Infineon TC332LP-32F Fault injection feasibility on Infineon AURIX TC332LP (ASIL-D) — UCB_DBG recovery

1

Hello NewAE team,
I am a hardware security researcher working on an automotive SRS module recovery project. The
target is an Infineon AURIX TC332LP-32F (SAK-TC332LP-32F200F-AA, TQFP-80, TC3xx family,
ASIL-D) where the UCB_DBG password (256-bit, PW0-PW7 at 0xAF402500) has been lost. This is a
legitimate recovery case for owned hardware.
We have already attempted:

  • 500K VDD glitch attempts with RP2040 + BSS138 (insufficient current, ~100mV drop)
  • 1.5M clock glitch attempts on XTAL1 pin with RP2040 @250MHz (jitter ±10ns)
  • EMFI with a commercial tool (likely shielded by module housing)
    Boot ROM timing mapped empirically: active zones at T+515us (pre-UCB decision) and T+603us
    (UCB_DBG password check loop, 3.1us pattern with 0.30us sub-pattern per 32-bit word).
    Questions:
  1. Is the CW-Husky voltage glitch module capable of inducing sufficient VDD_CORE perturbation
    on an ASIL-D TriCore with lockstep enabled?
  2. Does anyone have experience with TC3xx fault injection? We know the TC233LP has an
    official CW308T target — are TC3xx defenses substantially different?
  3. Would the analog waveform trigger be useful to track the 603us zone even with thermal
    drift between resets?
    Thank you for any guidance.
2

Unfortunately I don’t have any experience with this target, so I really can’t answer any of your questions.

1 Like
3

@Magnacin VDD Crowbar glitch performance with cw-husky is the same as with pico-glitcher (RDS on/off time depends mainly on transistor limitations). If the anti-glitch sensor is very precise, you won’t be able to perform a proper glitch with any of these glitchers.

The more expensive the processor protecting more sensitive data, the more precise the anti-glitch sensors it has.

How do you generate clock glitches on the RP2040? Through the RP2040 mini-fpga PIO directly? Or through external hardware that allows clock glitches to be placed at specific clock cycle percentages?

4

@Magnacin

I bricked 2 TriCores already by VCC glitching them. It erased the UCB sector. I don’t think it’s a good idea to glitch it.

You won’t get any results with RP2040 + BSS138, you must use the DMG2302 which is stronger. And lower the decoupling capacitors on the PCB if not possible removing them.

But again, I don’t recommend it. The glitch will brick the microcontroller.

5

Thanks for your advise, I have paused that project as I found out , some SRS modules with that MCU are cheap at the dealership (arond $250 USD), so I guess its not worth all of the trouble.