I am trying to recreate a supply glitch attack on an automotive MCU, which I have as a spare. The actual attack has been described in the There Will Be Glitches paper, and as I happen to have a spare ECU, I decided to give it a go.
The target uses a Renesas V850E2 microcontroller with a fairly complicated power domain scheme, as compared to the targets I’ve been playing with recently. In particular, there are two internal voltage regulators, REG1 and REG2, which provide power to the CPU. I am assuming I should aim at disturbing the voltage they produce. Here is a schematic:
My plan is to glitch the MCU at pin REG1C first and see what happens. Then, if no success, I’ll do the same with REG2C pin. The voltage on those two pins is 1.5 V, and I think they’re connected internally - at least I could not trace them being connected via tracks on the PCB, and the multimeter indicates they’re shorted.
There’s an interesting talk and slides at chip.fail, which describes using an external voltage supply for a sort-of identical setup. Basically, they desolder the capacitor connected to the internal regulator, and supply external voltage to the pin. I don’t believe that is going to be useful in my case, so I’d like to hear your comments.
Edit: I am also having trouble identifying the low-voltage regulator and inserting a resistor between its output and the MCU power pins. In one of Colin O’Flynn’s videos, I noticed he’s not using a resistor when glitching a RPi 3. Can this be done?