Target and Programming

Target and programming

The Target tab of ChipWhisperer Studio is where you put firmware on the target microcontroller and talk to it: program a .hex file, watch the serial port, send SimpleSerial commands by hand and change the target interface settings.

Program firmware at the top, SimpleSerial helper and serial console below.

Before using this tab, connect a scope and a target on the Connect tab (see Connecting Hardware). Programming only needs the scope; the serial console and SimpleSerial helper need the target connection too.

Programming firmware

Choosing the programmer

Programming uses ChipWhisperer's own programmer classes, the same ones the chipwhisperer Python library uses. The programmer must match the microcontroller on your target board:

Programmer	Use it for
STM32F	STM32 targets: CW-Lite ARM (CWLITEARM), the CW308 STM32F0 to F4 boards and the CW-Nano's built-in STM32F0 (CWNANO).
XMEGA	XMEGA targets: CW-Lite XMEGA (CWLITEXMEGA, CW303) and the CW308 XMEGA board.
AVR	ATmega targets such as the CW308 AVR board and the CW304 (ATmega328P).
SAM4S	SAM4S targets: the CW308 and CW312 SAM4S boards and the CWHUSKY platform.
NEORV32	The NEORV32 RISC-V soft core on the iCE40 FPGA target.
iCE40, XC7A35T	FPGA bitstreams for the CW312T iCE40 and Artix-7 (XC7A35T) targets, loaded over the SPI pins (CS on PDID, CRESET/PROG on nRST).

The list offers only the programmers the connected ChipWhisperer can drive; the others are shown as (not available) with the reason (for example the CW-Nano programs STM32F targets only). See Protocols and Interfaces. JTAG/SWD targets can also be flashed through OpenOCD from the Interfaces tab.

Other platforms (for example the NXP, Nordic or Silicon Labs CW308 boards) are not programmed by these built-in programmers; use the vendor's tools with the .hex Studio builds.

Three ways to get firmware onto the target

1. Upload a file from your computer: pick the programmer, choose a .hex file (.bin and .elf are also accepted by the file picker) with Hex file, and press Program target. The browser uploads the file to Studio, which stores it in the firmware/uploads folder of the data directory and programs it.
2. Use a path on the Studio machine: leave the file picker empty and type the full path of a firmware file into the box below it. This is handy when Studio runs on a lab PC and you use it from another computer's browser, because the file never has to travel through the browser.
3. Build it in Studio: the Firmware tab (Firmware Builds) builds ChipWhisperer's firmware projects and has a Build & program button that picks the right programmer for the platform automatically. The Firmware link under the Program firmware card takes you there.

Programming can take a few seconds to a minute. The status line under the button says Programming… (watch the log) while it runs, and the log at the bottom of the window shows the programmer's messages. When it finishes you see Done: N bytes written.

Programming the simulator

When the scope is the Simulator, programming an ELF (or a .hex that Studio built, which keeps its .elf next to it) makes the simulated target run that firmware in an emulator: its responses and traces then come from your code. Any other file is only checked to exist, and the simulated target keeps behaving like its built-in AES target. The result says which of the two happened. See Simulator.

SimpleSerial helper

ChipWhisperer's example firmware talks the SimpleSerial protocol: a one letter command, a hex payload, and a reply. The standard AES firmware, for example, uses k to set the key and p to encrypt a plaintext, and answers with r followed by the ciphertext.

Control	What it does	Default
Key + Send key	Sends command k with the key in hex. A toast confirms that the key was sent.	2b7e151628aed2a6abf7158809cf4f3c
Command	The one letter command to send.	p
Payload	The data to send, in hex (spaces are ignored).	00112233445566778899aabbccddeeff
Response length	How many bytes of reply to wait for.	16
Send	Sends the command and shows the reply as r <hex>, or (no response) if nothing valid came back within about half a second.

Both directions also appear in the terminal, so you can see exactly what went over the wire. The Interfaces tab has the same helper with a choice of protocol version.

SimpleSerial v1 or v2? Studio talks to the target through ChipWhisperer's own target classes, which handle the protocol's framing for you, so the helper looks the same for both. What matters is that the protocol version you select on the Connect tab (SimpleSerial v2 for current firmware, SimpleSerial v1 for legacy firmware) matches the version your firmware was built with (SimpleSerial in the Firmware tab, see Firmware Builds). If replies never arrive, a version mismatch is the most common cause.

Serial terminal

The terminal shows everything the target sends, plus what you send, including traffic from captures, notebooks and agents. It is the same terminal as in the Interfaces tab, where you also set the baud rate, parity, stop bits and pins.

Sent lines start with →, received lines with ←.

Control	What it does	Default
Text box + Send (or Enter)	Sends the text to the target. Up and Down recall what you sent before. Needs a connected target.
Send as	text, or hex bytes (for example 70 00 11 22).	text
Line ending	Added to text you send: no line end, LF, CR or CR LF. Not applied in hex mode.	LF
History	The last 30 lines sent, to send again.
show hex	Show each line as hex bytes instead of text. Newlines in text mode appear as ⏎.	off
timestamps	Show the time of each line.	off
clear	Empty the terminal view.

Studio polls the serial port about ten times a second while no capture or glitch sweep is running (during those jobs the target's replies are consumed by the job itself). The terminal keeps the most recent 1000 lines; the send mode, line ending and history are remembered.

Tip: If your firmware prints a banner or debug messages, they appear here. If nothing ever appears, check that io.tio1 and io.tio2 are set to serial_rx and serial_tx in the Scope tab (see Scope Settings), and that the baud rate in the target settings matches your firmware.

Target settings

The Target settings card shows the target interface's own settings (such as the serial baud rate and protocol details) as a tree that works exactly like the scope settings tree: hover a name for documentation, press Enter to apply, and values are read back after every change. Press ↻ Refresh to reload it. The tree refreshes automatically when a target connects or disconnects.

Resetting the target

There is no separate reset button on the Target tab. To reset the target by hand:

1. Open the Scope tab and filter for nrst (or pdic for XMEGA targets).
2. Set io.nrst to low, then back to high_z.

Setting io.target_pwr to False and back to True power cycles the target. A sweep in the Glitch tab can reset the target automatically after a crash.

Doing the same from code

• In a Notebook: cw.program_target(scope, cw.programmers.STM32FProgrammer, "fw.hex"), target.simpleserial_write('p', data) and target.simpleserial_read('r', 16) work as in Jupyter, on the same connection Studio uses.
• HTTP API: POST /api/target/program, /api/target/program/upload, /api/target/simpleserial and /api/target/serial/write.
• MCP Server: target_program, firmware_program, simpleserial, serial_write and serial_read.

See also

• Firmware Builds to compile firmware without installing a toolchain.
• Capturing Traces once the target answers.
• Troubleshooting if programming fails or the target is silent.