Mods for voltage glitching an application kit

[bruno]

Hello!

I’m trying to glitch the uC from this application board with the following schematics.

I’ve removed CB106 (1 uF) from the VDD 1.3V rail and soldered a SMA connector to the pads with short wires, then I connected the SMA cable to Husky Crowbar port.

I replaced C105 22uF by a 3.3uF capacitor

But the glitch is not good, I can only make it crash, (~scope.glitch.repeat = 5)

And I get nothing with values smaller than this.

Should I disconnect this VDD circuit and connect 1.2V from CW313 to the uC 1.3V rail instead ?

And/or maybe change the shunt 0.05R value to something bigger like ~5 ohms ? (already tried 10ohm and it didn’t worked)

Any ideas how to improve this?

PLATFORM = ‘CWHUSKY’
%run “jupyter/Setup_Scripts/Setup_Generic.ipynb”

scope.vglitch_setup(‘both’)
scope.io.glitch_trig_mcx = “glitch”
scope.clock.clkgen_freq = 20e6 # 20 MHz

scope.trigger.triggers = “tio4”
scope.trigger.module = “edge_counter”
scope.trigger.edges = 694

gc = cw.GlitchController(groups=["success", "reset", "normal"], parameters=["width", "offset", "ext_offset", "tries"])
gc.display_stats()

gc.set_global_step([10])

gc.set_range("width", 2056, 2056)
gc.set_range("offset", 2748, 2748) 
gc.set_range("tries", 1, 1)
gc.set_range("ext_offset", 0, 500)

gc.set_step("tries", 1)
gc.set_step("ext_offset", 1)

scope.glitch.output = "glitch_only"
scope.glitch.repeat = 1

assert scope.glitch.mmcm_locked

for glitch_settings in gc.glitch_values():
    scope.glitch.width = glitch_settings[0]
    scope.glitch.offset = glitch_settings[1]
    scope.glitch.ext_offset = glitch_settings[2]
    scope.arm()
    scope.capture() # wait for trigger

For reference, here’s the glitch waveform on a spot I get 92% accuracy on Fault 2_2 - Voltage Glitching to Bypass Password with the CW313+SAM4S target board

scope.clock.clkgen_freq = 7363636.363636363
gc.set_range(“width”, 2056, 2056)
gc.set_range(“offset”, 2748, 2748)
🐙 184 glitches |   0 resets |  16 normal |  92.00% |  2056 2748 140

And here’s the exact same glitch on my custom target

I can crash it only with >250nS pulses

Thanks

[bruno]

I lifted L103 and tried using the 1.2V supply from CW313 to feed the target 1.3V rail at R166 L103/C105 side, didn’t work. Besides the MCU not working / not communicating (stayed in EVR reset state) I tried the glitch just to see the voltage drop, but the brief ~60nS pulse (and even repeat=2) also cannot drop VDD on this rail.

I tried “both” and “hp”.

For the SAM4S target board “hp” is enough, but for my custom target not even “both” can do it.

BTW

C105 = 1uF will not stabilize the 1.3V original rail, that’s why I chose 3.3uF.

1.3V rail with C105 = 1uF

[bruno]

Thinking that maybe the long SMA cable could be the issue, today I tried the glitch insemination method used by Colin on this Voltage (VCC) Glitching Raspberry Pi 3 model B+ with ChipWhisperer-Lite video.

with SMA connector

probing directly

But even that cannot drop the voltage enough for a glitch to occur. Not even repeat=2 can make it

repeat=3 and the board crashes

I’m currently using a 8ohm shunt (10ohm the board won’t start)

And now I removed C120 (10 uF) from V_UC (+5V) rail (I don’t think that matters, but anyway)

Also tried increasing the glitch resolution

scope.clock.adc_mul = 1
scope.clock.clkgen_freq = 200e6
scope.glitch.output = “enable_only”
scope.glitch.repeat = 19

Don’t know what else to try here.

Out of curiosity here’s a measurement with a distant ground on the oscilloscope probe (not real measurement on the uC VDD/VSS pins)