PhysicalAttack_2023/FI_Tutorial_ClockGlitch_Student.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "id": "1a0a1d1c",
   "metadata": {},
   "source": [
    "## 1- Platform configuration and firmware compilation"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "fd366688",
   "metadata": {},
   "outputs": [],
   "source": [
    "SCOPETYPE = 'OPENADC'\n",
    "PLATFORM = 'CWLITEARM'\n",
    "SS_VER = 'SS_VER_2_1'\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "6e920f1f",
   "metadata": {},
   "outputs": [],
   "source": [
    "%%bash -s \"$PLATFORM\" \"$SS_VER\"\n",
    "cd ../hardware/victims/firmware/simpleserial-glitch\n",
    "make PLATFORM=$1 CRYPTO_TARGET=NONE SS_VER=$2"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "a0c1e2e9",
   "metadata": {},
   "source": [
    "## 2- Connect to Chipwhisperer"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "111afb5e",
   "metadata": {},
   "outputs": [],
   "source": [
    "import chipwhisperer as cw\n",
    "\n",
    "try:\n",
    "    if not scope.connectStatus:\n",
    "        scope.con()\n",
    "except NameError:\n",
    "    scope = cw.scope()\n",
    "\n",
    "try:\n",
    "    if SS_VER == \"SS_VER_2_1\":\n",
    "        target_type = cw.targets.SimpleSerial2\n",
    "    elif SS_VER == \"SS_VER_2_0\":\n",
    "        raise OSError(\"SS_VER_2_0 is deprecated. Use SS_VER_2_1\")\n",
    "    else:\n",
    "        target_type = cw.targets.SimpleSerial\n",
    "except:\n",
    "    SS_VER=\"SS_VER_1_1\"\n",
    "    target_type = cw.targets.SimpleSerial\n",
    "\n",
    "try:\n",
    "    target = cw.target(scope, target_type)\n",
    "except:\n",
    "    print(\"INFO: Caught exception on reconnecting to target - attempting to reconnect to scope first.\")\n",
    "    print(\"INFO: This is a work-around when USB has died without Python knowing. Ignore errors above this line.\")\n",
    "    scope = cw.scope()\n",
    "    target = cw.target(scope, target_type)\n",
    "\n",
    "\n",
    "print(\"INFO: Found ChipWhisperer😍\")"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "91cfd8d2",
   "metadata": {},
   "source": [
    "## 3- Config programmer and program the target"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "06b7afbe",
   "metadata": {},
   "outputs": [],
   "source": [
    "import time\n",
    "if \"STM\" in PLATFORM or PLATFORM == \"CWLITEARM\" or PLATFORM == \"CWNANO\":\n",
    "    prog = cw.programmers.STM32FProgrammer\n",
    "elif PLATFORM == \"CW303\" or PLATFORM == \"CWLITEXMEGA\":\n",
    "    prog = cw.programmers.XMEGAProgrammer\n",
    "else:\n",
    "    prog = None\n",
    "    \n",
    "\n",
    "time.sleep(0.05)\n",
    "scope.default_setup()\n",
    "def reset_target(scope):\n",
    "    if PLATFORM == \"CW303\" or PLATFORM == \"CWLITEXMEGA\":\n",
    "        scope.io.pdic = 'low'\n",
    "        time.sleep(0.1)\n",
    "        scope.io.pdic = 'high_z' #XMEGA doesn't like pdic driven high\n",
    "        time.sleep(0.1) #xmega needs more startup time\n",
    "    else:  \n",
    "        scope.io.nrst = 'low'\n",
    "        time.sleep(0.05)\n",
    "        scope.io.nrst = 'high_z'\n",
    "        time.sleep(0.05)\n",
    "        \n",
    "fw_path = \"../hardware/victims/firmware/simpleserial-glitch/simpleserial-glitch-{}.hex\".format(PLATFORM)\n",
    "cw.program_target(scope, prog, fw_path)\n",
    "if SS_VER==\"SS_VER_2_1\":\n",
    "    target.reset_comms()"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "1129b880",
   "metadata": {},
   "source": [
    "## 4- Config the target clock frequency"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "2cf6db77",
   "metadata": {},
   "outputs": [],
   "source": [
    "def reboot_flush():\n",
    "    reset_target(scope)\n",
    "    target.flush()\n",
    "if PLATFORM == \"CWLITEXMEGA\":\n",
    "    scope.clock.clkgen_freq = 32E6\n",
    "    if SS_VER=='SS_VER_2_1':\n",
    "        target.baud = 230400*32/7.37\n",
    "    else:\n",
    "        target.baud = 38400*32/7.37\n",
    "elif (PLATFORM == \"CWLITEARM\") or (\"F3\" in PLATFORM):\n",
    "    scope.clock.clkgen_freq = 24E6\n",
    "    if SS_VER=='SS_VER_2_1':\n",
    "        target.baud = 230400*24/7.37\n",
    "    else:\n",
    "        target.baud = 38400*24/7.37\n",
    "reboot_flush()"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "920b3f96",
   "metadata": {},
   "source": [
    "## 5- Help for scope.glitch "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "617bf6c3",
   "metadata": {},
   "outputs": [],
   "source": [
    "help(scope.glitch)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "64fa735e",
   "metadata": {},
   "source": [
    "## 6- Check the output with an incorrect password"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "64d9e12b",
   "metadata": {},
   "outputs": [],
   "source": [
    "#Do glitch loop if we send a wrong password\n",
    "\n",
    "pw = bytearray([0x00]*5)\n",
    "target.simpleserial_write('p', pw)\n",
    "\n",
    "val = target.simpleserial_read_witherrors('r', 1, glitch_timeout=10)#For loop check\n",
    "valid = val['valid']\n",
    "if valid:\n",
    "    response = val['payload']\n",
    "    raw_serial = val['full_response']\n",
    "    error_code = val['rv']\n",
    "\n",
    "print(val)\n",
    "#print(bytearray(val['full_response'].encode('latin-1')))"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "930ed6ef",
   "metadata": {},
   "source": [
    "## 7- Check the output with the correct password"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "9a2b70a0",
   "metadata": {},
   "outputs": [],
   "source": [
    "#Do glitch loop while we are sending correct password\n",
    "\n",
    "pw = bytearray([0x74, 0x6F, 0x75, 0x63, 0x68]) # correct password ASCII representation\n",
    "target.simpleserial_write('p', pw)\n",
    "\n",
    "val = target.simpleserial_read_witherrors('r', 1, glitch_timeout=10)#For loop check\n",
    "valid = val['valid']\n",
    "if valid:\n",
    "    response = val['payload']\n",
    "    raw_serial = val['full_response']\n",
    "    error_code = val['rv']\n",
    "\n",
    "print(val)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "998307b9",
   "metadata": {},
   "source": [
    "## 8- Glitch configuration"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "ce3c41cf",
   "metadata": {},
   "outputs": [],
   "source": [
    "import matplotlib.pylab as plt\n",
    "import chipwhisperer.common.results.glitch as glitch\n",
    "\n",
    "scope.glitch.clk_src = 'clkgen'\n",
    "scope.glitch.trigger_src = 'ext_single'\n",
    "scope.glitch.repeat = 1\n",
    "scope.glitch.output = \"clock_xor\"\n",
    "scope.io.hs2 = \"glitch\"\n",
    "gc = glitch.GlitchController(groups=[\"success\", \"reset\", \"normal\"], parameters=[\"width\", \"offset\", \"ext_offset\"])"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "3208d212",
   "metadata": {},
   "source": [
    "## 9- Applying the attack "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "ea259e89",
   "metadata": {},
   "outputs": [],
   "source": [
    "from importlib import reload\n",
    "import chipwhisperer.common.results.glitch as glitch\n",
    "from tqdm.notebook import tqdm\n",
    "import re\n",
    "import struct\n",
    "sample_size = 1\n",
    "# These width/offset settings are for CW-Lite/Pro; width/offset are expressed differently for Husky (see Fault 1_1)\n",
    "# gc.set_range(\"width\", 3, 20)\n",
    "# gc.set_range(\"offset\", 0, 25)    # one success at width = 3.516 offset = 1.172 ext_offset = 7 \n",
    "# gc.set_range(\"ext_offset\", 4, 20)\n",
    "gc.set_range(\"width\", 3, 5)\n",
    "gc.set_range(\"offset\", 0, 5)\n",
    "gc.set_range(\"ext_offset\", 4, 9)\n",
    "\n",
    "step = 1\n",
    "gc.set_global_step(step)\n",
    "scope.glitch.repeat = 1\n",
    "reboot_flush()\n",
    "broken = False\n",
    "gc.display_stats()\n",
    "\n",
    "\n",
    "for glitch_settings in gc.glitch_values():\n",
    "    scope.glitch.offset = glitch_settings[1]\n",
    "    scope.glitch.width = glitch_settings[0]\n",
    "    scope.glitch.ext_offset = glitch_settings[2]\n",
    "    for i in range(sample_size):\n",
    "        if scope.adc.state:\n",
    "            # can detect crash here (fast) before timing out (slow)\n",
    "            print(\"Trigger still high!\")\n",
    "            gc.add(\"reset\", (scope.glitch.width, scope.glitch.offset, scope.glitch.ext_offset))\n",
    "            #plt.plot(lwid, loff, 'xr', alpha=1)\n",
    "            #fig.canvas.draw()\n",
    "\n",
    "            #Device is slow to boot?\n",
    "            reboot_flush()\n",
    "\n",
    "        scope.arm()\n",
    "        target.simpleserial_write('p', bytearray([0]*5))\n",
    "\n",
    "        ret = scope.capture()\n",
    "\n",
    "\n",
    "        if ret:\n",
    "            print('Timeout - no trigger')\n",
    "            gc.add(\"reset\", (scope.glitch.width, scope.glitch.offset, scope.glitch.ext_offset))\n",
    "\n",
    "            #Device is slow to boot?\n",
    "            reboot_flush()\n",
    "\n",
    "        else:\n",
    "            val = target.simpleserial_read_witherrors('r', 1, glitch_timeout=10, timeout=50)#For loop check\n",
    "            if val['valid'] is False:\n",
    "                gc.add(\"reset\", (scope.glitch.width, scope.glitch.offset, scope.glitch.ext_offset))\n",
    "                #plt.plot(scope.glitch.width, scope.glitch.offset, 'xr', alpha=1)\n",
    "                #fig.canvas.draw()\n",
    "            else:\n",
    "\n",
    "                if val['payload'] == bytearray([1]): #for loop check\n",
    "                    broken = True\n",
    "                    gc.add(\"success\", (scope.glitch.width, scope.glitch.offset, scope.glitch.ext_offset))\n",
    "                    print(val['payload'])\n",
    "                    print(scope.glitch.width, scope.glitch.offset, scope.glitch.ext_offset)\n",
    "                    print(\"🐙\", end=\"\")\n",
    "#                     break\n",
    "                else:\n",
    "                    gc.add(\"normal\", (scope.glitch.width, scope.glitch.offset, scope.glitch.ext_offset))"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "d941ab3e",
   "metadata": {},
   "source": [
    "## 10- The result graph"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "80b12799",
   "metadata": {},
   "outputs": [],
   "source": [
    "%matplotlib inline\n",
    "gc.results.plot_2d(plotdots={\"success\":\"+g\", \"reset\":\"xr\", \"normal\":None},alpha=False)\n"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "ce93bc26",
   "metadata": {},
   "source": [
    "## 11- Try it with a precise configuration\n",
    "### Use more precise configuration based on the previous expriment with a smaller step. \n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "d4f35323",
   "metadata": {},
   "outputs": [],
   "source": [
    "from importlib import reload\n",
    "import chipwhisperer.common.results.glitch as glitch\n",
    "from tqdm.notebook import tqdm\n",
    "import re\n",
    "import struct\n",
    "\n",
    "gc.set_range(\"width\", ?, ?)\n",
    "gc.set_range(\"offset\", ?, ?)\n",
    "gc.set_range(\"ext_offset\", ?, ?)\n",
    "\n",
    "step = ?\n",
    "\n",
    "gc.set_global_step(step)\n",
    "scope.glitch.repeat = 1\n",
    "reboot_flush()\n",
    "broken = False\n",
    "gc.display_stats()\n",
    "\n",
    "for glitch_settings in gc.glitch_values():\n",
    "    scope.glitch.offset = glitch_settings[1]\n",
    "    scope.glitch.width = glitch_settings[0]\n",
    "    scope.glitch.ext_offset = glitch_settings[2]\n",
    "    for i in range(sample_size):\n",
    "        if scope.adc.state:\n",
    "            # can detect crash here (fast) before timing out (slow)\n",
    "            print(\"Trigger still high!\")\n",
    "            gc.add(\"reset\", (scope.glitch.width, scope.glitch.offset, scope.glitch.ext_offset))\n",
    "            #plt.plot(lwid, loff, 'xr', alpha=1)\n",
    "            #fig.canvas.draw()\n",
    "\n",
    "            #Device is slow to boot?\n",
    "            reboot_flush()\n",
    "\n",
    "        scope.arm()\n",
    "        target.simpleserial_write('p', bytearray([0]*5))\n",
    "\n",
    "        ret = scope.capture()\n",
    "\n",
    "\n",
    "        if ret:\n",
    "            print('Timeout - no trigger')\n",
    "            gc.add(\"reset\", (scope.glitch.width, scope.glitch.offset, scope.glitch.ext_offset))\n",
    "\n",
    "            #Device is slow to boot?\n",
    "            reboot_flush()\n",
    "\n",
    "        else:\n",
    "            val = target.simpleserial_read_witherrors('r', 1, glitch_timeout=10, timeout=50)#For loop check\n",
    "            if val['valid'] is False:\n",
    "                gc.add(\"reset\", (scope.glitch.width, scope.glitch.offset, scope.glitch.ext_offset))\n",
    "                #plt.plot(scope.glitch.width, scope.glitch.offset, 'xr', alpha=1)\n",
    "                #fig.canvas.draw()\n",
    "            else:\n",
    "\n",
    "                if val['payload'] == bytearray([1]): #for loop check\n",
    "                    broken = True\n",
    "                    gc.add(\"success\", (scope.glitch.width, scope.glitch.offset, scope.glitch.ext_offset))\n",
    "                    print(val['payload'])\n",
    "                    print(scope.glitch.width, scope.glitch.offset, scope.glitch.ext_offset)\n",
    "                    print(\"🐙\", end=\"\")\n",
    "#                     break\n",
    "                else:\n",
    "                    gc.add(\"normal\", (scope.glitch.width, scope.glitch.offset, scope.glitch.ext_offset))"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "fb64d690",
   "metadata": {},
   "outputs": [],
   "source": [
    "# %matplotlib inline\n",
    "gc.results.plot_2d(plotdots={\"success\":\"+g\", \"reset\":\"xr\", \"normal\":None},alpha=False)\n"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3 (ipykernel)",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.10.8"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 5
}