CW308 Target w/o direct access to Vcore


want to design a target for CW308. Target MCU will be STM32L552VET6 as it supports ARMv8-M w TZ.
I know there is already is a Cortex-M33 target (NXP LPC55S69), but I want to stick with this one.

Long story short, the goal is to generate reliable glitches.
But as there is also some built in crypto etc., I wanted to keep the opportunity for doing SCA later on.
When I was going to place the shunt, I found that the Vcore is exclusively supplied via an internal regulator, that cannot be turned off. The regulator gets supplied by VDD, which also powers I/O and some more stuff. This is why I expect a lots of noise here.

What would you do in this case?
Have you encountered something similar before?

Would be kind of sad to manufacture a target only for glitching and afterwards realize that you could have both.


Hi Lee,

We actually have an STM32L5 target (the L562RET6). Out of stock right now (, but you should be able to grab one of the blank CW308-STM32F boards and solder on the components yourself.

Yeah the internal regulator situation is pretty common, actually. Luckily these chips usually have the output of the regulator on a pin for connecting the big external components (capacitors and inductors). If it’s a linear regulator, you can feed in a slightly higher voltage on the output of the regulator (might be labled as decoupling capacitor pins, like on the STM32F* series). A switch mode will have a core voltage input that you can directly power, just make sure to power the feedback pin as well to stop the internal regulator from switching.


1 Like