KeyError: 'flash'

Hi everyone.
I got some troubles when I use CW305 and CWlite.

  1. There is KeyError: 'flash' during running jupyter/archive/PA_Intro_1-Firmware_Build_Setup.
    Also had the same problem during running jupyter/archive/Fault_1-Introduction_to_Clock_Glitch_Attacks.

Below is part of the code:


cw.program_target(scope, prog, fw_path)

KeyError                                  Traceback (most recent call last)
<ipython-input-16-b876eeece5c0> in <module>
----> 1 cw.program_target(scope, prog, fw_path)

c:\users\user\chipwh~1\cw\home\portable\chipwhisperer\software\chipwhisperer\ in program_target(scope, prog_type, fw_path, **kwargs)
     64         prog.find()
     65         prog.erase()
---> 66         prog.program(fw_path, memtype="flash", verify=True)
     67         prog.close()
     68     except:

c:\users\user\chipwh~1\cw\home\portable\chipwhisperer\software\chipwhisperer\capture\api\ in func_wrapper(self, *args, **kwargs)
     69    = 'high_z'
     70         try:
---> 71             val = func(self, *args, **kwargs)
     72         finally:
     73             target_logger.debug('Restoring pdic, pdid, and nrst pin configuration')

c:\users\user\chipwh~1\cw\home\portable\chipwhisperer\software\chipwhisperer\capture\api\ in program(self, filename, memtype, verify)
    255         Programmer.lastFlashedFile = filename
    256         xmega = self.xmegaprog()
--> 257         xmega.program(filename, memtype, verify)
    259     @save_and_restore_pins

c:\users\user\chipwh~1\cw\home\portable\chipwhisperer\software\chipwhisperer\hardware\naeusb\ in program(self, filename, memtype, verify, logfunc, waitfunc)
    257         fdata, fsize = FileReader(filename)
--> 259         startaddr = self._chip.memtypes[memtype]["offset"]
    260         maxsize = self._chip.memtypes[memtype]["size"]

KeyError: 'flash'

The error may not be due to the wiring.
Just in case, my hardware device is as shown below.

  1. Someone had asked related questions (Key_error “flash”), but it didn’t work (skipping the program_target()).
ktp = cw.ktp.Basic() # object to generate fixed/random key and text (default fixed key, random text)
key, text =  # get our fixed key and random text

target.simpleserial_write('k', key)

target.simpleserial_write('p', text)
ret = scope.capture()
trace = scope.get_last_trace()
output = target.simpleserial_read('r', 16)

from binascii import hexlify
ERROR:ChipWhisperer Target:Ack error:  
WARNING:ChipWhisperer Scope:Timeout in OpenADC capture(), no trigger seen! Trigger forced, data is invalid. Status: 0b
WARNING:ChipWhisperer Scope:Timeout in OpenADC capture(), no trigger seen! Trigger forced, data is invalid. Status: 0a
WARNING:ChipWhisperer Target:Unexpected start to command: 
TypeError                                 Traceback (most recent call last)
<ipython-input-33-e3e540d26394> in <module>
     14 from binascii import hexlify
---> 15 print(hexlify(output))
     16 print(hexlify(text))

TypeError: a bytes-like object is required, not 'NoneType'

All the best,

Here are some of my thoughts about my question.

Trying to use skipping the program_target() to solve KeyError ‘flash’ will result in my question 2.
However, this way can deal with KeyError ‘flash’ during running another tutorials in jupyter/courses/fault101 instead of in jupyter/archive.
The hardware I used may be different from the hardware in the tutorial, but I confused about there are PLATFORM = ‘CWLITEXMEGA’ in those tutorials.

Update again!
Someone had already answered related questions before.

I am sorry for my stupid question. :disappointed_relieved:

Well the main problem here is that your target is not a micro-controller anymore. So this has the following consequences:

  1. You cannot just build the binary file(.hex) and use the corresponding programmer to load it to the board like one would normally do with a XMEGA or ARM target. The CW305 has an FPGA and “waits” for a so called bitfile/bitstream Bitfiles(.bit) to be loaded to it. You can think of it as a binary file in typical microprocessors. So you no longer have nice function written in C (/chipwhisperer/hardware/victims/firmware) implementing a simple bootloader for instance. All the work has to been done by you. Obviously the AES hardware implementation and it’s bitfile is already provided by the chipwhisperer(/chipwhisperer/hardware/victims/cw305_artixtarget/fpga/vivado_examples/aes128_verilog/aes128_verilog.runs/impl_35/100t) in the context of the whole open-source project. Keep in mind that the process of uploading the bitstream to the FPGA is done using the SAM3U USB protocol.
  2. You cannot use the SimpleSerial commands to communicate with your CW305 board instead you have to use the target.CW305 class and it’s methods for all communication “transactions” (cw.capture_trace() method also works here for the whole AES encryption process in a similar fashion as with microcontroller targets)

I think the CW305 Whitepaper Section 5+ the rtfm will help you a lot, while also being the place to start working with your CW305.
p.s. The upcoming days I am going to try a DFA attack like the one demonstrated in fault201 tutorial but this time in my CW305, which basically attacks the AES implementation as it is already implemented in verilog by the ChipWhisperer’s github repo. I let you know if I managed to carry it out successfully, and if you want so I may share my python notebook in this thread.

Thanks for your reply! It would be great if you would share your python notebook.

Hello there, a followed a previous notebook found in a thread, uploaded by @Alex_Dewar . So I was able to complete a DFA attack via glock glitching (injected a 8th round fault MixColumns in particular and the used phoenixAES to recover round 10 key).
Enjoy… (5.1 KB)

1 Like