work for now i can tune the glitch and observe the results - just i wanna to learn glitch explorer and so on but ! there is missing glitch-simple folder with proper C files for compille and run on xmega… - can you upload them ? i did checked few of chipwhisperer reeleases and any of release doesnt have this files
thanks

Ah, the glitch-simple should compile on the XMEGA I thought? Basically there isn’t a separate .c file for the XMEGA now, you have to edit the “Makefile” to specify the XMEGA platform.

At one point there was a separate file for the XMEGA target but that is no longer valid. It might be it’s just some old documentation that hasn’t been updated!

yes…
look here newae.com/sidechannel/cwdocs … litch.html

6.2.3. Setting up Glitch Example

The glitch examples requires you to program the target device. The software to program is located at chipwhisperer\hardware\victims\firmware\glitch-simple -----> there is not any software like that !

You should also open the file glitchsimple.c which is the source code. The subroutine being glitched in this example looks like this: ----------> also there is nothing like that…

Damn sorry, will add to my list to fix just now! It’s getting a large backlog though but will hopefully get a chance this week to finally get through it all…