Hi everyone,
I was wondering how I could detect a RESET signal coming from the target I would like to attack.
Indeed, I would like to use the 5th pin (PROG-RESET) of the 20-pin CW-Lite connector because it’s an I/O pin. I search in the documentation but I found nothing about a function to read the state of the “PROG-RESET” pin or all the states possible for this pin (from my tests, I found at least two states : “low” when “scope.io.nrst = False” and “high_z” when "scope.io.nrst = “high_z”). Is there a third state or something I could use to know when the target send a rst signal ? (as we use the TIO4 pin to know when a trigger is detected or not).
Thanks by advance !
You can trigger a trace capture or a glitch from nrst (AKA PROG-RESET) by setting scope.trigger.triggers = 'nrst'. Lab 3_1B in the sca201 course does this, for example.
nrst can be driven by ChipWhisperer or by the target. In the case of our STM32 targets, ‘high_z’ means it will be pulled high by the STM32.
Jean-Pierre
Hi jpthibault,
Thanks to your return !
In my case, I am not looking for triggering the glitch from NRST. I am looking for detecting if the target is in Reset mode (and so has generated a reset) after the glitch has been injected. Finally, how to check NRST has been pulled high from Jupyter Notebook Python ?
You can poll scope.io.nrst to see if it’s low (it’s an active low reset). If it shows “high_z”, then you know that it’s high (at least in the case of STM32 - other targets may differ).
EDIT: as discussed in next post, you can’t poll scope.io.nrst to see whether it’s been pulled low by some other source.
However if the target pulls nrst low for a short time you may not see it. It may be best to detect the reset event indirectly, i.e. if the target outputs some known string after it’s reset.
Jean-Pierre
I’m not sure I well understand what you said.
Before pressing the RST button available on my target, what value should I set “scope.io.nrst” to? (“low” or “high_z”)
Thanks to your return !
I think there’s a few things that are sources of confusion here.
First, I made a mistake in my previous post: you cannot poll scope.io.nrst to learn whether the target has pulled reset low; scope.io.nrst only reflects what the ChipWhisperer capture board (i.e. CW-lite) has set nrst to, and does not reflect how the target may be driving nrst. The documentation around this is a bit misleading and I will fix that too.
Second, I’m getting the feeling that you don’t understand the meaning of high impedance (“high_z”) in digital electronics, and how it’s used. Briefly, a common use of high_z is when there are two (or more) possible drivers for a signal, which is the case here. The STM32 target has a pull-up resistor on its nrst input, which means that if the STM32 nrst input is left floating (unconnected) or if ChipWhisperer sets scope.io.nrst to high_z, then the STM32 target will read nrst as a logic 1 (remember, nrst is active low: it has to be 0 to reset the target). If you then set scope.io.nrst = 0, then the target will see nrst = 0 and get reset. The pushbutton reset (on your CW308 UFO board) can also be used to drive nrst to 0. Now if you had set scope.io.nrst = 1, then pushing the reset button would cause a short circuit, because ChipWhisperer is driving a logic 1 on nrst and the button press is connecting this directly to ground. By using scope.io.nrst = 'high_z' instead, ChipWhisperer is not driving a logic 1 on nrst and so pushing the reset button is fine.
(if this is still confusing, spend some time reading about high impedance on electronics.stackexchange.com… surely someone has written about this more clearly than I have, although I couldn’t find a perfect example with a quick search)
Finally, like I said earlier, the proper way to learn if your target has gotten reset is to detect it indirectly, e.g. by looking for a boot-up message on its UART output.
And keep scope.io.nrst to high_z, unless you want to reset the target from ChipWhisperer (to do that, set it to 0 then back to high_z).
Hope this helps,
Jean-Pierre