PicoGlitcher v2

In some cases, finding the parameters of a successful glitch can be quite tedious. Especially if the possible parameter space is large (see multiplexing and pulse-shaping). Therefore, the search for a suitable parameter point must be done somewhat more intelligently than with a brute force approach.

In the case of the fault-injeciton-library, a genetic algorithm has been implemented that can be used to search for the optimum parameter points.

If implemented correctly (and with a suitable configuration of the OptimizationController) you should expect clustering experiments around successful glitches. See the figure below for an example output of a glitching campaign. In this case, the ESP32v1.3 was glitched via the multiplexing method. More details can be found here.

The hardware is based on the Raspberry Pi Pico, two high-power MOSFETs for crowbar glitch generation, and two level shifters to ensure compatibility over a wide voltage range. A newly designed input stage (EXT1 and EXT2) can be used to filter out noise and other disturbances via adjustable Schmitt Triggers. The multiplexing output can be used to quickly switch between up to four different voltage levels and to supply the target board with power.

The second revision of the Pico Glitcher can also be modified to suit your needs. The Pico Glitcher v2 is built from the following components:

Due to the high demand for the Pico-Glitcher, the first batch has been sold out. Many thanks to everyone who has supported me by purchasing a Pico-Glitcher. I am currently planning the second hardware version of the Pico-Glitcher, which will have some new features. For example, in version 2 it will be possible to define the glitch pulse shape by different voltages at certain time intervals (so-called pulse shaping). In addition, two separate inputs with preamplifier and Schmitt trigger will facilitate triggering to different voltages. Stay tuned!

The documentation of the software and the hardware is now available under https://fault-injection-library.readthedocs.io/en/latest/.

Any feedback is appreciated!

This projected was kindly supported by JLCPCB which is a PCB manufacturer trusted by 5.4M engineers worldwide. You can get high-quality PCB prototypes for just $2. If you use the following link to sign up, you can get up to $80 coupons: https://jlcpcb.com/?from=matthias

After ten days I received my order from JLCPCB. As mentioned in the previous project log, generating the design files (gerber, CPL and BOM) was fairly straight forward.

The finished PCBs are of high quality. I could not find any errors and the components are perfectly placed and soldered. I am really happy with the way the PicoGlitcher PCB turned out.

The next step was to solder the rest of the components onto the board. For example, the Raspberry Pi Pico and some other through-hole components have to be soldered by hand. The finished board can be seen below.

The new design also works flawlessly. I could generate reproducible glitches on a STM microcontroller within a few minutes.

First of all, the design of the PicoGlitcher is good and I have not found any major flaws yet. The PicoGlitcher works.

However, I have noticed that some of the PCB markings are hard to read, and some are even missing. The component placement is also not optimal, so I decided to update the PCB files. Soldering the small SMD components by hand was difficult (for me at least), so I decided to give PCB manufacturing with component placement a try.

I made a few changes to the design files, picked all the components from JLCPCB via the Assembly Parts Lib and uploaded the new gerber files. In order to automatically generate the BOM and the component placement file (CPL) in Fusion360, I used the library jlcpcb-eagle. With the gerber, the BOM and the CPL files ready, I was finally able to submit my order to JLCPCB. All the relevant files can be found on my github page. 

I was surprised at how easy the whole procedure was. The JLCPCB parts library is huge and if an exact part is not available, there is always an alternative. What's more, every step of the process is easy to understand. The component placement is displayed in an online tool that allows you to check that all the components have been placed correctly. Manufacturing and shipping was fast. I received my order within ten days.

Here you can see a video of a running glitching campaign. The target gets reset, a glitch is emitted and the status of RDP is checked.

I am practiced in doing fine soldering work, but soldering the selected SMD components was nevertheless challenging. In the end, however, the soldering work was successful. The PicoGlitcher is working as expected and I am able to glitch targets. For a test if everything works, I ran a glitch against an STM32F4 microcontroller. Although RDP level 1 was activated, the target responds with an "ACK" after a few attempts when accessing the flash memory in bootloader mode.

The PicoGlitcher v1 actually works!

All the parts have finally arrived and I can now assemble the circuit boards. The boards look amazingly well made, all the tracks are perfect and there are no visible faults. The black boards stand out really nice.