Issue with Voltage Glitching on CW308-STM32F3: Unable to induce Resets or Successes

1

Hi ChipWhisperer Team,

I am currently trying to perform a Voltage Glitching attack on the CW308 UFO Board with the STM32F3 target, using a ChipWhisperer-Lite.

Despite scanning a very wide range of parameters, I am unable to get any results. The target runs perfectly stable (100% normal execution), and I cannot induce even a single RESET, let alone a successful glitch.

My Setup & Configuration:

  • Hardware: CW-Lite + CW308 UFO Board + STM32F3 Target.

  • Glitch Setup: I am using the Crowbar logic with both MOSFETs enabled:
    scope.vglitch_setup(‘both’)

  • Clock: 24 MHz (clkgen_x1).

  • Trigger: ext_single.

What I have tried:
I have swept the parameters aggressively to try and force a reset:

  • Width: Swept from 0 to 48% (trying to pull voltage low for a long time).

  • Repeat (tries): Swept from 1 up to 200 cycles.

  • Offset: Swept the full period (-45 to 45).

Despite these aggressive settings (especially high width and repeat), the target never resets and the power seems too stable.

My Questions:

  1. Is Voltage Glitching feasible on the stock CW308-STM32F3 target without hardware modifications?

  2. Do I need to physically remove the decoupling capacitors (e.g., C13/C14) on the target board to make the voltage drop effective?

  3. On the CW308 baseboard, do I need to remove any specific jumpers (like the FILT or J1/J3 headers) to disable onboard filtering?

  4. Could there be any other reason why scope.vglitch_setup(‘both’) fails to pull the voltage down enough to reset the MCU?

Any insights or recommended parameters for this specific target would be greatly appreciated.

Thanks,

2

Have you connected the glitch port?

Can you check (with an oscilloscope) whether you are actually generating glitches?

3

I am sorry, I don’t know what is glitch port, could you please show me where it is? I am using remote connect to play the cw platform, so I can’t attach it with oscilloscopes. Do you have other ways?

4

Here is a picture of a CW-lite. Both SMA ports at the bottom-right corner (labeled “MEASURE” and “GLITCH”) need to be connected to the CW308.

image
image1000×607 93.7 KB

The CW308 has a single SMA port so you’ll need to use a T-connector to connect both CW-lite ports to it. This T-connector is included with our CW308 (see datasheet).

Unless you verify that everything is properly connected, I can’t help you any further.

5

thank you! I think I found the problem, I only connect cw308 with measure without glitch port.

ccbbc92b23501f5bc842363523b4943
ccbbc92b23501f5bc842363523b49431920×2557 512 KB

Sorry but I have another question that if I disconnect the glitch port, it will affect both clock glitch and voltage glitch or only voltage glitch? I am in a bad situation because I got no success in both of them.

6

The glitch port is required for voltage glitching; it is not required for clock glitching.

7

yes sir,I have connected it in the right way, but I still got no reset or success, what else I need to do?Please give me something to check.

8

I’m troubleshooting why I’m getting zero resets.
For the CW308 UFO, does J3 need to be set to the Shunt/Glitch path (not direct 3.3V)?
And for the standard CW-Lite STM32F3 target (the break-away part), do I just need to connect the Glitch SMA cable without touching any jumpers?

536a35555506d1544425770bf872e2c8
536a35555506d1544425770bf872e2c81920×2557 539 KB

I have replace the wire on J17 with T_connector as you said, what else I need to do?If this photo is fuzzy, I will send another one later to you.

9

I will show you part of my code below, Please help me.

# CW-Lite / CW-Pro 参数 (关键修改)

\# Width: 0 到 40 (太大会导致断电重启 Reset)

gc.set_range(“width”, 20, 45.0)

gc.set_global_step(1)

# Offset: -45 到 45 (扫满整个周期)

gc.set_range(“offset”, -25.0, 25.0)

gc.set_step(“offset”, 1)

gc.set_range(“ext_offset”, glitch_spots[0], glitch_spots[-1])

gc.set_step(“ext_offset”, 1)

# 电压毛刺通常需要多打几次，Repeat 设置稍大一点

gc.set_range(“tries”, 10, 30)

gc.set_step(“tries”, 1)

# ==========================================

# 4. 硬件 Glitch 配置 【核心修改】

# ==========================================

print(“[*] Configuring Scope for VOLTAGE Glitch…”)

scope.vglitch_setup(‘both’)

10

Your jumper settings are correct. However the pictures still do not show the glitch port connected.

You asked about clock and voltage glitching, but let’s focus on one thing at a time.

I am guessing that you are trying to run the Fault 2_3 notebook? Let’s start with the Fault 2_1 notebook instead. Make sure you set PLATFORMto ”CW308_STM32F3”.

You can also peak at the solution.

11

Sorry sir, I have connected my glitch port right now.

I have two questions regarding Voltage Glitching (STM32F3):

1. Issue with SOLN Fault 2_2
I successfully completed the Fault 2_1 lab. However, when I run the solution script for Fault 2_2, I am unable to get a success. The script results in a very high number of Resets (more than “Normal” responses), but zero successes.
Do I need to manually adjust the glitch width parameters in the SOLN script? It seems the default parameters might be too aggressive for my setup.

2. Wrong PLATFORM setting
For my own project, I realized I was setting PLATFORM = ‘CWLITEARM’ in my script, but my actual hardware is the CW308 UFO Boardwith the STM32F3 target (CW308_STM32F3).
I am getting some resets, but no successful glitches.
I originally guessed that the platform name shouldn’t matter much since I am still seeing resets. However, could this mismatch be the main reason I am failing to find the glitch sweet spot?

Thanks for your help!

12

Furthermore, I buy a stm32F4 from your web,what platform I need to set?Can I run my current project just change the platform?

13

I invite you to have a closer look at what’s done in the notebooks depending on PLATFORM. You’ll see that different glitch parameter ranges are set depending on the platform (gc.set_range()). If you completed 2_1 successfully, learn from that what glitch parameter settings are successful, to help you get success on the other labs.

CWLITEARM and CW308_STM32F3 are the same target- you’ll see that for the purposes of compiling and programming the firmware, either works. Why do we set different glitch ranges for these? Because when it comes to glitching, even small differences like the length of a cable has an effect. CWLITEARM is a single-board combined capture+target, with no SMA cables at all (like the first picture here).

In general, glitching often doesn’t automatically work. You need to expect some searching and tweaking of parameters.

For the STM32F4, you’ll have to do the work of finding what parameters work for you.

14

Thank you for your patient answer, for STM32F4 things ,I clearly know the parameters will change, but I mean are there anything else I need to do except finding parameters and changing platform?

And for Fault2_2,you mean that the parameters in SOLN Fault2_2 don’t ensure a success , maybe I need for more trainning to find some new parameters to get a success case.

Although I set the platform as CWLITEARM, this isn’t the reason I get no success in my case ,am I right? I am afraid of it will influence other things(e.g hardware settings).After reading your answer, all of my worries faded away.

I always ask for your help, thank you again.I wish you have a good dayyyyy!