Using CW to attack

SergentYork · May 1, 2022, 8:09am

Hi, i am trying top understand how to use the CW to attack other products outside of the course did any one did it and if so how?

jpthibault · May 1, 2022, 1:41pm

This is not “outside of the course”, but just in case you weren’t aware we have this here which shows attacking something that’s not a ChipWhisperer target:

github.com

newaetech/chipwhisperer-jupyter/blob/master/courses/faultapp1/LPC1114_Fuse_Bypass.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "## Background on Code Read Protection\n",
    "\n",
    "To help protect proprietary code from being dumped via a bootloader or a debugging interface, many microcontrollers include some mechanism that locks down the flash and prevents reads. In the case of NXP's LPC1114, this is done by reading a value from flash during the boot sequence, with different values corresponding to different levels of protection. As is shown in the figure below, there are 4 levels of read protection, with the rest of the values representing an unlocked device. This makes this a great target for glitching, as corrupting one bit from this read will unlock the device and give us full access. Since higher CRP levels are harder (or in the case of CRP level 3, \"impossible\") to remove, we'll be using the device in CRP level 1.\n",
    "\n",
    "| Name    | Value in FLASH  | JTAG/SWD | Serial Bootloader (ISP) | Notes                                                                                |\n",
    "|---------|-----------------|----------|-------------------------|--------------------------------------------------------------------------------------|\n",
    "| NO_ISP  | 0x4E697370      | enabled  | disabled                |                                                                                      |\n",
    "| CRP1    | 0x12345678      | disabled | subset                  | Read memory disabled. Sector erase and mass erase possible (which also removes CRP). |\n",
    "| CRP2    | 0x87654321      | disabled | subset                  | Read memory disabled. Mass erase only (which also removes CRP).                      |\n",
    "| CRP3    | 0x43218765      | disabled | disabled                | Claimed impossible to recover from since no reprogramming interface.                 |\n",
    "| INVALID | Any other Value | enabled  | enabled                 |                                                                                      |\n",
    "\n",
    "This was first published by Chris Gerlinsky at RECON Brussels. You can [see his slides here](https://recon.cx/2017/brussels/resources/slides/RECON-BRX-2017-Breaking_CRP_on_NXP_LPC_Microcontrollers_slides.pdf) or watch his [presentation here](https://www.youtube.com/watch?v=98eqp4WmHoQ). It was [re-created by Dmitry Nedospasov on his blog](https://toothless.co/blog/bootloader-bypass-part1/), which has additional details and examples of how you can achieve this attack.\n",
    "\n",

This file has been truncated. show original