Hi there!
I’m working for quite a while now on bypassing RDP1 on stm32f405 with CW Husky, but it seems I’m doing something wrong, so trying to share the setup and ask if someone have any advices on it to get it work.
My code:
(cant attach here as new user)
My hardware setup:
I’m using waveshare adapter to connect
not attaching jumpers for pin49 and 73 gives me no decoupling capacitors config I hope.
From the CW side I’m connecting everything to CW313 board, then PWR(1.8) is going to the shunt resistor (with shunthc connected), then from the other side of the resistor to the VCAP1,VCAP2 and shuntl. Tried different resistor values from 10Ohm and higher. The resistor to cw313 and to vcap part is placed on maket board.
trigger:
ADC trace looks like this (presample=100, 24Mhz, no glitches)
so there are two constant spikes, first is just at the start(offset 100) of processing the command, and second is at 100± samples after first response is sent (offset 1300), all interesting code should be between them. Other spikes you see vary and are not stable.
I’m using two sequential triggers here, the UART trigger on 0x11 command (read) and then ADC level trigger to start at a spike.
I’ve tried first with just UART one, but I noticed that the time from sending the command to actual processing could vary a bit, so added second trigger to mitigate this factor.
target info and code I’m trying to bypass:
the target should run on 24MHz according to the specs, however it has not output clock pin in this mode.
The target code looks like this:
read_uart_command()
command = make_command_safe()
if command == command1
send_ack()
send_smth_1()
if command == command2
send_ack()
send_smth_1()
if command == command3
send_ack()
send_smth_1()
if command == command4
if call func() == false
send_nack()
// do stuff
func():
if get_rdp_from_register != rdp0_constant:
return false
send_ack()
//do stuff
My analysis:
So there are 2 checks I need to bypass here, but no signals I can check to see where am I, so I’ve tried first one glitch to search where I could fall into commands1-3, and then tried to iterate over different offsets on 2nd glitch in this zone and a little after it.
I can successfully fall into commands1-3 quite a lot with different settings I tried, but for some reason not even once in command4, so something in my setup should be wrong.
Questions:
- Is there anything obviously wrong with my hardware / code / trigger setup for experienced users?
- Should I use the same clkgen_freq or higher than the target, since I can’t really synchronize them to the one for better results?
- Should I use hp or lp or both for glitching here? It seems I can get commands1-3 with both.
- For me it seems that my 2 glitches should be very close one to each other, because there is not so much asm commands between checks I want to bypass. Is it right? How close it could be in real life(1cycle, 10cycles, 100cycles?)
- Any other advices that you could think of?