Source Code Documentation
Findus is a Python library to perform fault-injection attacks on embedded devices. It was developed for the Pico Glitcher, however, the ChipWhisperer Pro and the ChipWhisperer Husky is also supported.
This is the documentation of the findus module and all its classes.
Database
Database class managing access to the SQLite databases to store results from a glitching campaign. The parameter points stored in these databases are used to render an overview of the scanned parameter point via a web application. The web application and data analyzer can be run separately from the glitcher scripts by the following command:
analyzer --directory databases
Example usage:
# import Database from findus
from findus import Database
...
database = Database(argv=argv)
...
database.insert(experiment_id, delay, length, color, response)
Example usage for multi-dimensional parameter space:
# import Database from findus
from findus import Database
...
database = Database(argv=argv, column_names=["delay", "length", "t1"])
...
database.insert(experiment_id, delay, length, t1, color, response)
If you want to plot the (length, t1)-slice, you can call the analyzer script as follows:
analyzer --directory databases -x length -y t1
If dbname is not provided, a name will automatically generated based on argv.
Methods:
| Name | Description |
|---|---|
__init__ |
Default constructor. |
insert |
Method to insert datapoints into the SQLite database. |
get_parameters_of_experiment_rel |
Get the parameters of a dataset by experiment_id relative to the base row count. |
get_parameters_of_experiment |
Get the parameters of a dataset by experiment_id. |
remove_conditional |
Remove a parameter point from the database by a condition. |
remove_rel |
Remove a parameter point from the database by experiment_id relative to the base row count. |
remove |
Remove a parameter point from the database by experiment_id. |
cleanup |
Remove all parameter points with a given color. |
get_number_of_experiments |
Get the total number of performed experiments (number of datasets in the database). |
get_latest_experiment_id |
Get the latest experiment_id. |
get_base_experiments_count |
[Deprecated] Get the total number of performed experiments (number of datasets in the database). |
close |
Close the connection to the database. |
__init__(argv, dbname=None, resume=False, nostore=False, column_names=None, dirname='databases')
Default constructor of the Database class.
| Parameters: |
|
|---|
change_color_of_experiment(experiment_id, color)
Change the color of a dataset by experiment_id.
| Parameters: |
|
|---|
change_color_of_experiment_rel(experiment_id, color)
Change the color of a dataset by experiment_id relative to the base row count.
| Parameters: |
|
|---|
cleanup(color)
Remove all parameter points with a given color.
close()
Close the connection to the database.
get_base_experiments_count()
[Deprecated] Get the total number of performed experiments (number of datasets in the database).
| Returns: |
|
|---|
get_latest_experiment_id()
Get the latest experiment_id.
| Returns: |
|
|---|
get_number_of_experiments()
Get the total number of performed experiments (number of datasets in the database).
| Returns: |
|
|---|
get_parameters_of_experiment(experiment_id)
Get the parameters of a dataset by experiment_id.
| Parameters: |
|
|---|
| Returns: |
|
|---|
get_parameters_of_experiment_rel(experiment_id)
Get the parameters of a dataset by experiment_id relative to the base row count.
| Parameters: |
|
|---|
| Returns: |
|
|---|
insert(*dataset)
Method to insert datapoints into the SQLite database.
| Parameters: |
|
|---|
remove(experiment_id)
Remove a parameter point from the database by experiment_id.
| Parameters: |
|
|---|
remove_conditional(condition)
Remove a parameter point from the database by a condition.
| Parameters: |
|
|---|
remove_rel(experiment_id)
Remove a parameter point from the database by experiment_id relative to the base row count.
| Parameters: |
|
|---|
ErrorHandling
check(experiment_id, response, expected=b'expected', keep=None, user_action=None, recolor='O')
Check for consecutive errors and act accordingly.
| Parameters: |
|
|---|
| Returns: |
|
|---|
Glitcher
Glitcher template class. This class defines a common anchestor from which other glitcher modules should inherit from.
Methods:
| Name | Description |
|---|---|
__init__ |
Default constructor. Does nothing in this case. |
classify |
Template method to classify an output state. |
colorize |
Returns a colored string depending on a color identifier (G, Y, R, M, C, B). |
get_speed |
Calculate and return the average speed of the glitching campaign (glitches per second). |
__init__()
Default constructor. Does nothing in this case.
classify(state)
staticmethod
Template method to classify an output state. Overload this class if you want to customize the targets response classification. Alternatively, use the built-in class GlitchState to characterize the targets responses. Remember to define certain response states depending on the possible responses. See class STM32Bootloader for an example.
from findus import PicoGlitcher
from findus.STM32Bootloader import STM32Bootloader
glitcher = PicoGlitcher()
...
programmer = STM8Programmer(port=self.args.target, baud=115200)
...
state = programmer.bootloader_enter()
...
glitcher.classify(state)
colorize(s, color)
staticmethod
Returns a colorized string depending on a color identifier (G, Y, R, M, C, B, O, Z).
| Parameters: |
|
|---|
Returns: Returns the colorized string.
get_speed(start_time, number_of_experiments)
staticmethod
Calculate and return the average speed of the glitching campaign (glitches per second).
| Parameters: |
|
|---|
Returns: Returns the average number of experiments per second.
Helper
Helper class that provides useful functions. Example usage:
from findus import Helper as helper
filename = f"{helper.timestamp()}_memory_dump.bin"
Methods:
| Name | Description |
|---|---|
timestamp |
Provides the current timestamp in a file-friendly format. |
arange(start, stop=None, step=1.0)
staticmethod
Return evenly spaced values within a given interval. Equivalent to numpy's arange function.
| Parameters: |
|
|---|
| Returns: |
|
|---|
linspace(start, stop, num, endpoint=True)
staticmethod
Generate equidistant points from a start to a stop point. Equivalent to numpy's linspace function.
| Parameters: |
|
|---|
| Returns: |
|
|---|
timestamp()
staticmethod
Provides the current timestamp in a file-friendly format.
| Returns: |
|
|---|
PicoGlitcher
Bases: Glitcher
Class giving access to the functions of the Pico Glitcher. Derived from Glitcher class. For an example, connect the Pico Glitcher as follows:
- Remove any capacitors on your target device that could infere with the glitch.
- Set the desired output voltage
VTARGETwith the micro switch. - Connect
VTARGETwith the voltage input of your target (VCC). - Connect the
GLITCHoutput (either the SMA connector or the pin header) to an appropriate target pin, for exampleVCC. - Connect the
RESEToutput with the target's reset input. - Connect the
RESETline with theTRIGGERinput.
Code snippet:
from findus import PicoGlitcher
glitcher = PicoGlitcher()
glitcher.init(port="/dev/ttyACM0", ext_power="/dev/ttyACM1", ext_power_voltage=3.3)
# set up database, define delay and length
...
# one shot glitching
glitcher.arm(delay, length)
# reset target for 0.01 seconds (the rising edge on reset line triggers the glitch)
glitcher.reset_target(0.01)
# read the response from the device (for example UART, SWD, etc.)
response = ...
# classify the response and put into database
color = glitcher.classify(response)
database.insert(experiment_id, delay, length, color, response)
Methods:
| Name | Description |
|---|---|
__init__ |
Default constructor. Does nothing in this case. |
init |
Default initialization procedure. |
arm |
Arm the Pico Glitcher and wait for trigger condition. |
block |
Block the main script until trigger condition is met. Times out. |
reset |
Reset the target via the Pico Glitcher's |
release_reset |
Release the reset to the target via the Pico Glitcher's |
power_cycle_target |
Power cycle the target via the Pico Glitcher |
power_cycle_reset |
Power cycle and reset the target via the Pico Glitcher |
reset_and_eat_it_all |
Reset the target and flush the serial buffers. |
reset_wait |
Reset the target and read from serial. |
set_lpglitch |
Enable low-power MOSFET for glitch generation. |
set_hpglitch |
Enable high-power MOSFET for glitch generation. |
rising_edge_trigger |
Configure the Pico Glitcher to trigger on a rising edge on the |
uart_trigger |
Configure the Pico Glitcher to trigger when a specific byte pattern is observed on the |
set_cpu_frequency |
Set the CPU frequency of the Raspberry Pi Pico. |
get_cpu_frequency |
Get the current CPU frequency of the Raspberry Pi Pico. |
__del__ |
Default deconstructor. Disconnects Pico Glitcher. |
__init__()
Default constructor. Does nothing in this case.
apply_calibration(vhigh, vlow, store=True)
Calculate and store the offset and gain parameters that were determined by the calibration routine. These values are stored in config.json and must be re-calculated if the config is overwritten.
| Parameters: |
|
|---|
arm(delay, length, number_of_pulses=1, delay_between=0)
Arm the Pico Glitcher and wait for the trigger condition. The trigger condition can either be when the reset on the target is released or when a certain pattern is observed in the serial communication.
| Parameters: |
|
|---|
arm_adc()
Arm the ADC on pin 26 and capture ADC samples if the trigger condition is met. On Pico Glitcher hardware version 1, the separate SMA connector labeled Analog can be used to measure analog voltage traces. On revision 2, the analog input is directly connected to the GLITCH line.
arm_double(delay1, length1, delay2, length2)
Arm the Pico Glitcher and wait for the trigger condition. The trigger condition can either be when the reset on the target is released or when a certain pattern is observed in the serial communication. This functions emits two glitches after a given time, each measured separately from the trigger condition.
Be sure that delay2 > delay1 + length1.
| Parameters: |
|
|---|
arm_multiplexing(delay, mul_config, vinit='config')
Arm the Pico Glitcher and wait for the trigger condition. The trigger condition can either be when the reset on the target is released or when a certain pattern is observed in the serial communication. Only available for hardware revision 2 and later.
| Parameters: |
|
|---|
arm_pulseshaping_from_config(delay, ps_config)
Arm the Pico Glitcher and wait for the trigger condition. The trigger condition can either be when the reset on the target is released or when a certain pattern is observed in the serial communication. Only available for hardware revision 2 and later. Additionally, the Pulse Shaping Expansion board is needed.
| Parameters: |
|
|---|
Example:
ps_config = [[4*length, 1.8], [4*length, 0.95], [length, 0.0]]
glitcher.arm_pulseshaping_from_config(delay, ps_config)
arm_pulseshaping_from_lambda(delay, ps_lambda, pulse_number_of_points)
Arm the Pico Glitcher and wait for the trigger condition. Generate the pulse from a lambda function depending on the time.
| Parameters: |
|
|---|
Example:
ps_lambda = f"lambda t:-1.0/({2*length})*t+3.0 if t<{2*length} else 2.0 if t<{4*length} else 0.0 if t<{5*length} else 3.0"
glitcher.arm_pulseshaping_from_lambda(delay, ps_lambda, 6*length)
arm_pulseshaping_from_list(delay, pulse)
Arm the Pico Glitcher and wait for the trigger condition. Genereate the pulse from a raw array of values.
| Parameters: |
|
|---|
Example:
pulse = [-0x1fff] * 50 + [-0x0fff] * 50 + [-0x07ff] * 50 + [0x0000] * 50
glitcher.arm_pulseshaping_from_list(delay, pulse)
arm_pulseshaping_from_spline(delay, xpoints, ypoints)
Arm the Pico Glitcher and wait for the trigger condition. The pulse definition is given by time and voltage points. Intermediate values are interpolated.
| Parameters: |
|
|---|
Example:
xpoints = [0, 100, 200, 300, 400, 500, 515, 520]
ypoints = [3.0, 2.1, 2.0, 2.0, 1.7, 0.0, 2.0, 3.0]
glitcher.arm_pulseshaping_from_spline(delay, xpoints, ypoints)
block(timeout=1.0)
Block until trigger condition is met. Raises an exception if times out.
| Parameters: |
|
|---|
change_config_and_apply(key, value)
Change the content of the configuration file config.json. Note that the value to be changed must already exist. Apply the values afterwards without reset by calling glitcher.switch_pio(1). This will re-initialize the internal statemachines and apply the configuration.
| Parameters: |
|
|---|
change_config_and_reset(key, value)
Change the content of the configuration file config.json. Note that the value to be changed must already exist. After calling this function, the Pico Glitcher must be re-initialized (call glitcher.init(port=args.rpico, ext_power=args.power, ext_power_voltage=3.3) again).
| Parameters: |
|
|---|
check_glitch()
Check if the glitch was emitted.
| Returns: |
|
|---|
clean_init()
Re-initialize the Pico Glitcher on the fly. Can be used to make changes to the configuration on the fly.
cleanup_pio()
Remove all programs from the internal statemachines. Could be necessary before a program is added to the statemachine but it is out of memory. Some weird behavior was observed when removing and adding programs to the statemachines. Use with caution.
configure_adc(number_of_samples=1024, sampling_freq=500000)
Configure the onboard ADC of the Pico Glitcher.
| Parameters: |
|
|---|
configure_gpio_out(pin_number)
Configure the GPIO pin pin_number as an output.
| Parameters: |
|
|---|
disable_vtarget()
Disable the Pico Glitcher's VTARGET output.
do_calibration(vhigh)
Emit a calibration pulse with the Pico Glitcher Pulse Shaping expansion board to determine vhigh and vlow. These parameters are used to calculate the offset and gain parameters of the DAC.
| Parameters: |
|
|---|
edge_count_trigger(pin_trigger='default', number_of_edges=2, edge_type='rising')
Configure the Pico Glitcher to trigger after a certain number of eddges on the TRIGGER line.
| Parameters: |
|
|---|
enable_vtarget()
Enable the Pico Glitcher's VTARGET output.
falling_edge_trigger(pin_trigger='default', dead_time=0, pin_condition='default', condition='rising')
Configure the Pico Glitcher to trigger on a falling edge on the TRIGGER line with optional trigger suppression (dead time).
| Parameters: |
|
|---|
get_adc_samples(timeout=1.0)
Read back the captured ADC samples.
get_cpu_frequency()
Get the current CPU frequency of the Raspberry Pi Pico.
| Returns: |
|
|---|
get_power_supply()
To control the external power supply in a script, the power_supply object is necessary.
| Returns: |
|
|---|
hard_reset()
Perform a hard reset of the Pico Glitcher (Raspberry Pi Pico).
init(port, ext_power=None, ext_power_voltage=3.3, enable_vtarget=True)
Default initialization procedure of the Pico Glitcher. Default configuration is:
- Set the trigger input to rising-edge trigger on
TRIGGERinput and assume triggering when the reset is released. - Set a dead time that prohibits triggering within a certain time (trigger rejection). This is intended to exclude false trigger conditions.
- Use the low-power crowbar MOSFET as default.
| Parameters: |
|
|---|
initiate_reset()
Initiate the reset of the target via the Pico Glitcher's RESET output.
power_cycle_reset(power_cycle_time=0.2)
Power cycle and reset the target via the Pico Glitcher VTARGET and RESET output. Optionally the multiplexing stage can be used to power-cycle the target. Can also be used to define sharper trigger conditions via the RESET line. Depending on the glitch configuration (crowbar, multiplexing, pulse-shaping), the power-cycle is performed with either the crowbar, multiplexing or pulse-shaping stage.
| Parameters: |
|
|---|
power_cycle_target(power_cycle_time=0.2)
Power cycle the target via the Pico Glitcher VTARGET output or optionally via the multiplexing stage. Depending on the glitch configuration (crowbar, multiplexing, pulse-shaping), the power-cycle is performed with either the crowbar, multiplexing or pulse-shaping stage.
If available, target is power-cycled by the external power supply RD6006.
| Parameters: |
|
|---|
release_reset()
Release the reset of the target via the Pico Glitcher's RESET output.
reset(reset_time=0.2)
Reset the target via the Pico Glitcher's RESET output. This function is the same as reset_target. Left in for downward compatibility.
| Parameters: |
|
|---|
reset_and_eat_it_all(target, target_timeout=0.3)
Reset the target via the Pico Glitcher's RESET output and flush the serial buffers.
| Parameters: |
|
|---|
reset_target(reset_time=0.2)
Reset the target via the Pico Glitcher's RESET output.
| Parameters: |
|
|---|
reset_wait(target, token, reset_time=0.2, debug=False)
Reset the target via the Pico Glitchers's RESET output and wait until the target responds (read from serial).
| Parameters: |
|
|---|
| Returns: |
|
|---|
rising_edge_trigger(pin_trigger='default', dead_time=0, pin_condition='default', condition='rising')
Configure the Pico Glitcher to trigger on a rising edge on the TRIGGER line with optional trigger suppression (dead time).
| Parameters: |
|
|---|
set_cpu_frequency(frequency=200000000)
Set the CPU frequency of the Raspberry Pi Pico.
| Parameters: |
|
|---|
set_ext_mosfet(*pin)
Enable glitch generation on a given GPIO output. Could be used generate glitches by an external MOSFET.
| Parameters: |
|
|---|
set_gpio(pin_number, value)
Set the GPIO pin pin_number to a specific output value (0 or 1).
| Parameters: |
|
|---|
set_hpglitch()
Enable the high-power crowbar MOSFET for glitch generation.
The glitch output is an SMA-connected output line that is normally connected to a target's power rails. If this setting is enabled, a high-powered MOSFET shorts the power-rail to ground when the glitch module's output is active.
set_lpglitch()
Enable the low-power crowbar MOSFET for glitch generation.
The glitch output is an SMA-connected output line that is normally connected to a target's power rails. If this setting is enabled, a low-powered MOSFET shorts the power-rail to ground when the glitch module's output is active.
set_multiplexing()
Enables the multiplexing mode of the Pico Glitcher version 2 to quickly switch between different voltage levels.
set_mux_voltage(voltage)
TODO
set_pulseshaping(vinit=1.8)
Enables the pulse-shaping mode of the Pico Glitcher version 2 to apply a voltage profile to the target's supply voltage.
| Parameters: |
|
|---|
switch_pio(pio_base)
In some rare cases, it might be necessary to switch to the other internal statemachine. For example, if a change in the glitch configuration is necessary but the statemachine is out of memory. Instead of removing the programs from the statemachine (cleanup_pio), one can simply switch to the other statemachine and setup the Pico Glitcher to use the configuration on the second statemachine.
| Parameters: |
|
|---|
tio_trigger(pin_trigger='default', edge_type='rising')
Configure the Pico Glitcher to trigger on a rising or falling edge on the TRIGGER line.
| Parameters: |
|
|---|
uart_trigger(pattern, baudrate=115200, number_of_bits=8, pin_trigger='default')
Configure the Pico Glitcher to trigger when a specific byte pattern is observed on the TRIGGER line.
| Parameters: |
|
|---|
waveform_generator(frequency, gain, waveid)
The Pulse Shaping expansion board of the Pico Glitcher v2 can be used to generate arbitrary and continous waveforms as well.
| Parameters: |
|
|---|
- sine wave:
waveid = 0 - cosine wave:
waveid = 1 - triangle:
waveid = 2 - positive sawtooth:
waveid = 3 - negative sawtooth:
waveid = 4
Serial
Class to manage serial connections more easily. Example usage:
# import Serial from findus
from findus import Serial
ser = Serial(port="/dev/ttyUSB0")
ser.write(b'\x7f')
...
result = ser.read(3)
Methods:
| Name | Description |
|---|---|
__init__ |
Default constructor. |
write |
Write data out via the serial interface. |
read |
Read data from the serial interface. |
reset |
Reset target via DTR pin and flush data lines. |
flush |
Flush data buffers. |
flush_v2 |
Flush serial data buffers with timeout. |
close |
Close serial connection. |
__init__(port='/dev/ttyUSB0', baudrate=115200, timeout=0.1, bytesize=8, parity='N', stopbits=1)
init: Default constructor.
| Parameters: |
|
|---|
close()
Close serial connection.
flush()
Flush serial data buffers.
flush_v2(timeout=0.01)
Flush serial data buffers with timeout.
| Parameters: |
|
|---|
init()
Initializes the serial connection. Can be called again, if the connection was closed previously.
read(length)
Read length bytes from the serial port. If a timeout is set it may return fewer characters than requested. With no timeout it will block until the requested number of bytes is read.
| Parameters: |
|
|---|
Returns: Bytes read from the port.
read_until(expected='\n', size=None)
Read until an expected sequence is found (\n by default), the size is exceeded or until timeout occurs. If a timeout is set it may return fewer characters than requested. With no timeout it will block until the requested number of bytes is read.
| Parameters: |
|
|---|
| Returns: |
|
|---|
readline()
Read up to one line, including the \n at the end.
| Returns: |
|
|---|
reset(debug=False)
Reset target via DTR pin and flush data lines. Can be used alternatively to the reset lines of the Pico Glitcher (or ChipWhisperer Husky, or ChipWhisperer Pro) to reset the target. This function is the same as reset_target. Left in for downward compatibility.
| Parameters: |
|
|---|
reset_target(debug=False)
Reset target via DTR pin and flush data lines. Can be used alternatively to the reset lines of the Pico Glitcher (or ChipWhisperer Husky, or ChipWhisperer Pro) to reset the target.
| Parameters: |
|
|---|
write(message)
Write the bytes data to the port. This should be of type bytes (or compatible such as bytearray or memoryview). Unicode strings must be encoded (e.g. 'hello'.encode('utf-8').
| Parameters: |
|
|---|
Returns: Number of bytes written.
This is the documentation of the PicoGlitcher module and all its classes.
Upload this module onto your Pico Glitcher. The classes and methods will become available through the pyboard interface.
PicoGlitcher
Class that contains the code to access the hardware of the Pico Glitcher.
__change_config(key, value)
Change the content of the configuration file config.json. Note that the value to be changed must already exist.
| Parameters: |
|
|---|
__init__()
Default constructor.
Initializes the Pico Glitcher with the default configuration.
- Disables VTARGET
- Enables the low-power MOSFET for glitching
- Configures the Pico Glitcher to use the rising-edge triggger condition.
apply_calibration(vhigh, vlow, store=True)
Calculate and store the offset and gain parameters that were determined by the calibration routine. These values are stored in config.json and must be re-calculated if the config is overwritten.
| Parameters: |
|
|---|
arm(delay, length, number_of_pulses=1, delay_between=0)
Arm the Pico Glitcher and wait for the trigger condition. The trigger condition can either be when the reset on the target is released or when a certain pattern is observed in the serial communication.
| Parameters: |
|
|---|
arm_adc()
Arm the ADC on pin 26 and capture ADC samples if the trigger condition is met. On Pico Glitcher hardware version 1, the separate SMA connector labeled Analog can be used to measure analog voltage traces. On revision 2, the analog input is directly connected to the GLITCH line.
arm_double(delay1, length1, delay2, length2)
Arm the Pico Glitcher and wait for the trigger condition. The trigger condition can either be when the reset on the target is released or when a certain pattern is observed in the serial communication. This functions emits two glitches after a given time, each measured separately from the trigger condition.
Be sure that delay2 > delay1 + length1.
| Parameters: |
|
|---|
arm_multiplexing(delay, mul_config, vinit='config')
Arm the Pico Glitcher in multiplexing mode and wait for the trigger condition.
| Parameters: |
|
|---|
arm_pulseshaping_from_config(delay, ps_config)
Arm the Pico Glitcher and wait for the trigger condition. The pulse is defined via a configuration similar to multiplexing (without interpolation):
| Parameters: |
|
|---|
arm_pulseshaping_from_lambda(delay, ps_lambda, pulse_number_of_points)
Arm the Pico Glitcher and wait for the trigger condition. Generate the pulse from a lambda function depending on the time.
| Parameters: |
|
|---|
arm_pulseshaping_from_list(delay, pulse)
Arm the Pico Glitcher and wait for the trigger condition. Genereate the pulse from a raw array of values.
| Parameters: |
|
|---|
arm_pulseshaping_from_spline(delay, xpoints, ypoints)
Arm the Pico Glitcher and wait for the trigger condition. The pulse definition is given by time and voltage points. Intermediate values are interpolated.
| Parameters: |
|
|---|
block(timeout)
Block until trigger condition is met. Raises an exception if times out.
| Parameters: |
|
|---|
change_config_and_apply(key, value)
Change the content of the configuration file config.json. Note that the value to be changed must already exist. Apply the values afterwards.
| Parameters: |
|
|---|
change_config_and_reset(key, value)
Change the content of the configuration file config.json. Note that the value to be changed must already exist. Reset the Pico Glitcher.
| Parameters: |
|
|---|
check_glitch()
Check if the glitch was emitted.
| Returns: |
|
|---|
configure_adc(number_of_samples=1024, sampling_freq=500000)
Configure the onboard ADC of the Pico Glitcher.
| Parameters: |
|
|---|
disable_vtarget()
Disables VTARGET output. Disables the Pico Glitcher's power supply for the target.
do_calibration(vhigh)
Emit a calibration pulse with that can be used to determine vhigh and vlow. These parameters are used to calculate the offset and gain parameters of the DAC.
| Parameters: |
|
|---|
enable_vtarget()
Enable VTARGET output. Activates the Pico Glitcher's power supply for the target.
get_adc_samples(timeout=1.0)
Read back the captured ADC samples.
get_firmware_version()
Get the current firmware version. Can be used to check if the current version is compatible with findus.
| Returns: |
|
|---|
get_frequency()
Get the current CPU frequency of the Raspberry Pi Pico.
| Returns: |
|
|---|
hard_reset()
Perform a hard reset of the Pico Glitcher (Raspberry Pi Pico).
initiate_reset()
Reset the target via the Pico Glitcher's RESET output.
power_cycle_reset(power_cycle_time=0.2)
Power cycle and reset the target via the Pico Glitcher VTARGET and RESET output. Optionally the multiplexing stage can be used to power-cycle the target. Can also be used to define sharper trigger conditions via the RESET line.
| Parameters: |
|
|---|
power_cycle_target(power_cycle_time=0.2)
Power cycle the target via the Pico Glitcher VTARGET output.
| Parameters: |
|
|---|
release_reset()
Release the reset on the target via the Pico Glitcher's RESET output.
reset_target(reset_time=0.01)
Reset the target via the Pico Glitcher's RESET output, release the reset on the target after a certain time.
| Parameters: |
|
|---|
set_baudrate(baud=115200)
Set the baudrate of the UART communication in UART-trigger mode.
| Parameters: |
|
|---|
set_dead_zone(dead_time=0, pin_condition='default', condition='rising')
Set a dead time that prohibits triggering within a certain time (trigger rejection). This is intended to exclude false trigger conditions. Can also be set to 0 to disable this feature.
| Parameters: |
|
|---|
set_ext_mosfet(pin=Globals.EXT_GLITCH)
Enable the external mosfet triggering on GPIO19
set_frequency(frequency=200000000)
Set the CPU frequency of the Raspberry Pi Pico.
| Parameters: |
|
|---|
set_hpglitch()
Enable the high-power crowbar MOSFET for glitch generation.
The glitch output is an SMA-connected output line that is normally connected to a target's power rails. If this setting is enabled, a low-powered MOSFET shorts the power-rail to ground when the glitch module's output is active.
set_lpglitch()
Enable the low-power crowbar MOSFET for glitch generation.
The glitch output is an SMA-connected output line that is normally connected to a target's power rails. If this setting is enabled, a low-powered MOSFET shorts the power-rail to ground when the glitch module's output is active.
set_multiplexing()
Enables the multiplexing mode of the Pico Glitcher version 2 to switch between different voltage levels.
set_number_of_bits(number_of_bits=8)
Set the number of bits of the UART communication in UART-trigger mode.
| Parameters: |
|
|---|
set_number_of_edges(number_of_edges=2)
Set the number of edges after which the Pico Glitcher triggers in edge-counting trigger mode.
| Parameters: |
|
|---|
set_pattern_match(pattern)
Configure the Pico Glitcher to trigger when a specific byte pattern is observed on the RX line (TRIGGER pin).
| Parameters: |
|
|---|
set_pulseshaping(vinit=1.8)
Enables the pulse-shaping mode of the Pico Glitcher version 2 to emit a pre-defined voltage pulse on the Pulse Shaping expansion board.
set_trigger(mode='tio', pin_trigger='default', edge_type='rising')
Configures the Pico Glitcher which triggger mode to use.
In "tio"-mode, the Pico Glitcher triggers on a rising edge on the TRIGGER pin.
If "uart"-mode is chosen, the Pico Glitcher listens on the TRIGGER pin and triggers if a specific byte pattern in the serial communication is observed. In "edge"-mode, the Pico Glitcher counts the number of edges and triggers if a certain number of edges were observed. The parameter edge_type should be ignored if "uart"-mode is selected.
| Parameters: |
|
|---|
GeneticAlgorithm
This module includes all classes and functions that are necessary to search for optimal parameters in a multidimenstional parameter space.
GeneticAlgorithm
Class representing a Genetic Algorithm for optimizing a given problem.
__init__(parameterspace, population, health_malus_factor=1)
Initializes the Genetic Algorithm with a parameterspace, population, and an optional health malus factor.
| Parameters: |
|
|---|
get_bins_from_genom(parameters)
Converts a list of parameters into a list of bins based on the parameterspace.
| Parameters: |
|
|---|
| Returns: |
|
|---|
get_max_health()
Calculate the maximum health possible for an individual based on the population's genom length and the weights in the parameter space.
| Returns: |
|
|---|
get_parameterspace()
Returns the parameterspace.
| Returns: |
|
|---|
get_population()
Returns the population.
| Returns: |
|
|---|
health_function(parameters)
Calculates the health of an individual:
health = Sum(weight_i) - factor * malus * Sum(weight_i)
health = (1 - factor * malus) * Sum(weight_i)
| Parameters: |
|
|---|
run(threshold)
Runs the simulation until an individual's health meets or exceeds a certain threshold.
| Parameters: |
|
|---|
| Returns: |
|
|---|
step()
Perform one step of the simulation by updating the population, performing breeding, mutation, replacing weak individuals, and killing old individuals.
| Returns: |
|
|---|
Individual
This class represents an individual with parameters, health, maximum age, and current age.
| Attributes: |
|
|---|
get_age()
Get the current age of the entity.
| Returns: |
|
|---|
get_genom()
Get the parameters (genom) of the entity.
| Returns: |
|
|---|
get_health()
Get the health of the entity.
| Returns: |
|
|---|
get_max_age()
Get the maximum age of the entity.
| Returns: |
|
|---|
increase_age()
Increase the age of the entity by one.
set_genom(parameters)
Set the parameters (genom) for the entity.
| Parameters: |
|
|---|
set_health(health)
Set the health of the entity.
| Parameters: |
|
|---|
OptimizationController
Wrapper class for initializing parameter space binning and using the genetic algorithm to search for optimal paramters.
Methods:
| Name | Description |
|---|---|
__init__ |
Constructor of the OptimizationController. Parameter boundaries and parameter divisions must be provided. Parameters for the genetic algorithm are optional. |
print_best_performing_bins |
Output the best performing parameter space bins. In these bins a successful glitch is assumed. |
step |
Perform the next step of the genetic algorithm; should be called before every experiment. |
add_experiment |
Add the parameters and the outcome (weights) to the parameter space. |
__init__(parameter_boundaries, parameter_divisions, number_of_individuals=10, length_of_genom=20, malus_factor_for_equal_bins=1)
Constructor of the OptimizationController. Parameter boundaries and parameter divisions must be provided. Parameters for the genetic algorithm are optional.
| Parameters: |
|
|---|
add_experiment(weight, *parameter)
Method to add the parameters and the outcome (weights) to the parameter space. Can be used similarly to the method Database.insert().
| Parameters: |
|
|---|
print_best_performing_bins()
Method that prints an overview of the best performing bins of the parameterspace. Can be called from time to time to obtain an overview of the optimization process.
step()
Perform the next step in the optimization process. Should be called before the next experiment.
| Returns: |
|
|---|
Parameterspace
__init__(parameter_boundaries, parameter_divisions)
Initializes the class with the given parameter boundaries and divisions.
| Parameters: |
|
|---|
| Raises: |
|
|---|
add_experiment(weight, *parameter)
Add experiment data to the dataset. This function adds an experiment to the dataset with the given weight and parameters. It checks if each parameter is within the specified boundaries. If any parameter is out of bounds, it prints an error message and returns without adding the experiment. Otherwise, it assigns the experiment to a bin and updates the weight for that bin.
| Parameters: |
|
|---|
| Returns: |
|
|---|
get_bin_assignment(*parameter)
This function assigns a bin to each parameter based on its value.
| Parameters: |
|
|---|
| Returns: |
|
|---|
get_bin_numbers_sorted_by_weights()
Returns a list of bin numbers sorted by their corresponding weights.
| Returns: |
|
|---|
get_boundaries(bin_assignment)
Returns the boundaries for a given bin assignment.
| Parameters: |
|
|---|
| Returns: |
|
|---|
get_boundaries_from_coordinates(coordinates)
This function calculates the boundaries for each parameter based on the given coordinates.
| Parameters: |
|
|---|
| Returns: |
|
|---|
get_cardinality()
Returns the cardinality of the set.
get_coordinates(bin_assignment)
This function calculates the coordinates of a given bin assignment in a multi-dimensional binning system.
| Parameters: |
|
|---|
| Returns: |
|
|---|
| Raises: |
|
|---|
get_weights()
Returns the list of weights per bin.
| Returns: |
|
|---|
Population
A class to represent a population of individuals.
__init__(number_of_individuals, length_of_genom)
Initializes a new population with a given number of individuals and genom length.
| Parameters: |
|
|---|
breed(i, j)
Breeds two individuals and returns a new individual with a genom that is a combination of the two parents.
| Parameters: |
|
|---|
| Returns: |
|
|---|
generate_random_individual()
Generates a random individual with a genom of length 'length_of_genom'.
| Returns: |
|
|---|
get_individuals()
Returns a list of all individuals in the population.
| Returns: |
|
|---|
get_length_of_genom()
Returns the length of the genom for each individual.
| Returns: |
|
|---|
get_number_of_individuals()
Returns the number of individuals in the population.
| Returns: |
|
|---|
increase_age_of_population()
Increases the age of each individual in the population.
kill_and_replace()
Removes individuals from the population that have exceeded their maximum age and replaces them with random individuals.
mutate(i)
Mutates the genom of the individual at the given index.
| Parameters: |
|
|---|
| Returns: |
|
|---|
replace(i, individual)
Replaces the individual at the given index with the given individual.
| Parameters: |
|
|---|
replace_with_random(i)
Replaces the individual at the given index with a random individual.
| Parameters: |
|
|---|
set_individuals(individuals)
Sets the population to the given list of individuals.
| Parameters: |
|
|---|
sort_by_health()
Sorts the population by the health of each individual.
update_health(health_function)
Updates the health of each individual in the population using the given health function.
| Parameters: |
|
|---|
DebugInterface
Class to interact with the target device using OpenOCD and GDB.
__del__()
Destructor method called when the object is about to be garbage collected. Detaches the debugger by printing a message and invoking the detach method.
__init__(interface='stlink', interface_config=None, target='stm32l0', target_config=None, transport='hla_swd', gdb_exec='arm-none-eabi-gdb', adapter_serial=None, gdb_port=3333, telnet_port=4444, tcl_port=6666)
Initializes the OpenOCD configuration with default values or custom values provided.
| Parameters: |
|
|---|
__parse_register_string(input_string)
Parses a custom formatted string into a dictionary containing a list of register values.
The input string follows the pattern: ^done,register-values=[{number="0",value="0x0"}, ...]
| Parameters: |
|
|---|
| Returns: |
|
|---|
attach(delay=0.1)
Attaches to the OpenOCD server.
| Parameters: |
|
|---|
characterize(response, mem)
Characterizes the response based on the memory content.
| Parameters: |
|
|---|
| Returns: |
|
|---|
detach()
Detaches from the current debugging session by terminating and closing the necessary processes and socket.
extract_memory_content(response, address=0)
Extracts memory content from the response.
| Parameters: |
|
|---|
| Returns: |
|
|---|
format_bytes(value)
staticmethod
Wandelt einen String-Wert so um, dass er nach dem '0x'-Präfix mindestens 4 Hex-Ziffern lang ist.
gdb_init(timeout=1.0, verbose=False)
Init the gdb debug session.
| Parameters: |
|
|---|
gdb_interrupt_disconnect(timeout=0.3, halt_target=True, verbose=False)
Disconnects the GDB target and exits the GDB process.
| Parameters: |
|
|---|
gdb_load_exec(elf_image='program.elf', timeout=0.3, verbose=False)
Load and execute an ELF image using GDB.
| Parameters: |
|
|---|
gdb_read_register_names()
Connects to the microcontroller over openocd and gdb and extracts the available registers.
| Returns: |
|
|---|
gdb_read_registers(timeout=1.0, verbose=False)
Read the current register values.
| Parameters: |
|
|---|
kill_process(port, verbose=False)
Kill the process that is using the specified port.
| Parameters: |
|
|---|
load_exec(elf_image='program.elf', sp=536879104, pc=536874916, verbose=False)
Load image to RAM and execute. Attention: Program must also be compiled to be compatible to run in RAM.
| Parameters: |
|
|---|
lock_target(verbose=False, overwrite_target_name='')
Locks the target (activates RDP).
mi(cmd, verbose=False)
Sends a GDB command through the GDB process.
| Parameters: |
|
|---|
mi_wait_done(timeout=1.0, ok_prefixes=('^done', '^running', '^connected'), verbose=False)
Wait for a GDB MI command to complete with a timeout.
| Parameters: |
|
|---|
| Raises: |
|
|---|
program_target(glitcher=None, elf_image='program.elf', unlock=True, rdp_level=0, power_cycle_time=0.1, overwrite_target_name='', verbose=False)
Main function to program the target. Optionally unlocks the target, writes the ELF image, and adjusts the RDP level.
| Parameters: |
|
|---|
read_address(address)
Read memory content from a specific address using OpenOCD.
| Parameters: |
|
|---|
| Returns: |
|
|---|
read_image(bin_image='memory_dump.bin', start_addr=134217728, length=1024, verbose=False)
Reads an image from the target device's memory and saves it to a binary file.
| Parameters: |
|
|---|
read_option_bytes()
Reads the option bytes from the memory address 0x4002201c for stm32l0, or 0x1FFF7800 for stm32g0 microcontrollers.
| Returns: |
|
|---|
read_pcrop()
Reads the PCROP (Programmable Code Protection Region) value from the option bytes.
| Returns: |
|
|---|
read_rdp()
Reads the RDP (Read Protection) value from the option bytes.
| Returns: |
|
|---|
read_rdp_and_pcrop(verbose=False)
Reads both RDP and PCROP values from the option bytes.
| Parameters: |
|
|---|
| Returns: |
|
|---|
telnet_init()
Establishes a connection to the OpenOCD telnet server and receives initial messages.
telnet_interact(command, read=True, delay_before_read=0.01, verbose=False)
Sends a command via Telnet and receives the response.
| Parameters: |
|
|---|
| Returns: |
|
|---|
telnet_interrupt_disconnect(halt_target=True, shutdown_openocd=True, verbose=False)
Disconnects from the target and exits the telnet process.
| Parameters: |
|
|---|
telnet_parse_registers(input_data)
Parses a string of register names and their hexadecimal values into a dictionary.
| Parameters: |
|
|---|
| Returns: |
|
|---|
telnet_read_address(address)
Reads the memory content at a specified address using Telnet.
| Parameters: |
|
|---|
| Returns: |
|
|---|
telnet_read_image(bin_image='memory_dump.bin', start_addr=134217728, length=1024, verbose=False)
Reads an image from a specified memory address using a telnet connection.
| Parameters: |
|
|---|
telnet_read_memory(start_address, width=32, count=256, halt=True, delay_before_read=0.1, verbose=False)
Read the current register values.
| Parameters: |
|
|---|
telnet_read_register_names()
Connects to the microcontroller over an open openocd connection via telnet and extracts the available registers.
| Returns: |
|
|---|
telnet_read_registers(reg_name_list, halt=True, delay_before_read=0.1, verbose=False)
Read the current register values.
| Parameters: |
|
|---|
test_connection()
Tests the connection to the target device by resetting it.
unlock_target(verbose=False, overwrite_target_name='')
Unlocks the target and removes any read-out protection. Attention: This will erase the targets flash!
write_image(elf_image='program.elf', verbose=False)
Writes an ELF image to the target using OpenOCD.
| Parameters: |
|
|---|
AnalogPlot
Class to easily plot captured voltage traces with the ADC.
Example usage:
from findus.AnalogPlot import AnalogPlot
...
glitcher.configure_adc(number_of_samples=1024, sampling_freq=450_000)
plotter = AnalogPlot(number_of_samples=1024, sampling_freq=450_000)
...
glitcher.arm_adc()
...
samples = glitcher.get_adc_samples()
plotter.update_curve(samples)
__init__(number_of_samples, vref=3.3, sampling_freq=500000, dynamic_range=4096)
Initialize the AnalogPlot object.
| Parameters: |
|
|---|
show()
Show the plot without blocking the program.
update_curve(y)
Update the curve with new data.
| Parameters: |
|
|---|
ExternalPowerSupply
Wrapper class for the RD6006 voltage supply to align function names with the rest of the library. Example usage:
from findus import ExternalPowerSupply
power_supply = ExternalPowerSupply(port="/dev/ttyACM0")
power_supply.set_voltage(ext_power_voltage)
print(power_supply.status())
power_supply.power_cycle_target(power_cycle_time)
Methods:
| Name | Description |
|---|---|
__init__ |
Default constructor. |
status |
Get the status of the voltage supply. |
set_voltage |
Set the voltage. |
enable_vtarget |
Enable voltage output. |
disable_vtarget |
Disable voltage output |
power_cycle_target |
Power cycle the target (disables output, waits a certain time, enables voltage output again). |
__init__(port)
Default constructor.
| Parameters: |
|
|---|
disable_vtarget()
Disable voltage output.
enable_vtarget()
Enable voltage output.
power_cycle_target(power_cycle_time=0.2)
Power cycle the target (disables output, waits a certain time, enables voltage output again).
| Parameters: |
|
|---|
set_voltage(voltage)
Set the voltage of the power supply.
| Parameters: |
|
|---|
status()
Get the status of the voltage supply.
| Returns: |
|
|---|
GlitchState
Class that combines subclasses for different states. Can be used to classify different responses.
- Error: Enum class for error states.
- Warning: Enum class for warning states.
- OK: Enum class for ok states (no errors).
- Expected: Enum class for expected states.
- Success: Enum class for success states (glitching was successful).
Example usage:
from findus.GlitchState import GlitchState, OKType
def return_ok():
return GlitchState.OK.ack
def main():
response = return_ok()
if issubclass(type(response), OKType):
print("Response was OK.")