Experimenting with Clock Glitching CW Lite

[enrique.garciaj]

Hi, I’m really mess with this I connect to my DUT (Infineon) clock input, the main idea is generate 16Mhz for running the DUT, for now it works, now I want to generate glitches on this clock to find a configuration that works for this DUT. But the glitches do not appear.

The green line is a trigger generated by CW Lite to an external scope, as you can see there’s no glitches in the middle of the high state of the signal.
Here is my code:
import chipwhisperer as cw
import time

Basic setup

scope = cw.scope()
scope.glitch.clk_src = ‘clkgen’ # Use clock generator as source
scope.clock.clkgen_freq = 16E6 # Set frequency to 16MHz
scope.io.hs2 = “clkgen” # Output clock signal on HS2 pin
scope.io.tio4 = “gpio_low” # Start with TIO4 low
scope.io.glitch_hp = False # Turn off glitch high-power output
scope.io.glitch_lp = False # Turn off glitch low-power output

Configure glitch parameters

scope.glitch.width = 25 # Width for 31.2ns duration
scope.glitch.offset = 25 # Offset for 31.25ns delay
scope.glitch.trigger_src = ‘ext_single’ # Use single trigger mode
scope.glitch.output = “clock_xor” # XOR clock with glitch
scope.glitch.repeat = 8 # Single glitch per trigger

def perform_delayed_glitch(delay_s=15, duration_ms=5):
“”“Wait specified seconds, then perform continuous glitches for duration”“”
print(f"16MHz clock running. Waiting {delay_s} seconds before glitching…")
time.sleep(delay_s) # Wait before starting glitches

print(f"Starting continuous glitch sequence for {duration_ms}ms...")

# Use precise timing for TIO4 control
start_time = time.perf_counter()
scope.io.tio4 = "gpio_high"           # Set trigger high
scope.arm()                           # Arm once for continuous glitching

# Active wait for precise timing
while (time.perf_counter() - start_time) < (duration_ms / 1000.0):
    pass

scope.io.tio4 = "gpio_low"            # Stop triggering immediately
print("Glitch sequence completed")

Execute delayed glitch sequence

try:
perform_delayed_glitch(15, 5) # 15s delay, then 5ms of glitches
except Exception as e:
print(f"Error during glitch sequence: {e}")
finally:
scope.dis() # Disconnect scope
_________________________________________ END OF CODE
Acctually with the 16Mhz clock DUT works at 100%
The signal in the image is at output from the CW Lite, but I connect a Clock Buffer between CW Lite and the DUT for a smooth signal, that makes the DUT works.

The intention is generate a continuos glitch by 5 ms, but I don’t know how to stop the glitch without stop the 16mhz…

Please advice

[Alex_Dewar]

Your issue is probably that you’re outputting "clkgen" on HS2. You need to change this to "glitch" to connect the glitch module to the clock output.

[enrique.garciaj]

Hi, thanks for your interest on my issue.
I change the line to : scope.io.hs2 = “glitch”
That sounds logic
But, the same result on the external scope.

Best Regards,

[Alex_Dewar]

Ah your trigger code doesn’t look correct here either. The trigger for the glitch works the same as a rising edge trigger on an oscilloscope - you’re arming the glitch (scope.arm()), then doing your trigger event (scope.io.tio4 = "gpio_high") in perform_delayed_glitch, which is backwards from how you want it. You also need to call scope.capture() after you set your GPIO high to disarm the ChipWhisperer properly.

I think an easier way to do what you want is to simply use the continuous trigger source. Try this version of perform_delayed_glitch():

def perform_delayed_glitch(delay_s=15, duration_ms=5):
    """Wait specified seconds, then perform continuous glitches for duration"""
    print(f"16MHz clock running. Waiting {delay_s} seconds before glitching…")
    time.sleep(delay_s) # Wait before starting glitches
    print(f"Starting continuous glitch sequence for {duration_ms}ms...")

    # Use precise timing for TIO4 control
    start_time = time.perf_counter()
    scope.glitch.trigger_src = "continuous" #insert glitch on every clock cycle

    # Active wait for precise timing
    while (time.perf_counter() - start_time) < (duration_ms / 1000.0):
        pass

    scope.glitch.trigger_src = "ext_single" #stop inserting glitches

    print("Glitch sequence completed")

[enrique.garciaj]

You’ve been glitched

Thanks

[enrique.garciaj]

Hi, I change the code using using:
scope.glitch.trigger_src = ‘ext_single’ # Use single trigger mode
scope.glitch.output = “clock_xor” # XOR clock with glitch
scope.glitch.repeat = 8192

And then:
scope.arm()

For testing with smaller periods of attack, but I observe a difference, with ‘ext_single’ the glitch in on each period and with ‘continuos’ one period with glitch and period without glitch, and so on.

I attach image with ‘ext_single’, previously is the image for continuous mode. my question is this normal?

Best Regards,