Skip to content

Simple voltage glitcher implementation for the iCEBreaker FPGA board

License

Notifications You must be signed in to change notification settings

SySS-Research/icebreaker-glitcher

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

7 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

iCEBreaker Glitcher

The iCEBreaker Glitcher is a simple voltage glitcher for an iCEBreaker FPGA board.

This glitcher is based on and inspired by glitcher implementations by Dmitry Nedospasov (@nedos) from Toothless Consulting and Grazfather (@Grazfather).

The iCEBreaker Glitcher exemplarily demonstrates how the code read protection (CRP) of NXP LPC-family microcontrollers can be bypassed as presented by Chris Gerlinsky (@akacastor) in his talk Breaking Code Read Protection on the NXP LPC-family Microcontrollers at REcon Brussles 2017.

Hardware Requirements

Software Requirements

Installation

The iCEBreaker Glitcher can be downloaded and built using the SymbiFlow toolchain in the following way:

git clone https://github.com/SySS-Research/icebreaker-glitcher.git
cd icebreaker-glitcher
make
make prog
 
virtualenv glitching
source glitching/bin/activate
pip install -r python/requirements.txt

Test Setup

The following two images show a working test setup for the iCEBreaker Glitcher.

iCEBreaker Glitcher test setup

MAX4619 wiring using iCEBreaker Glitcher

Usage

The iCEBreaker Glitcher is used via the Python command tool iCE iCE Baby Glitcher.

$ python ice-glitcher.py --help
 
 ██▓ ▄████▄  ▓█████     ██▓ ▄████▄  ▓█████     ▄▄▄▄    ▄▄▄       ▄▄▄▄ ▓██   ██▓     ▄████  ██▓     ██▓▄▄▄█████▓ ▄████▄   ██░ ██ ▓█████  ██▀███ 
▓██▒▒██▀ ▀█  ▓█   ▀    ▓██▒▒██▀ ▀█  ▓█   ▀    ▓█████▄ ▒████▄    ▓█████▄▒██  ██▒    ██▒ ▀█▒▓██▒    ▓██▒▓  ██▒ ▓▒▒██▀ ▀█  ▓██░ ██▒▓█   ▀ ▓██ ▒ ██▒
▒██▒▒▓█    ▄ ▒███      ▒██▒▒▓█    ▄ ▒███      ▒██▒ ▄██▒██  ▀█▄  ▒██▒ ▄██▒██ ██░   ▒██░▄▄▄░▒██░    ▒██▒▒ ▓██░ ▒░▒▓█    ▄ ▒██▀▀██░▒███   ▓██ ░▄█ ▒
░██░▒▓▓▄ ▄██▒▒▓█  ▄    ░██░▒▓▓▄ ▄██▒▒▓█  ▄    ▒██░█▀  ░██▄▄▄▄██ ▒██░█▀  ░ ▐██▓░   ░▓█  ██▓▒██░    ░██░░ ▓██▓ ░ ▒▓▓▄ ▄██▒░▓█ ░██ ▒▓█  ▄ ▒██▀▀█▄ 
░██░▒ ▓███▀ ░░▒████▒   ░██░▒ ▓███▀ ░░▒████▒   ░▓█  ▀█▓ ▓█   ▓██▒░▓█  ▀█▓░ ██▒▓░   ░▒▓███▀▒░██████▒░██░  ▒██▒ ░ ▒ ▓███▀ ░░▓█▒░██▓░▒████▒░██▓ ▒██▒
░▓  ░ ░▒ ▒  ░░░ ▒░ ░   ░▓  ░ ░▒ ▒  ░░░ ▒░ ░   ░▒▓███▀▒ ▒▒   ▓▒█░░▒▓███▀▒ ██▒▒▒     ░▒   ▒ ░ ▒░▓  ░░▓    ▒ ░░   ░ ░▒ ▒  ░ ▒ ░░▒░▒░░ ▒░ ░░ ▒▓ ░▒▓░
 ▒ ░  ░  ▒    ░ ░  ░    ▒ ░  ░  ▒    ░ ░  ░   ▒░▒   ░   ▒   ▒▒ ░▒░▒   ░▓██ ░▒░      ░   ░ ░ ░ ▒  ░ ▒ ░    ░      ░  ▒    ▒ ░▒░ ░ ░ ░  ░  ░▒ ░ ▒░
 ▒ ░░           ░       ▒ ░░           ░       ░    ░   ░   ▒    ░    ░▒ ▒ ░░     ░ ░   ░   ░ ░    ▒ ░  ░      ░         ░  ░░ ░   ░     ░░   ░
 ░  ░ ░         ░  ░    ░  ░ ░         ░  ░    ░            ░  ░ ░     ░ ░              ░     ░  ░ ░           ░ ░       ░  ░  ░   ░  ░   ░    
    ░                      ░                        ░                 ░░ ░                                     ░                               
iCE iCE Baby Glitcher v0.5 by Matthias Deeg - SySS GmbH
A very simple voltage glitcher implementation for the Lattice iCEstick Evaluation Kit
Based on and inspired by voltage glitcher implementations by Dmitry Nedospasov (@nedos)
and Grazfather (@Grazfather)
---
usage: ./glitcher.py [-h] [--start_offset START_OFFSET] [--end_offset END_OFFSET] [--start_duration START_DURATION] [--end_duration END_DURATION] [--offset_step OFFSET_STEP] [--duration_step DURATION_STEP] [--retries RETRIES]
 
optional arguments:
  -h, --help            show this help message and exit
  --start_offset START_OFFSET
                        start offset for glitch (default is 100)
  --end_offset END_OFFSET
                        end offset for glitch (default is 10000)
  --start_duration START_DURATION
                        start duration for glitch (default is 1)
  --end_duration END_DURATION
                        end duration for glitch (default is 30)
  --offset_step OFFSET_STEP
                        offset step (default is 1)
  --duration_step DURATION_STEP
                        duration step (default is 1)
  --retries RETRIES     number of retries per configuration (default is 2)

The configuration of a voltage glitching attack can be changed via different command line arguments, for example:

python ice-glitcher.py --start_offset 5400 --end_offset 5430 --start_duration 10 --end_duration 25 --retries 3

Demo

This demo video exemplarily shows how the code read protection (CRP) of an NXP LPC1343 chip can be bypassed by using a voltage glitching attack in order to dump the flash memory containing the firmware.

In this proof-of-concept video, the iCEstick Glitcher was used, which works in the same way as the iCEBreaker glitcher.

SySS PoC Video: Voltage Glitching Attack using SySS iCEstick Glitcher

References

Disclaimer

Use at your own risk. Do not use without full consent of everyone involved. For educational purposes only.