Voltage glitch to so password bypass

1

Hi all I am trying to do password pass by voltage glitch attack, topic 2 lab 1, i am using the jupyter note book and the following parameters:

gc.set_range("width", 46, 49.8)
gc.set_range("offset", -46, -49.8)
gc.set_range("ext_offset", 11, 31)
step = 1
scope.glitch.repeat = 100
gc.set_global_step(step)

the target is XMEGA chip,
but it just doesn’t work, there is no success on the controller display_status, and I don’t understand why?

here is the full code:

from importlib import reload
import chipwhisperer.common.results.glitch as glitch
from tqdm.notebook import tqdm
import re
import struct

gc.set_range("width", 46, 49.8)
gc.set_range("offset", -46, -49.8)
gc.set_range("ext_offset", 11, 31)
step = 1
scope.glitch.repeat = 100
gc.set_global_step(step)



reboot_flush()

for glitch_settings in gc.glitch_values():
    scope.glitch.offset = glitch_settings[1]
    scope.glitch.width = glitch_settings[0]
    scope.glitch.ext_offset = glitch_settings[2]
    if scope.adc.state:
        # can detect crash here (fast) before timing out (slow)
        print("Trigger still high!")
        gc.add("reset", (scope.glitch.width, scope.glitch.offset, scope.glitch.ext_offset))


        #Device is slow to boot?
        reboot_flush()

    scope.arm()
    target.simpleserial_write('p', bytearray([0]*5))

    ret = scope.capture()

    val = target.simpleserial_read_witherrors('r', 1, glitch_timeout=10)#For loop check
    if ret:
        print('Timeout - no trigger')
        gc.add("reset", (scope.glitch.width, scope.glitch.offset, scope.glitch.ext_offset))

        #Device is slow to boot?
        reboot_flush()

    else:
        if val['valid'] is False:
            gc.add("reset", (scope.glitch.width, scope.glitch.offset, scope.glitch.ext_offset))
 
        else:
            if val['rv'] == 1: #for loop check
                gc.add("success", (scope.glitch.width, scope.glitch.offset, scope.glitch.ext_offset))
                print(val['payload'])
                print(scope.glitch.width, scope.glitch.offset, scope.glitch.ext_offset)
                print("🐙", end="")
            else:
                gc.add("normal", (scope.glitch.width, scope.glitch.offset, scope.glitch.ext_offset))

does any one has an idea?

2

Hi,

Those look like pretty extreme settings. Do you see resets at all? If so, I’d recommend toning down the width and repeat.

Alex

3

what values will you recommend, for the width,offset,ext_offset? I do see rests but not a lot though.

4

I’d recommend starting with with the settings you see in courses/fault101/SOLN_Fault 2_2 - Voltage Glitching to Bypass Password.ipynb and working from there.

Alex

5

I did and still it didn’t work

6

Just to make sure, have you run through the previous lab (courses/fault101/SOLN_Fault 2_1 - Introduction to Voltage Glitching.ipynb)? Did you see any success there?

Alex

7

I did exactly that and still didn’t work