class GoodFETGlitch(GoodFET):
def __init__(self, *args, **kargs):
- print "Initializing GoodFET Glitcher."
+ print "# Initializing GoodFET Glitcher."
#Database connection w/ 30 second timeout.
self.db=sqlite3.connect("glitch.db",30000);
def glitchvoltages(self,time):
"""Returns list of voltages to train at."""
c=self.db.cursor();
- c.execute("""select
- (select min(vcc) from glitches where time=? and count=1),
- (select max(vcc) from glitches where time=? and count=0);""",
- [time, time]);
+ #c.execute("""select
+ # (select min(vcc) from glitches where time=? and count=1),
+ # (select max(vcc) from glitches where time=? and count=0);""",
+ # [time, time]);
+ c.execute("select min,max from glitchrange where time=? and max-min>0;",[time]);
rows=c.fetchall();
for r in rows:
min=r[0];
return range(min,max,1);
#If we get here, there are no points. Return empty set.
return [];
-
+ def crunch(self):
+ """This builds tables for glitching voltage ranges from the training set."""
+ print "Precomputing glitching ranges. This might take a long while.";
+ print "Times...";
+ sys.stdout.flush();
+ self.db.execute("drop table if exists glitchrange;");
+ self.db.execute("create table glitchrange(time integer primary key asc,max,min);");
+ self.db.commit();
+ print "Calculating ranges...";
+ sys.stdout.flush();
+
+ maxes={};
+ mins={};
+
+ c=self.db.cursor();
+ c.execute("select time,vcc,count from glitches;"); #Limit 10000 for testing.
+ progress=0;
+ for r in c:
+ progress=progress+1;
+ if progress % 1000000==0: print "%09i rows crunched." % progress;
+ t=r[0];
+ v=r[1];
+ count=r[2];
+ if count==0:
+ try: oldmax=maxes[t];
+ except: oldmax=-1;
+ if v>oldmax: maxes[t]=v;
+ elif count==1:
+ try: oldmin=mins[t];
+ except: oldmin=0x10000;
+ if v<oldmin: mins[t]=v;
+ print "List complete. Inserting.";
+ for t in maxes:
+ max=maxes[t];
+ try: min=mins[t];
+ except: min=0;
+ self.db.execute("insert into glitchrange(time,max,min) values (?,?,?)",(t,max,min));
+ self.db.commit();
+ print "Done, database crunched.";
def graphx11(self):
try:
import Gnuplot, Gnuplot.PlotItems, Gnuplot.funcutils
print "^C to exit.";
while 1==1:
time.sleep(30);
-
-
def graph(self):
import Gnuplot, Gnuplot.PlotItems, Gnuplot.funcutils
g = Gnuplot.Gnuplot(debug=1);
g('set term png');
g('set output "timevcc.png"');
g(script_timevcc);
- def explore(self,tstart=0,tstop=-1, trials=5):
+ def points(self):
+ c=self.db.cursor();
+ c.execute("select time,vcc,gnd,glitchcount,count from glitches where lock=0 and count>0;");
+ print "time vcc gnd glitchcount count";
+ for r in c:
+ print "%i %i %i %i %i" % r;
+ def npoints(self):
+ c=self.db.cursor();
+ c.execute("select time,vcc,gnd,glitchcount,count from glitches where lock=0 and count=0;");
+ print "time vcc gnd glitchcount count";
+ for r in c:
+ print "%i %i %i %i %i" % r;
+ #GnuPlot sucks for large sets. Switch to viewpoints soon.
+ # sqlite3 glitch.db "select time,vcc,count from glitches where count=0" | vp -l -d "|" -I
+
+ def explore(self,tstart=0,tstop=-1, trials=1):
"""Exploration phase. Uses thresholds to find exploitable points."""
gnd=0;
self.scansetup(1); #Lock the chip, place key in eeprom.
tstop=self.client.glitchstarttime();
times=range(tstart,tstop);
random.shuffle(times);
- for t in times:
- voltages=self.glitchvoltages(t);
- print "Exploring %04i points in t=%04i." % (len(voltages),t);
+ #self.crunch();
+ count=0.0;
+ total=1.0*len(times);
+
+ c=self.db.cursor();
+ c.execute("select time,min,max from glitchrange where max-min>0;");
+ rows=c.fetchall();
+ c.close();
+ random.shuffle(rows);
+ for r in rows:
+ t=r[0];
+ min=r[1];
+ max=r[2];
+ voltages=range(min,max,1);
+ count=count+1.0;
+ print "%02.02f Exploring %04i points in t=%04i." % (count/total,len(voltages),t);
sys.stdout.flush();
for vcc in voltages:
self.scanat(1,trials,vcc,gnd,t);
rows=c.fetchall();
for a in rows:
return True;
+ c.close();
return False;
def scanat(self,lock,trials,vcc,gnd,time):
client=self.client;
- db=self.db;
client.glitchRate(time);
client.glitchVoltages(gnd, vcc); #drop voltage target
gcount=0;
scount+=1;
#print "values (%i,%i,%i,%i,%i);" % (
# time,vcc,gnd,gcount,scount);
- if(lock>0):
+ if(lock==0):
self.db.execute("insert into glitches(time,vcc,gnd,trials,glitchcount,count,lock)"
"values (%i,%i,%i,%i,%i,%i,%i);" % (
time,vcc,gnd,trials,gcount,scount,lock));
- else:
+ elif scount>0:
+ print "INSERTING AN EXPLOIT point, t=%i and vcc=%i" % (time,vcc);
self.db.execute("insert into exploits(time,vcc,gnd,trials,count)"
"values (%i,%i,%i,%i,%i);" % (
time,vcc,gnd,trials,scount));
+ self.db.commit(); #Don't leave a lock open.