Fault injection on Husky with CW308T-XMEGA

I’m trying to execute the basic Fault 2_1 (glitching on loop) on CW308T-XMEGA with the Husky, but I’m not able to manage it.I already done the lab with the CW lite and everything was fine (not in this setup but similar).

The current UFO setup is thisone:

Also checking with the oscilloscope the glitch seems to be injected (pink is the clock)

I’ve also tried widening the ranges, but I’ve never been able to get a single glitch fixed.

num_tries = 3
gc.set_range("tries", 0, num_tries)

gc.set_range("width", 1850, 2100)
gc.set_range("offset", 2000, 2400)
gc.set_global_step([10]) # reduce to fine tune glitching

gc.set_step("ext_offset", 1)
gc.set_range("ext_offset", 10, 50)

Also using LP and HP.

scope.io.glitch_lp = True
scope.io.glitch_hp = True

When the width exceeds a certain limit they always reset.


Any guesses as to why it might not be working properly?

Thank you in advance


Try increasing the offset range to its full extent. You should keep the width near where it starts to reset. You may also want to try clocking the XMEGA higher, like we do with the Lite.


Hello Alex,

thank for your reply, I took sometime to execute some tests on the hardware. Here the results.

First of all I check the CWLITEXMEGA setup (using the light and the xmega born with the lite).

First check gave me no appreciable results.

Then I noticed that change: update cwlitexmega vglitch ranges · newaetech/chipwhisperer-jupyter@1f9b6d5 · GitHub and tried the old settings.

Then I switched to CWLITE + cw308t-xmega replicating the same configuration, and the results are the same. With the data taken from the old CW the situation is quite the same, with the new data I was unable to get a single working fault.

At this point I switched back to the husky + cw308t-xmega. Using these settings I get it working. Switching to the 32Mhz was the key.

scope.clock.clkgen_freq = 32E6

if SS_VER=='SS_VER_2_1':
    target.baud = 230400*32/7.37
    target.baud = 38400*32/7.37

scope.io.glitch_hp = True
scope.io.glitch_lp = True

gc.set_range("width", 2200, 4000)

gc.set_range("offset", 1000, 3500)
gc.set_global_step([50]) # reduce to fine tune glitching

gc.set_step("ext_offset", 1)
gc.set_range("ext_offset", 25, 31)
scope.glitch.repeat = 10

Here the results:

From what I could see limiting the ranges too much in the tutorials could create a lot of problems. I have no idea why with my hardware the data is so different from the new ones on github.

Thank you.