CW1200 + STM32F303+ CW308T Clock glitching to bypass password

I am not able get successful glitches for the default range of width and offset & ext_offset.
i.e
width = [2,14]
offset = [-14,14]
ext_offset =[11,31]

@Alex_Dewar kindly help me out , what the range needs to be for successful glitches to occur.

Can you please tell me if the platform name changes for STM32F303 With CW1200 capture?

Thanks
Niharika

Hi,

Did you get successful glitches in the previous glitching lab? If so, try using those settings instead.

Alex

1 Like

Hi @Alex_Dewar I got successful glitches for the previous lab and used the same range for this too that is width - 0-48 , offset - (-48,48). No luck either. Step size too i matched with the previous lab but no success hits.
Please let me know the range I can try to get successful hits.

And now I got an error on the capture box when I tried to execute the Power analysis for bypass password with STM32F303 & PSOC 62, A picture of the same is attached below. I tried to restart and clock glitching works fine but not power analysis the same issue comes up. Does this mean something has gone wrong in the capture box??

Please let me know the range for Clock glitching to Bypass Password.

Regards

In that case, try increasing the range of ext_offset. You might not be hitting the right instruction with that current range.

That hard fault error you’re getting should be fixed with the newest firmware update. I’d recommend updating to the newest firmware. I’ll check a bit later, but I believe the newest should be 1.60.1

Alex

1 Like

Hi @Alex_Dewar , I updated it to the lastest firmwarelike you said which was 1.60.0.
But still getting the Hard Fault error on the capture box when I execute this below cell

trace_test = cap_pass_trace(“h\n”)

#Basic sanity check
assert(len(trace_test) == 3000)
print(“:heavy_check_mark: OK to continue!”)

The error is as follows


USBTimeoutError Traceback (most recent call last)
c:\users\shobha~1\chipwh~1\cw\home\portable\chipwhisperer\software\chipwhisperer\capture\targets\SimpleSerial.py in read(self, num_char, timeout)
269 num_char = self.ser.inWaiting()
→ 270 return self.ser.read(num_char, timeout)
271 except USBError:

c:\users\shobha~1\chipwh~1\cw\home\portable\chipwhisperer\software\chipwhisperer\capture\targets\simpleserial_readers_base.py in read(self, num, timeout)
133 # If we didn’t get enough data, try to read more from the hardware
→ 134 data = bytearray(self.hardware_read(num, timeout=timeout)).decode(‘latin-1’)
135 for c in data:

c:\users\shobha~1\chipwh~1\cw\home\portable\chipwhisperer\software\chipwhisperer\capture\targets\simpleserial_readers\cwlite.py in hardware_read(self, num, timeout)
80 def hardware_read(self, num, timeout=250):
—> 81 return self.cwlite_usart.read(num, timeout)

c:\users\shobha~1\chipwh~1\cw\home\portable\chipwhisperer\software\chipwhisperer\hardware\naeusb\serial.py in read(self, dlen, timeout)
187 if waiting > 0:
→ 188 newdata = self._usb.readCtrl(self.CMD_USART0_DATA, 0, min(min(waiting, dlen), self._max_read))
189 resp.extend(newdata)

c:\users\shobha~1\chipwh~1\cw\home\portable\chipwhisperer\software\chipwhisperer\hardware\naeusb\naeusb.py in readCtrl(self, cmd, value, dlen)
791 # Vendor-specific, IN, interface control transfer
→ 792 return self.usbseralizer.readCtrl(cmd, value, dlen)
793

c:\users\shobha~1\chipwh~1\cw\home\portable\chipwhisperer\software\chipwhisperer\hardware\naeusb\naeusb.py in readCtrl(self, cmd, value, dlen)
190 cmdpacket = self.make_cmd(self.READ_CTRL, cmdpacket)
→ 191 return self.process_rx(self.txrx(tx=cmdpacket))
192

c:\users\shobha~1\chipwh~1\cw\home\portable\chipwhisperer\software\chipwhisperer\hardware\naeusb\naeusb.py in txrx(self, tx)
298 if cmd == self.READ_CTRL:
→ 299 response = self.usbdev().ctrl_transfer(payload[0], payload[1], payload[2], payload[3], payload[4], timeout=self._timeout)
300 naeusb_logger.debug("READ_CTRL: bmRequestType: {:02X}, \

~\WPy64-3771\python-3.7.7.amd64\lib\site-packages\usb\core.py in ctrl_transfer(self, bmRequestType, bRequest, wValue, wIndex, data_or_wLength, timeout)
1078 buff,
→ 1079 self.__get_timeout(timeout))
1080

~\WPy64-3771\python-3.7.7.amd64\lib\site-packages\usb\backend\libusb1.py in ctrl_transfer(self, dev_handle, bmRequestType, bRequest, wValue, wIndex, data, timeout)
900 length,
→ 901 timeout))
902

~\WPy64-3771\python-3.7.7.amd64\lib\site-packages\usb\backend\libusb1.py in _check(ret)
601 elif ret == LIBUSB_ERROR_TIMEOUT:
→ 602 raise USBTimeoutError(_strerror(ret), ret, _libusb_errno[ret])
603 else:

USBTimeoutError: [Errno 10060] Operation timed out

During handling of the above exception, another exception occurred:

Warning Traceback (most recent call last)
in
----> 1 trace_test = cap_pass_trace(“h\n”)
2
3 #Basic sanity check
4 assert(len(trace_test) == 3000)
5 print(“:heavy_check_mark: OK to continue!”)

in cap_pass_trace(pass_guess)
3 num_char = target.in_waiting()
4 while num_char > 0:
----> 5 target.read(num_char, 10)
6 time.sleep(0.01)
7 num_char = target.in_waiting()

c:\users\shobha~1\chipwh~1\cw\home\portable\chipwhisperer\software\chipwhisperer\capture\targets\SimpleSerial.py in read(self, num_char, timeout)
271 except USBError:
272 self.dis()
→ 273 raise Warning(“Error in target. It may have been disconnected”)
274 except Exception as e:
275 self.dis()

Warning: Error in target. It may have been disconnected

And extending the ext_offset worked :smiley:

Regards,
Niharika

Good to hear that the new glitch settings worked for you.

The new firmware is 1.60.1. 1.60.0 is the one with the hard fault error.

Alex

1 Like

Hi, @Alex_Dewar is there any command/program line to upgrade to a particular version of firmware, because it says the latest version is 1.60.0

If there is a way to update to a particular version of firmware please let me know how.

Regards,
Niharika

How are you upgrading? If you’ve got the latest git commit, running import chipwhisperer as cw; scope = cw.scope(); scope.upgrade_firmware() should grab the newest firmware for you.

Alex

1 Like

Scope.upgrade_firmware() is giving me 1.60.0 and not 1.60.1

Regards
Niharika

Are you on the latest git commit? Worst case, you should be able to replace software/chipwhisperer/hardware/firmware/cw1200.py with chipwhisperer/cw1200.py at develop · newaetech/chipwhisperer · GitHub.

Alex

1 Like

Will try this. I am not sure if I am on the latest git commit will check that too. And then try to update the firmware.

Thank you @Alex_Dewar

Niharika

1 Like

Hi @Alex_Dewar ,It worked Thank you so much :smiley:

Regards,
Niharika

Hi @Alex_Dewar , trying to perform side channel analysis with a third party board that is PSOC62 But getting a different result/graph than what is expected.
What changes needs to done to get the expected out put. when I say different output I mean

a diff = 3.2568359375
b diff = 3.607421875
c diff = 3.30078125
d diff = 3.3828125
e diff = 3.25
f diff = 3.046875
g diff = 3.2021484375
h diff = 3.548828125
i diff = 2.974609375
j diff = 2.923828125
k diff = 2.98828125
l diff = 3.701171875
m diff = 3.6982421875
n diff = 3.37890625
o diff = 3.224609375
p diff = 3.62109375
q diff = 3.662109375
r diff = 2.8876953125
s diff = 3.59375
t diff = 3.16796875
u diff = 3.3017578125
v diff = 2.76953125
w diff = 3.4384765625
x diff = 12.244140625 //which should be more than 40
y diff = 3.37890625
z diff = 2.95703125
0 diff = 3.4287109375
1 diff = 3.5654296875
2 diff = 3.5625
3 diff = 3.244140625
4 diff = 3.228515625
5 diff = 3.63671875
6 diff = 3.5791015625
7 diff = 3.708984375
8 diff = 2.9462890625
9 diff = 3.091796875

and not getting this below result`
h
h0
h0p
h0px
h0px3

for this I have connected 20 pin cable between target board and capture board, sma cable to measure port, and power cable for target board.
please tell me the changes I have to do here to get the desired output?

Regards
Niharika

Try changing the threshold you use for a successful character.

1 Like

Is there any maximum number for threshold like we have in glitching (-49,49) or I can give any number as threshold?? I can give any number above 40 right?

Niharika

The threshold is just a number you pick to distinguish between correct and incorrect answers. If I understand your earlier post right, all the wrong guesses have a difference around 3-4, while the correct guess has a difference around 12. You might pick something like 8 as a threshold, since it’s between 4 and 12.

Alex

1 Like

Oh understood, will try this and thanks again for helping me clear the Hard fault error.

Niharika

Hi @Alex_Dewar , It worked . Thank you so much

Niharika

1 Like