How to Match More Than Two Instruction Addresses in TraceWhisperer (Husky Platform)

Embedded Security Side Channel Power Analysis
1

Hi everyone,

I’m currently using TraceWhisperer on the Husky platform to locate specific instructions in the code I’m analyzing. My project requires me to track more than two instructions, but from the example in the official course notebook (TraceWhisperer.ipynb), it seems that the trace.set_isync_matches function only allows setting two addresses (addr0 and addr1).

My questions are:

  1. Is there any way to configure more than two instruction addresses for ISYNC matching?
  2. If not, are there any newer tools, methods, or platforms that support this functionality?

Here is part of my current TraceWhisperer configuration:

trace.enabled = True
trace.capture.raw = False
trace.clock.fe_clock_src = 'target_clock'
assert trace.clock.fe_clock_alive, "Hmm, the clock you chose doesn't seem to be active."
trace.trace_mode = 'SWO'
trace.jtag_to_swd()  # switch target into SWD mode

acpr = 0
trigger_freq_mul = 8
trace.clock.swo_clock_freq = scope.clock.clkgen_freq * trigger_freq_mul
trace.target_registers.TPI_ACPR = acpr
trace.swo_div = trigger_freq_mul * (acpr + 1)

assert trace.clock.swo_clock_locked, "Trigger/UART clock not locked"
assert scope.userio.status & 0x4, "SWO line not high"

trace.set_pattern_match(0, [3, 8, 32])
trace.capture.rules_enabled = [0]
trace.set_isync_matches(addr0=0x8008c36, addr1=0x8008c78, match="both")
trace.capture.trigger_source = 'firmware trigger'
trace.capture.mode = 'while_trig'

Any help or suggestions would be greatly appreciated!

Thanks in advance!

2

Unfortunately no, that’s a hardware limitation of ARM’s debug infrastructure.

The limit is 2 because there are 2 ARM registers to specify addresses to match on: DWT_COMP0 and DWT_COMP1.

What you can perhaps do is modify your firmware to update DWT_COMPx dynamically as your program is running.

3

Thank you very much for your prompt reply, which helped me confirm this fact. Perhaps I should adjust my attack strategy in time.