newaetech / chipwhisperer

ChipWhisperer - the complete open-source toolchain for side-channel power analysis and glitching attacks

ChipWhisperer

|

| Hardware Docs | Documentation | Forum | Store | NewAE

ChipWhisperer is an open source toolchain dedicated to hardware security research. This toolchain consists of several layers of open source components:

• Hardware: The ChipWhisperer uses a capture board and a target board. Schematics and PCB layouts for the ChipWhisperer-Lite capture board and a number of target boards are freely available.
• Firmware: Three separate pieces of firmware are used on the ChipWhisperer hardware. The capture board has a USB controller (in C) and an FPGA for high-speed captures (in Verilog) with open-source firmware. Also, the target device has its own firmware; this repository includes many firmware examples for different targets.
• Software: The ChipWhisperer software includes a Python API for talking to ChipWhisperer hardware (ChipWhisperer Capture) and a Python API for processing power traces from ChipWhisperer hardware (ChipWhisperer Analyzer). You can find documentation for our Python API at chipwhisperer.readthedocs.io

---

Getting Started

First time using ChipWhisperer? Check out these links:

• Getting started
• Installing ChipWhisperer if you're trying to set up this software package
• Hardware Docs for hardware information. Also has helpful comparison between different NewAE products.

ChipWhisperer 5.5: All-in-one installer, Serial Port, ECC, and Segmented Capture

ChipWhisperer 5.5 has brought some exciting new features that make it easier to use and allow you to do some cool new things:

1. The ChipWhisperer Windows installer now includes everything you need to use ChipWhisperer, including Python/Juptyer, Git, Make, and compilers! For more information, check out our Windows installer page on ReadTheDocs.
2. ChipWhisperer capture devices (CWLite, Nano, Pro, etc.) have gotten a new firmware update that gives them a USB-CDC serial port for talking over USART. This means you can use your favourite serial program, such as PuTTy, to talk to and listen to the target's USART communication. For more info, see our rtfm serial port page.
3. We've recently added two ECC power analysis attack notebooks. One attacks a hardware ECC implementation running on the CW305 and the other attacks a software ECC implementation running on a microcontroller. Both can be found in jupyter/demos.
4. There's a new segmented capture mode that allows you to fill the ChipWhisperer capture buffer with multiple power traces before transferring data to the PC. This greatly reduces the overhead on trace transfer, allowing capture speeds of 1000+ captures/second for FPGA AES implementations. See our API documentation to see how to use it.

Also, if you haven't checked it out yet, ChipWhisperer 5.4 included TraceWhisperer, which allows you to use Arm trace to timestamp microcontroller operations/functions in your powertrace. It requires a CW305 or PhyWhisperer. For more information, see https://github.com/newaetech/DesignStartTrace.

GIT Source

Note all development occurs on the develop branch. If you are looking for bleeding edge it's NOT on master - we push each release (and possibly any critical changes) to master. This means that "master" always gives you the latest known-working branch, but there may be new features on the "develop" branch.

Help!

Stuck? If you need a hand, there are a few places you can ask for help:

• The NewAE Forum is full of helpful people that can point you in the right direction
• If you find a bug, let us know through the issue tracker

---

ChipWhisperer is a trademark of NewAE Technology Inc., registered in the US, Europe, and China.

chipwhisperer's Issues

Git: Improve branching model

Currently, we do all of our work in "master", and we just tag a commit when we make a new release. It would be better to make a "develop" branch for our day-to-day development so that the master branch only includes the software releases.

SW: Dropdown for default SimpleSerial values

Would be nice if some common defaults for key/init/input/go commands were built into ChipWhisperer for a few applications (encryption, authentication, glitch module, etc). Should leave a custom mode where everything is user-editable and this should be default to avoid breaking existing scripts.

SW: PyCrypto dependency

The random vs. fixed t-test attack (chipwhisperer/software/chipwhisperer/capture/acq_patterns/crittest.py) uses an AES encryption to generate a list of "random" plaintexts. It uses PyCrypto to perform these encryption operations. However, we have AES implemented elsewhere in ChipWhisperer, so we should get rid of this dependency.

Analyzer crashes on exit if the Capture tool GUI is executed before from script (Windows only)

Analyzer crashes on exit if the Capture tool GUI is executed before (Windows only). The capture window is being deleted twice, in the exec_ loop (because the deleteLater call) and when the QApplication leaves the scope (because the deleterLater call inside the makeApplication). Workaround was to insert an argument to disable this last call.

NOTE: This bug was copied from old KNOWNISSUES.TXT which is being deleted. I'm not sure if this bug is still a problem.

Python code in scripts folder gets run automatically

Any .py files in chipwhisperer/software/chipwhisperer/capture/scripts will get automatically run (ie: any code outside of functions or classes will be run automatically). This can cause ChipWhisperer to break pretty badly (can't connect to CW hardware, etc).

One way to reproduce is to put the code from Tutorial B11 into the scripts folder.

No section "Trace Management"

Attempting to load a project that doesn't exist using the command line gives a cryptic error message about the Trace Management section. We should check if the file exists before trying to find this section.

https://wiki.newae.com/Tutorial_B1_Building_a_SimpleSerial_Project

Following the B1 tutorial (on my CW lite) I am running into problems.

I am not quite sure this if this is because of my (self built software or the default because it used to work about 6 month ago) but for https://wiki.newae.com/Tutorial_B1_Building_a_SimpleSerial_Project to
work I need to follow a few more steps (I think those are described in the glitch video)

Configure the clock to generated 7.37 MHz
Switch TX/RX in CW extra settings
Configure HS IN/OUT to be the clkgen
perform an additional DCM reset.

Analyzer: DES key scheduler doesn't work

The analyzer has a DES key schedule calculator, but it does nothing! The output text field is always empty. See forum post.

Filenames in top bar don't accurately reflect unsaved changes

The filename in the CW software top bar previously always had a star beside it. In #52 we took this out, but we should be more careful to add a star when the file is unsaved.

Glitch map doesn't load existing data from glitch explorer

It's painful to capture a bunch of glitches then realize the glitch map isn't open. This should load existing data from the glitch explorer lines.

modalSession has been exited prematurely

"modalSession has been exited prematurely - check for a re-entrant call to endModalSession" is a Mac specific bug when closing modal dialogs and the only fix is updating the Qt library.

NOTE: This bug was copied from old KNOWNISSUES.TXT which is being deleted. I'm not sure if this bug is still a problem.

Can't add QColor and int

There's an issue with auto-incrementing colors - CWCapture appears to misunderstand how the current color was selected, so it struggles to autoincrement it. Need to figure out how to reproduce.

WIKI: Make various example traces available (probably new github "chipwhisperer-examples")?

Used to be some example traces... should do that again

CW308: Make quasi-automated test

CWPro: Don't allow setting SAD pattern with downsampling on

When downsampling is enabled, the trace in CWCapture will not look like the trace seen by the ADC. If the SAD pattern is set using a downsampled trace, this pattern won't be useful for trigger, but it might be unclear why the trigger is not working.

The SAD reference should be locked when downsampling is enabled.

Update Installing_ChipWhisperer

Hi,

I noticed the installing from git adds a second repository (openacd) under the current directory. There is nothing wrong with this but given the main git repository already contains a .gitsubmodule file it is enough
to say

git submodule init
git submodule update

https://wiki.newae.com/Installing_ChipWhisperer

FPGA: Add support for larger FIFO

FPGA file needs small patch (described at https://newae.com/forum/viewtopic.php?f=6&t=19)

Updating preprocessing module causes plot command to change

Updating preprocessing module sets plot command as default

Download CW Firmware Button Errors

1. Connect to CW-Lite/CW1200
2. Open CW Firmware Preferences Window
3. Disconnect & then Reconnect to CW
4. Hit "Program FPGA"

Problem seems to be related to keeping wrong reference around, needs fixing.

SW: some analyzer SAD/T-test partitions are broken

Some of the partition choices for SAD/t-test display are broken. RKey-1 and HD AES Last Round print some pretty cryptic errors after clicking "Display". These errors should be fixed, or at least be a bit more user-friendly

SW: Make easier to use API

TODO: Make improvements (probably as 'wrapper' first) to make API easier to use. Perhaps something like this usage:

import chipwhisperer as cw
from chipwhisperer import gui
from chipwhisperer.acq_controller import basic

project = cw.project('aes.cwp', writer=sql_writer, overwrite=True)

gui.show()

scope = cw.scope("cwlite")
scope.gain_db = 20
scope.trigger.mode = "rising"
scope.trigger.timeout = 2
scope.trigger.offset = 1250
scope.trigger.samples = 3000
scope.trigger.pretrigger = 500

scope.clkgen.freq = 7.37E6
scope.adcclk.src = "clkgen_x4"
scope.reset_clocks()

scope.trigger_pins.tio4 = True
scope.trigger_pins.mode = "OR"
scope.target_hsout = "clkgen"

#scope.glitchhp = False
#scope.glitchlp = False
#scope.target_power = False
#scope.glitch.source = "clkgen"
#scope.glitch.manual()

ac = basic(scope, target, project)
ac.test_capture(N=1)

gui.register(scope)
gui.register(target)
gui.register(ac)

ac.capture(N=1000000, segments=1)

print scope.adcclk.freq
print scope.adcclk.samplerate

Cryptic error messages: NoneType has no attribute "InWaiting"

When the target is disconnected, trying to Capture 1 gives a strange error message. This should really say something like "No target connected - to capture traces, first connect to target"

SW: CWCapture UI is slow for long captures

Some people are reporting that the ChipWhisperer GUI gets extremely slow when capturing thousands of traces. Increasing the number of trace sets doesn't seem to help. See this forum thread I haven't been able to reproduce this on my end.

Test Issue

Ignore

Needs more Save As

ChipWhisperer doesn't have Save As. It should.

https://wiki.newae.com/Installing_ChipWhisperer

Hi,

Following https://wiki.newae.com/Installing_ChipWhisperer I tried the quick tests.

These currently fail because they can not find the .hex files that are located in the tests directory.

WARNING:Could not execute method run in script class Capture: 'IOError:[Errno 2] No such file or directory: 'simpleserial-des-xmega.hex''

I fudged a solution here
https://gist.github.com/x8-999-github/61d1fe3e217a9954b974313fe9cfe437

VM: Terminal looks connected even if it's not

On Lubuntu, the main terminal text box appears the same whether or not the terminal is connected to the target. We should make this more clear.

Glitch explorer doesn't sweep

Even with captures succeeding and all int/float settings correct, the glitch explorer sometimes refuses to sweep. I'm not sure why this happens.

SW: New global_mod module used for passing data between modules

There are several instances where data needs to be passed between modules, for example in capture logic to pass around references to the OpenADC or ChipWhisperer. Right now this is done with some insane levels of indirection.

There is now a module to place these in instead. Need to go through and update the system to use this module, and figure out what all should go into it.

CWPro: baud rate not read from device, so defaults displayed are wrong

Test Issue

Ignore

py2exe / Binary Distribution

Have long thought of making a distribution using something like py2exe. So far I haven't done a lot of research into that, as are other options & also can do similar for macos. This issue is to track suggestions/notes:

Initial notes:

• Would be good to still be able to modify some underlying files possibly.
• Can install drivers at same time?

Glitch explorer is slow during large captures

The glitch explorer uses a QTableWidget to display all of the glitch results. This class is really slow (ex: see http://stackoverflow.com/questions/16801802/how-to-speed-up-qtablewidget) so it becomes incredibly slow after a few thousand traces. There should be some way to speed up this table.

Glitch Explorer serial response wait in Simpleserial timeout to short

I try to glitch a traget based on Simpleserial and always got empty responses in glitch monitor however terminal showed a lot of data coming back.

After adding a timeout for the serial read everything worked fine:

        if fmt.startswith("$GLITCH$"):
            try:
                databytes = int(fmt.replace("$GLITCH$",""))
            except ValueError:
                databytes = 64

-            self.newInputData.emit(self.ser.read(databytes))
+            self.newInputData.emit(self.ser.read(databytes, timeout=1000))
            return None

This is not optimal (now it always takes 1 second for the trace to finish, regardless if the output arrives earlier) but it solved my problem.

Better would be to start the response read based on the trigger since my target needs some time to arrive at the trigger output and glitch point (between 500-700 msec).

Cannot switch from CW1200 to CWLite, hard to modify CW1200 FW Settings

Currently the CW1200 and CWLite firmware is one object that gets switched depending if a CWLite or CW1200 is detected. This ends up being pretty clunkly and causes many bad things (TM), including trying to load the wrong firmware when switching tools.

Should have seperate objects, maybe seperate pull downs are thus required.

WIKI: Tag software version on tutorial page (& make template to keep various info)

Should tag SW version used in creating tutorial, so people have an idea. What it was created with.

This should also be made into part of a template that goes on each tutorial which could show HW used, etc etc.

This issue will be used to track progress.

CWPro: Save/load SAD pattern

Currently, it is impossible to save a SAD pattern to use later - when the ChipWhisperer is powered off, this fixed pattern is lost. It would be nice to be able to save patterns and load them later.

Capture: I/O Decoder trigger stays after switching Pro to Lite

When a CW-Pro is connected, the I/O Decoder trigger module appears in the settings. It sticks around after we plug in a CW-Lite instead, and the Lite doesn't understand these settings, causing all kinds of USB errors. This module should vanish when a Lite is connected.

SW: AVR/XMEGA Programmer Crashes if Scope Disconnected

If the USB device is disconnected while an AVR programmer is still open, the programmer will crash.

stdout/stderr redirection prevents output from reaching shell

The stdout/stderr redirection to the logging tab at https://github.com/newaetech/chipwhisperer/blob/master/software/chipwhisperer/common/ui/CWMainGUI.py#L166 prevents the output from going to the shell. This makes one wonder where the output of e.g. print statements is going, and increases confusion.
Ideally this would be teed, but that would require combining both buffers into the output buffer.
Thoughts on potential solutions?

SW: Can't program XMEGA/AVR without GUI

The XMEGA programmer GUI has some of the logic for programming the XMEGA targets, and it's impossible to make a programmer object without the GUI. It should be much easier to program an XMEGA from the command line.

Test Issue

Fix firmware file rebuild script

As suggested by Thomas Jarosch: you could make a "smart" rebuild logic: Cache the sha256sum of the input files in an extra file. If they sha256sum of a file changes, regenerate the output file and update the cache.

SW: Import traces from external captures

Forum thread

Right now, there's no way to import raw traces/plaintexts/ciphertexts/keys into the trace manager. It would be helpful if there was a way to take .npy files with this information and automatically generate a .cfg file to be used in the trace manager.

SW: Crash when programming AVR

Attempting to program an AVR device when none are plugged in causes CWCapture to crash. The XMEGA programmer is a bit less insane (displays a warning that programming failed) - the AVR should work like this too.

Windows 10 - Installer should be signed

Problems on Windows 10 due to unsigned installer it seems. We have a signing key from driver install so presumably this is fixable without much effort besides figuring out how to sign the installer.

Glitch explorer doesn't sweep if trace fails

If a trace capture times out (no trigger or other reasons), the glitch explorer will add a line but it won't change the parameters. This is really confusing. I think the parameters should always change if a line is added to the glitch explorer - maybe no lines should be added if the trace fails.

Trace import impossible

Hi,

I'm trying to import DPAv3-style traces, but the trace manager keeps crashing when selecting an entry in the dropdown menu.

Traceback (most recent call last):
  File "/home/edermi/chipwhisperer/software/chipwhisperer/common/traces/TraceManagerImport.py", line 97, in traceTypeChanged
    self.tmanagerParams = newTT.getParamsClass(openMode=True)   
AttributeError: 'NoneType' object has no attribute 'getParamsClass'

I'm not able to import traces, the 'load cfg' button stays grey.

I'm using ubuntu 14.04 with dependencies installed from repo and latest ChipWhisperer archive from the ChipWhisperer homepage.

Endless error messages: can't convert str "" to int

To reproduce:

• Type an invalid key in the fixed key field
• Press enter

CWPro: error messages on serial decode string not being valid

Impossible to stop error messages