LPC1343 weird bounces on my glitch

Embedded Security Glitching
1

Hello,

I am trying to understand why I am not able to glitch the LPC1343 with my chipwhisperer.

I was able to pass my glitch with the arty-glitcher but not with the chipwhipserer.

I don’t use a target board and I am directly connected on the LPC1343 chip. I made my own shunt resistor ( and filter capacitors ) : I copied the schematics of the LPC1343 target board.

My implementation:

I guess my glitch is not working because of the bounces of the voltage as you can see on the following picture:

So it seems that the signal filtering is not working as expected and the glitch is really dirty.

Do you know how can I remove those “bounces” on my glitch ? Because even with the duplicated filter from the target board, my glitch does not work.

Here are the glitch parameters of the previous picture:

clk_src = clkgen
width = 35.15625
width_fine = 0
offset = 10.15625
offset_fine = 0
trigger_src = ext_single
arm_timing = after_scope
ext_offset = 10820
repeat = 10
output = enable_only

Thank you for your help.

2

Hi,

Seeing a bounce/ringing on the Vcc line when you do a glitch is expected and may actually help cause a successful glitch. Generally you don’t want any filtering on the low side of the shunt resistor, which is why we remove the decoupling capacitors in our LPC1114 glitch demo.

Is the target you’re attacking on a development board?

Alex

3

Hello Alex,

Yes this is a development board:

I am trying to reproduce the Fault_6-LPC1114 tutorial for LPC1343 devices.

Thanks

4

Hi,

I’d recommend using this lab instead: https://github.com/newaetech/chipwhisperer-jupyter/blob/master/courses/faultapp1/LPC1114_Fuse_Bypass.ipynb and closely following the hardware setup steps there. If you continue with your setup, you should remove any capacitors on the low side of the shunt.

Again, I wouldn’t worry about ringing on the Vcc line when glitching - this is normal and may be desirable.

Alex

5

Thank you for your answer Alex,

I followed this tutorial, removed : C1 and C4 and cut the traces on 3.3V_CORE and 3.3V_IO_E. I also added a 10 ohm resistor.

So my set-up is the same than the tutorial. I was not able to glitch the board with the tutorial. I also tried to change freq_multiplier to 2 ( ps: I also multiplied the ext_offset by 2 ). I tried all the different configuration of width, repeat and ext_offset ( between ext_offset 5200 ns and 5500 )

I was able to glitch the board with a arty-glitcher ( FPGA ) so I know exactly which ext_offset to use ( I verified with my oscilloscope ).

So because I was not able to glitch the board, I tried to use the same filter capacitors used in the LPC1343 target board to improve my glitch. ( https://github.com/newaetech/chipwhisperer-target-cw308t/tree/master/CW308T_LPC1343F ). Even with this filtering, I am not able to glitch the CRP.

Thank you for your help and if you have any idea, let me know.

6

Up,

I am not able to glitch the LPC1343 following the LPC1114_Fuse_Bypass tutorial. I know exactly where ( the offset ) to glitch because I was able to glitch the chip using the arty-glitcher.

Do you know if someone was able to glitch the LPC1343 using the chipwhisperer ?

Thank you for your help.

7

Hello,

I finally managed to glitch the LPC1343 with the CW:

The parameters for the record:

scope.io.glitch_lp = True
scope.glitch.clk_src = “clkgen”
scope.glitch.trigger_src = “ext_single”
scope.glitch.output = “enable_only”

freq_multiplier = 1

offset_range = Range(5162freq_multiplier, 5170freq_multiplier, 1)
repeat_range = Range(110, 200, 1)

scope.glitch.width = 40
scope.glitch.repeat = repeat_range.min

Glitch offset 5164, width 118…[SUCCESS]

Glitch OK! Beginning dump…
00 08 00 10 D1 1D 00 00 CB 1F 00 00 CB 1F 00 00

Thank you

8

As a side note, to have a reliable glitch, I added this filter to the power voltage. ( PS : I replaced the R1 12-ohm with a 30-ohm resistor )

With this configuration, my glitch is really clean, and I can reliably reproduce my glitch attack.