git.rot13.org Git - goodfet/blob - client/GoodFETGlitch.py

   1 #!/usr/bin/env python
   2 # GoodFET Client Library
   3 #
   4 # (C) 2009 Travis Goodspeed <travis at radiantmachines.com>
   5 #
   6 # This code is being rewritten and refactored.  You've been warned!
   7
   8 import sys, time, string, cStringIO, struct, glob, serial, os, random;
   9 import sqlite3;
  10
  11 from GoodFET import *;
  12
  13 script_timevcc="""
  14 plot "< sqlite3 glitch.db 'select time,vcc,glitchcount from glitches where count=0;'" \
  15 with dots \
  16 title "Scanned", \
  17 "< sqlite3 glitch.db 'select time,vcc,count from glitches where count>0;'" \
  18 with dots \
  19 title "Success", \
  20 "< sqlite3 glitch.db 'select time,vcc,count from glitches where count>0 and lock>0;'" \
  21 with dots \
  22 title "Exploited"
  23 """;
  24
  25 class GoodFETGlitch(GoodFET):
  26
  27     def __init__(self, *args, **kargs):
  28         print "Initializing GoodFET Glitcher."
  29         #Database connection w/ 30 second timeout.
  30         self.db=sqlite3.connect("glitch.db",30000);
  31         self.db.execute("create table if not exists glitches(time,vcc,gnd,trials,glitchcount,count,lock)");
  32         self.db.execute("create index if not exists glitchvcc on glitches(vcc);");
  33         self.client=0;
  34     def setup(self,arch="avr"):
  35         self.client=getClient(arch);
  36     def graphx11(self):
  37         try:
  38             import Gnuplot, Gnuplot.PlotItems, Gnuplot.funcutils
  39         except ImportError:
  40             print "gnuplot-py is missing.  Can't graph."
  41             return;
  42         g = Gnuplot.Gnuplot(debug=1);
  43         g.clear();
  44
  45         g.title('Glitch Training Set');
  46         g.xlabel('Time (16MHz)');
  47         g.ylabel('VCC (DAC12)');
  48
  49         g('set datafile separator "|"');
  50
  51         g(script_timevcc);
  52         while 1==1:
  53             time.sleep(30);
  54             g('replot');
  55
  56
  57     def graph(self):
  58         #try:
  59         import Gnuplot, Gnuplot.PlotItems, Gnuplot.funcutils
  60         #except ImportError:
  61         #    print "py-gnuplot or py-numpy is missing.  Can't graph."
  62         #    return;
  63         g = Gnuplot.Gnuplot(debug=1);
  64
  65         g('\nset term png');
  66         g.title('Glitch Training Set');
  67         g.xlabel('Time (16MHz)');
  68         g.ylabel('VCC (DAC12)');
  69
  70         g('set datafile separator "|"');
  71         g('set term png');
  72         g('set output "timevcc.png"');
  73         g(script_timevcc);
  74
  75     def learn(self):
  76         #Learning phase
  77         trials=1;
  78         lock=0;  #1 locks, 0 unlocked
  79         vstart=0;
  80         vstop=0xfff;  #Could be as high as 0xFFF
  81         vstep=1;
  82         tstart=0;
  83         tstop=-1; #<0 defaults to full range
  84         tstep=0x1; #Must be 1
  85         self.scan(lock,trials,vstart,vstop,tstart,tstop);
  86
  87     def scan(self,lock,trials=1,vstart=0,vstop=0xfff,tstart=0,tstop=-1):
  88         client=self.client;
  89         self.lock=lock;
  90         client.serInit();
  91         if tstop<0:
  92             tstop=client.glitchstarttime();  #Really long; only use for initial investigation.
  93             print "-- Start takes %04i cycles." % tstop;
  94         client.start();
  95         client.erase();
  96
  97         self.secret=0x69;
  98
  99         while(client.eeprompeek(0)!=self.secret):
 100             print "-- Setting secret";
 101             client.start();
 102
 103             #Flash the secret to the first two bytes of CODE memory.
 104             client.erase();
 105             client.eeprompoke(0,self.secret);
 106             client.eeprompoke(1,self.secret);
 107             sys.stdout.flush()
 108
 109         #Lock chip to unlock it later.
 110         if lock>0:
 111             client.lock();
 112         voltages=range(vstart,vstop,1);
 113         times=range(tstart,tstop,1);
 114
 115         gnd=0;     #TODO, glitch GND.
 116         vcc=0xfff;
 117         random.shuffle(voltages);
 118         #random.shuffle(times);
 119
 120         for vcc in voltages:
 121             if not self.vccexplored(vcc):
 122                 print "Exploring vcc=%i" % vcc;
 123                 sys.stdout.flush();
 124                 for time in times:
 125                     self.scanat(trials,vcc,gnd,time)
 126                     sys.stdout.flush()
 127                 self.db.commit();
 128             else:
 129                 print "Voltage %i already explored." % vcc;
 130                 sys.stdout.flush();
 131     def vccexplored(self,vcc):
 132         c=self.db.cursor();
 133         c.execute("select vcc from glitches where vcc=? limit 1;",[vcc]);
 134         rows=c.fetchall();
 135         for a in rows:
 136             return True;
 137         return False;
 138     def scanat(self,trials,vcc,gnd,time):
 139         client=self.client;
 140         db=self.db;
 141         client.glitchRate(time);
 142         client.glitchVoltages(gnd, vcc);  #drop voltage target
 143         gcount=0;
 144         scount=0;
 145         #print "-- (%5i,%5i)" % (time,vcc);
 146         #sys.stdout.flush();
 147         for i in range(0,trials):
 148             client.glitchstart();
 149
 150             #Try to read *0, which is secret if read works.
 151             a=client.eeprompeek(0x0);
 152             if self.lock>0: #locked
 153                 if(a!=0 and a!=0xFF and a!=self.secret):
 154                     gcount+=1;
 155                 if(a==self.secret):
 156                     print "-- %04x: %02x HELL YEAH! " % (time, a);
 157                     scount+=1;
 158             else: #unlocked
 159                 if(a!=self.secret):
 160                     gcount+=1;
 161                 if(a==self.secret):
 162                     scount+=1;
 163         #print "values (%i,%i,%i,%i,%i);" % (
 164         #    time,vcc,gnd,gcount,scount);
 165         self.db.execute("insert into glitches(time,vcc,gnd,trials,glitchcount,count,lock)"
 166                    "values (%i,%i,%i,%i,%i,%i,%i);" % (
 167                 time,vcc,gnd,trials,gcount,scount,self.lock));