Voltage glitch is not working on STM32f3 (CW308)

Embedded Security
1

Hi
I am trying the same setting as given in tutorial for STM32F3 target board, i am using chipWhisperer lite board (CW308). when i am trying to provide vcc glitch every time it is getting normal count.

i read the data sheet of STM32F3, i found that it has internal voltage regulator. after disabling the internal voltage regulator i am getting reset count.

i am not able to success in voltage glitch. could you please provide some info will it need any modification in hardware red board(CW308) any setting or any programming setting for the target board STM32F3.

2

I don’t think it’s possible to bypass the regulator in the STM32F3. You can in the F4, since there’s decoupling capacitors on the output of the regulator, but the same isn’t true for the F3. You can put the device in a low power mode that disables most of the chip, but this will prevent the core from running as well.

The F3 can definitely be tricky to voltage glitch. Two things that can really affect the success rate when glitching:

  1. Using a different length SMA cable (sometimes longer is better, sometimes shorter is better)
  2. Changing the clock frequency on the target. For the default notebook, we now run the F3 at 24MHz, since glitches seem to work far better at this higher clock frequency.

Alex

3

Thanks Alex,
Could you please upload your CW308 lite (red board) pic, i have a doubt on my board that some of the dip switches may be wrongly placed (selected).

Dileep

4

Important settings here:

  1. J3 jumpered on HS2/OUT
  2. VCC 3.3V LED on
  3. J14 jumpered between FILT and FILT_HP/FILT_LP
  4. No jumper on J16

Everything else is just enabling/disabling voltage regulators used for other targets.

In regards to glitching, a few more recommendations I have:

  1. Try increasing the width (if on glitch_only) and/or the repeat (both enable_only and glitch_only), as these should always crash the target at some point. This will help you verify that your glitch is having an effect. Additionally, good voltage glitching areas are typically with widths/repeats that are just short of crashing the target.
  2. It may also be worth verifying the glitch on an oscilloscope if you have one

Alex

1 Like