Help needed with Tutorial A3 VCC Glitching XMEGA Target


#61

Hi Alex,

I’ve finally managed to get glitch_infinite( ) and glitch1( ) to work using Vcc glitch on the V4 software.
But the glitch parameters I’ve got don’t really have a high success percentage, probably 7% at best.
I also noticed that the glitch parameters for glitch_infinite( ) and glitch1( ) were different. I’m guessing that this difference could be due to their instructions?

Regards,
Melvin.


#62

Hi Melvin,

I have the same result. I’m think the same what this is result of differents in instructions.
In my experience the best results can give short length of cable. Now I use 10 cm coax and I have 70-80%. When I using 60 cm caox the probably is near 20%. But another length of cable needed another glitch width and offset.

Regards,
Nik.


#63

Alex

Good to hear you finally got some glitches! I’d suspect you’re probably right regarding the instruction differences. Out of curiosity, how much did the parameters change by?

If either of you want to try some additional glitching, Fault_4 seems to work pretty well with voltage glitching (and I’d imagine Fault_5 would as well).

Alex


#64

Hi Alex,

Using the V4 and a 15cm coax cable on the STM32F3 target board, the high power Vcc glitch parameters for glitch_infinite( ) are as follows:

  • Glitch Width : 42.2, 42.6
  • Glitch Offset : -26.95, -35.94, -36.33, -36.72
  • Ext Offset : 2188
  • Repeat: 1
  • Success Rate: 20% ~ 80%

And the high power Vcc glitch parameters for glitch1( ) are as follows:

  • Glitch Width : 42.2
  • Glitch Offset : -46.48
  • Ext Offset : 149, 157, 209, 212, 215, 247, 269, 284
  • Repeat: 1
  • Success Rate: 1% ~ 7%

I also hooked an oscilloscope onto the CW308 to find out the difference between the outputs of V4 and V5 software. They look very much alike. Speaking of which, for Vcc glitching, both V4 and V5 software allow the glitch widths to be set with negative values. Does a negative glitch width make any sense? Likewise, for clock glitching, does a negative glitch width make any sense? If so, how would they look like on a plot/scope?

Thanks.

Regards,
Melvin.


#65

Hi Melvin,

Here’s what the glitch generation signals look like:

All a negative width means is that phase shift two creates the rising edge of the signal instead of the falling edge and phase shift 1 creates the falling edge instead of the rising edge.

Alex


#66

Hi Alex,

If I understand you correctly, does that mean that for a given negative glitch width, there is always positive complement of it, i.e. glitch width = -10 = 40? If so, then that would reduce the search space by quite a fair bit =)

Regards,
Melvin.


#67

Hi Melvin,

This should be the case; however, I personally haven’t seen this during any glitch attacks that I’ve done.

Alex


#68

Hi Alex,

Do you know why do our glitch parameters differ even though we (me, Nik, and yourself) are all performing Vcc glitching on the same STM32F3 target boards running the same tutorial examples?
Is there any place where I could find more information on this?

Regards,
Melvin.


#69

Hi Melvin,

The most part of differ, it is length of cable, mosfet transistor (in different versions of CW it different) and the tool have rather parameters too (I use CW1200 Pro).
I think that the width of impulse in seconds near of 1.7 Voltage on PCB STM32F3 must be constant for all. It can mesuared by oscilloscope.
The phase offset include all different listed above and must be different. It is just only My things.

Regards,
Nik.


#70

Hello.

I also failed XMEGA glitch and am trying to glitch with STM32.
There is one question. Please let me know if you know anything.

Q:Where should I connect the glitch port of CW1173 ChipWhisperer-Lite on CW308 UFO Target ?
I think it is necessary to connect the glitch port for glitch.

Regards,
sato


#71

Hi Sato,

According to your photo, you should only connect the coax cable to the glitch port of the CW1173 as there is only one SMA connector on the CW308, which serves as both the glitch input and capture output.
You do not need to connect the coax cable to the capture port for Vcc glitch to work.
In order to perform both glitching and capture, you will need a SMA TEE adapter/connector to be connected on the CW308.

Regards,
Melvin.


#72

Hi Melvin,

Sorry about the slow response. I’d concur with Nik in that those all have a lot to do with variability in the glitch settings between different boards. Unfortunately, there’s a lot of complicated stuff going on in the chip when we do glitching and we don’t really know the underlying circuit, so we can’t really say for certain, just make educated guesses.

Alex


#73

Hi Melvin,

Thamk you for answering.
I noticed that SMA TEE adapter/connector was in my kit.
I will challenge the VCC glitch of STM32 too.

Regards,
sato


#74

Hi Alex,

Does it possible to setup pulse witdh more then 50%? Or maybe possible to setup width of impulse in us/ns?

Regards,
Nik.


#75

Hi Nik,

I believe the only way to get above a 50% pulse width is to go the full 100% with enable_only. Time based glitch settings do exist in the form of glitch_fine and offset_fine, though their max range is rougly +/-5ns. I’m not sure how possible/easy it would be to increase this range.

Alex