CW308 Connect With STM32F Controlling with SimpleSerial

Embedded Security ChipWhisperer Software
1

Hi,
I connect the CW1173 ChipWhisperer-Lite through the CW308 UFO to control the STM32F303.
I follow CW308T-STM32F - NewAE Hardware Product Documentation
to programming via ChipWhisperer bootloader.
If I use the following code:

import chipwhisperer as cw
scope = cw.scope
target = cw.target(scope)
scope.default_setup()

I would encouter some problem :

AttributeError: 'function' object has no attribute '_get_usart'

However, I change to use provided file Setup_Generic.ipynb and program with firmware.hex, the board can be programed successfully.

Verified flash OK, 6247 bytes
Firmware uploaded successfully.

After the setup is complete, I want to write the key and plaintext and trigger AES start.

  1. set AES key
# Set the AES key
key = bytearray([0x2b, 0x7e, 0x15, 0x16, 0x28, 0xae, 0xd2, 0xa6, 0xab, 0xf7, 0x15, 0x88, 0x09, 0xcf, 0x4f, 0x3c])
response = target.simpleserial_write('k', key)

# Waits for an ack from the target for timeout ms
response = target.simpleserial_wait_ack
print("AES key set response:", response)

Get response:

AES key set response: <bound method SimpleSerial.simpleserial_wait_ack of SimpleSerial Settings =
	output_len             = 16
	baud                   = 38400
	simpleserial_last_read = 
	simpleserial_last_sent = k2b7e151628aed2a6abf7158809cf4f3c
>
  1. Set Plaintext and trigger start
plaintext = bytearray([0x6b, 0xc1, 0xbe, 0xe2, 0x2e, 0x40, 0x9f, 0x96, 0xe9, 0x3d, 0x7e, 0x11, 0x73, 0x93, 0x17, 0x2a])
response = target.simpleserial_write('p', plaintext)

# Waits for an ack from the target for timeout ms
response = target.simpleserial_wait_ack
print("AES plaintext set response:", response)

Get response:

AES plaintext set response: <bound method SimpleSerial.simpleserial_wait_ack of SimpleSerial Settings =
	output_len             = 16
	baud                   = 38400
	simpleserial_last_read = 
	simpleserial_last_sent = p6bc1bee22e409f96e93d7e117393172a
>
  1. Read ciphertext
print(target.simpleserial_read('r', 16))
print(target.simpleserial_read_witherrors('r', 16))
print(target)

Get response:

None
{'valid': False, 'payload': None, 'full_response': '', 'rv': None}
SimpleSerial Settings =
	output_len             = 16
	baud                   = 38400
	simpleserial_last_read = 
	simpleserial_last_sent = p6bc1bee22e409f96e93d7e117393172a

It seems fail to read the result from simpleserial.
How can I solve the problem?

Thanks!
ZT

2

Hi,

Calling a function and assigning a function are two different things. You need to call simpleserial_wait_ack() instead of just assigning it.

3

Hi,
Sorry for my misunderstanding. After I modify the code, the code will become:

# Set the AES key
key = bytearray([0x2b, 0x7e, 0x15, 0x16, 0x28, 0xae, 0xd2, 0xa6, 0xab, 0xf7, 0x15, 0x88, 0x09, 0xcf, 0x4f, 0x3c])
target.simpleserial_write('k', key)
# Waits for an ack from the target for timeout ms
target.simpleserial_wait_ack()

Get “0”, it seems work properly.

plaintext = bytearray([0x6b, 0xc1, 0xbe, 0xe2, 0x2e, 0x40, 0x9f, 0x96, 0xe9, 0x3d, 0x7e, 0x11, 0x73, 0x93, 0x17, 0x2a])
target.simpleserial_write('p', plaintext)
# Waits for an ack from the target for timeout ms
target.simpleserial_wait_ack()

I get the response like below message:

(ChipWhisperer Target ERROR|File SimpleSerial.py:317) Ack error: r3AD

Then, I read the result from target.

print(target.simpleserial_read('r', 16))
print(target)

I get the response like below message:

(ChipWhisperer Target WARNING|File SimpleSerial.py:410) Unexpected start to command: 7
None
SimpleSerial Settings =
	output_len             = 16
	baud                   = 38400
	simpleserial_last_read = 77BB40D7A3660A89ECAF32466EF97
	z00
	
	simpleserial_last_sent = p6bc1bee22e409f96e93d7e117393172a

It seems that the key was successfully sent according to my code. I would like to ask if it might be due to other configuration issues or command errors.
To facilitate resolving the issue, I am providing the following information about setting and firmware.

SCOPETYPE = 'OPENADC'
PLATFORM='CW308_STM32F3'
CRYPTO_TARGET = 'TINYAES128C'

%%bash
cd ../../hardware/victims/firmware/simpleserial-aes
# Compile the firmware using the Makefile to generate firmware.hex
make PLATFORM=CW308_STM32F3 CRYPTO_TARGET=TINYAES128C

How can I solve the problem?
Thanks!
ZT

4

This issue is probably that you’re not waiting enough time before sending the message and receiving it. I’d recommend throwing a time.sleep(0.25) in between sending and trying to read the response.

1 Like
5

Hi,
Althrough I add time.sleep(0.25) between every two command, it still get the same error.
I think it might not cause by this reason. Because of “r3AD” seems the command of reading cipher text and the first byte of the ciphertext in Ack error: r3AD.
The expected ciphertext will be bytearray([0x3a, 0xd7, 0x7b, 0xb4, 0x0d, 0x7a, 0x36, 0x60, 0xa8, 0x9e, 0xca, 0xf3, 0x24, 0x66, 0xef, 0x97]).
Delete the target.simpleserial_wait_ack() after transmitting the plaintext command and read the ciphertext directly. I get the correct results.
Thanks for your help!
ZT

6

Whoops, sorry I missed that call in your second code block. Yeah the ack is done after the simpleserial_put() call in the C code, so we end up just rolling the ack check into the simplserial-read().

Alex

7

Roger that! :smiley: Thanks!
ZT