Trying to glitch an 8-bit PIC

Embedded Security Glitching
1

I have built a circuit for glitching PIC12F1822, an 8-bit MCU running from internal 8 MHz oscillator. The code that’s running on the PIC is similar to the XMEGA code from the Fault 101 tutorials:

loop:
    if serial command received:
        set trigger high
        increment variable
        set trigger low
        send variable over uart
goto loop

I’ve been trying to find the correct voltage glitch parameters for over a day now. The procedure I follow is:

  1. Find the glitch parameters which will result in about 20% target reset (this step is working)
  2. Select a point in time after the trigger
  3. Inject a number of glitches around that point and watch for unusual output from the UART (the only results are a normal output or a reset)

So far nothing I do works, and I’ve done quite a bit of experiments. I hope that means I’m missing something and not that the PIC micro is immune to voltage glitching. The glitch settings are:

glitch = 
    clk_src     = clkgen
    width       = 46.09375
    width_fine  = 0
    offset      = 1.171875
    offset_fine = 0
    trigger_src = ext_single
    arm_timing  = after_scope
    ext_offset  = 14
    repeat      = 19
    output      = glitch_only

The CW clock is set to 64 MHz.

My strategy will benefit from some comments.
Thanks

2

Hi,

Some stuff you can try beyond just glitch parameters:

  1. Try messing around with the properties of the glitch circuit. Two simple ways are to change the value of the shunt resistor and to change the length of the cable connecting the ChipWhisperer glitch output to the target
  2. Try increasing the clock of the ChipWhisperer and swapping scope.glitch.output to 'enable_only'.

Glitching is very fickle and there are a lot of variables, so unfortunately it can be quite difficult to get your first glitch on a target.

Alex

3

After changing the shunt resistor from R10 to R47, I was able to successfully glitch the target. The scope.glitch.output was kept to ‘glitch_only’, as I found that switching to enable_only gives less flexibility in this case.

Thanks for your help.