Reproducing Fault 1_1 example on ATMEGA328 chip fails

Embedded Security ChipWhisperer Software
1

I have read/performed some chipwhisperer jupyter courses and decided to reproduce the
“Fault 1_1 - Introduction to Clock Glitching”-course on an Atmega328 chip on a breadboard.

I uploaded the code for the Atmega and the jupyterfile to my google drive:
atmega firmware + jupyter notebook file

I worked a bit different than the course:

  • I used the CW-lite’s clock and divided it to a 16Mhz clock, so I could still upload firmware with my FTDI programmer at default baudrate

  • Instead of working with “Simpleserial” I chose to detect a glitch on the atmega itself and toggle a pin accordingly. The calculation is performed once during setup so I reboot the device in each glitch loop.

So when I run my setup, things do not work out as expected.
Since I reboot each cycle and wait for a trigger with a timeout of 4s, I expect on my serial output of my ftdiprogrammer “Started!” should be printed for each loop. In reality I see it only printed once.

In an attempt to debug this I started to print the trig_count in each loop:

print("trig_count: " + str(scope.adc.trig_count))

The count varies a lot for each loop but was in the range of 239838 - 971713 so the time between trigger high and low appears to be 15ms - 60ms.

When I then reprogram the atmega with a 1s delay between its trigger the time measured from the trig_count was the same as before (would expect it to be at least one second).

Can anyone point out where I am in the wrong?

2

Hard to say since I don’t have your setup, but I have a few things to note that might help you move forward:

  1. I’m not super familiar with what goes on under-the-hood of Arduino sketches, but if interrupts are involved, that would be the reason for the trig_count variability.
  2. scope.adc.trig_count measures how many clock cycles the trigger is seen high for, after arming the scope; delaying the trigger assertion by 1 second won’t change anything (unless I’ve misunderstood what you meant by “1s delay”).
  3. You can compile our example SimpleSerial-based firmware, as shown in our tutorials, by setting PLATFORM to CW304.
  4. We have a “notduino” target; it might be helpful to compare your own target with the notduino schematic.
  5. Detecting a glitch on the target itself isn’t ideal!