2 \author Travis Goodspeed
3 \brief Glitching Support for GoodFET20
5 See the TI example MSP430x261x_dac12_01.c for usage of the DAC.
6 This module sends odd and insufficient voltages on P6.6/DAC0
7 in order to bypass security restrictions of target devices.
15 //! Call this before the function to be glitched.
18 //Set to high voltage.
22 TACTL=0; //Clear dividers.
23 TACTL|=TACLR; //Clear TimerA Config
25 TASSEL_SMCLK | //SMCLK source,
26 MC_1 | //Count up to CCR0
27 TAIE; //Enable Interrupt
28 CCTL0 = CCIE; // CCR0 interrupt enabled
31 //Enable general interrupts, just in case.
39 //Set GSEL high to disable glitching.
49 WDTCTL = WDTPW + WDTHOLD; // Stop WDT
50 TACTL = TASSEL1 + TACLR; // SMCLK, clear TAR
51 CCTL0 = CCIE; // CCR0 interrupt enabled
53 TACTL |= MC1; // Start Timer_A in continuous mode
54 _EINT(); // Enable interrupts
58 //! Setup analog chain for glitching.
59 void glitchsetupdac(){
60 glitchvoltages(glitchL,glitchH);
63 // Timer A0 interrupt service routine
64 interrupt(TIMERA0_VECTOR) Timer_A (void)
67 //debugstr("Glitching.");
76 TACTL |= MC0; // Stop Timer_A;
82 u16 glitchH=0xfff, glitchL=0xfff,
83 glitchstate=2, glitchcount=0;
85 //! Glitch an application.
86 void glitchapp(u8 app){
87 debugstr("That app is not yet supported.");
91 //! Set glitching voltages.
92 void glitchvoltages(u16 low, u16 high){
97 //debugstr("Set glitching voltages.");
100 ADC12CTL0 = REF2_5V + REFON; // Internal 2.5V ref on
101 // Delay here for reference to settle.
102 for(i=0;i!=0xFFFF;i++) asm("nop");
103 DAC12_0CTL = DAC12IR + DAC12AMP_5 + DAC12ENC; // Int ref gain 1
104 DAC12_1CTL = DAC12IR + DAC12AMP_5 + DAC12ENC; // Int ref gain 1
105 // 1.0V 0x0666, 2.5V 0x0FFF
110 //! Set glitching rate.
111 void glitchrate(u16 rate){
115 //! Handles a monitor command.
116 void glitchhandle(unsigned char app,
121 glitchvoltages(cmddataword[0],
126 glitchrate(cmddataword[0]);
130 //FIXME parameters don't work yet.
132 handle(cmddata[0],cmddata[1],0);
135 _DINT();//disable interrupts
136 TACTL=0; //clear dividers
137 TACTL|=TACLR; //clear config
138 TACTL|=TASSEL_SMCLK| //smclk source
139 MC_2; //continuout mode.
141 //perform the function
142 silent++;//Don't want the function to return anything.
143 handle(cmddata[0],cmddata[1],0);
145 cmddataword[0]=TAR; //Return counter.
149 glitchvoltages(0xFFF,0);//Inverted VCC and GND.
153 P5OUT&=~BIT7;//Glitch
154 //asm("nop");//asm("nop");asm("nop");asm("nop");asm("nop");asm("nop");
157 asm("nop");asm("nop");asm("nop");asm("nop");asm("nop");asm("nop");
158 asm("nop");asm("nop");asm("nop");asm("nop");asm("nop");asm("nop");
165 debugstr("Unknown glitching verb.");