Misunderstanding about VFI triggering

Embedded Security Glitching
1

Hi everyone,

I encounter a misunderstanding on the moment the glitch is performed.

What I understood, is that “trigger_high()” function set a GPIO (A12) at high level then “trigger_low()” function reset the same GPIO. I understand that the state change allows to arm one of the MOSFETs to pull the target supply voltage to ground. So, my first question is : What is the purpose of the second MOSFET ? and my second question is : Does “trigger_low()” function allow to arm the second MOSFET ?

Then, I could note that from the JupyterNotebook Python script, after setting the required configuration (for clk_src, output, trigger_src) we execute a first time the module :

scope.io.glitch_hp = True
scope.io.glitch_lp = True

before deactivating them and activating them again just after writing a letter to execute a function on the target like this :

scope.io.glitch_hp = False
scope.io.glitch_hp = True
scope.io.glitch_lp = False
scope.io.glitch_lp = True

What is the purpose of making something like that ?

My last question is: What action is generated by each transistor? (“One pulls the voltage to ground but what does the other one do?”)

Théophile

2

I forgot to ask about something else…

Is it possible for supplying the target thanks to an external way and doing glitch with the ChipWhisperer-Lite and SMA cable connected to the target ?

Théophile

3

Hi Théophile,

  1. trigger_high() and trigger_low() are executed on the target device to pulse the IO4 line, which is what triggers the CW glitch module to issue a glitch.
  2. The two MOSFETs can be used either individually or in parallel to pull the target Vcc to ground. Both pull Vcc to ground. Maybe the schematic can help understand: https://github.com/newaetech/chipwhisperer/blob/develop/hardware/capture/chipwhisperer-lite-32bit/cw-lite-arm-main.pdf
  3. The purpose of toggling scope.io.glitch* to False and back to True is explained in the notebook, “should reset glitch module to make sure nothing stuck high”
  4. If your target is not powered by ChipWhisperer, you’ll have to find some way to use the ChipWhisperer glitch output to control your target’s power source.

The best way to understand all this better is to use an oscilloscope to to look at IO4 and the glitch output as you play with the different glitch parameters. For example you can see the shape of the glitch when using lp only, hp only, and lp+hp.

Jean-Pierre