arXiv demonstrates secure debug re-enablement on RP2350
Original title: Shoot on (Core)Sight: Re-enabling Secure Debug on the RP2350 with Photon-Emission Microscopy and Laser Fault Injection
Photon-emission microscopy and laser fault injection allow re-enabling secure debug on RP2350, restoring sustained access after reset.
Fault-resistant policy storage does not guarantee fault-resistant enforcement on the RP2350A4. Differential photon-emission microscopy narrowed the area for laser scanning, which found two sites where pulses set the DEBUGEN bits enabling core-1 Secure debug. An online attack sequence using only Serial Wire Debug feedback restored sustained access. After rescue reset, the sequence recovered a 128-bit test secret. This reset reloads the secret's runtime page lock from a stored policy that permits Secure reads and prevents user firmware from tightening the lock.
- Two sites found where pulses set DEBUGEN bits.
- Online attack sequence using SWD feedback restored sustained access.
- After rescue reset, 128-bit test secret recovered.
- Reset reloads secret's runtime page lock from stored policy.
From the original article
1 min read at arxiv.orgFault-resistant policy storage does not guarantee fault-resistant enforcement. We demonstrated this distinction on the RP2350A4 using differential photon-emission microscopy (PEM) and laser fault injection (LFI). PEM narrowed the area for laser scanning, which found two sites where pulses set the DEBUGEN bits enabling core~1 Secure debug.
By Antoine Plin · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.