1,461
edits
Changes
Jump to navigation
Jump to search
TBDThe most interesting part of this attack was the discovery that the '''''reset pin goes low for the window of time you should insert a glitch''''' to bypass security! This seems to be the case for all Microchip/ATMEL SAM chips mentioning GPNVM in their datasheets. I have only verified the SAM4C32, SAM4S2A, and E70/S70/V70/V71 exhibit this behavior however. The time from power-up to reset asserting itself varies by chip. The SAM4C32 takes about 17mS while the SAM4S2A only takes 600uS. The SAM E70/S70/V70/V71 takes about 1mS as seen below. Blue (3.3V), Red (VDDCORE), Green (Reset)[[File:ATSAME70 Power Cycle.jpg|none|thumb|600x600px|Scope capture provided by Waleed at 0x01 Team]]I should note that I only discovered this while setting up a different test trying to glitch the processor after resetting it. I like to watch the oscilloscope as I perform glitch attacks to see if any anomalies pop up that could inform future attacks. When I found 0x01 Team's research and realized I should be power cycling instead of resetting, the scope was already configured to monitor VDDCORE & Reset. The first time I power cycled the chip it was clear the reset line activity was correlated in some way with the voltage fluctuation on VDDCORE.
→Reset Pin as a Side Channel
===Reset Pin as a Side Channel===
----
