Any tutorial about glitching

Yay, I have reliable glitching with the BP5 and an Arduino! :partying_face:

Here’s the BP serial console (with notes):

Getting BP connected and set for UART mode:

VT100 compatible color mode? (Y/n)> yScreen Resolution changed
HiZ> m 3


Use previous settings?
 UART speed: 115200 baud
 Data bits: 8 
 Parity: None 
 Stop bits: 1 
 Hardware flow control: None 
 Signal inversion: Non-inverted (Standard) 

y/n, x to exit (Y) > 

Actual speed: 115207 baud
Mode: UART

Running bridge command while resetting Arduino. Arduino displays a simple power up header, then starts asking for password:

UART> bridge
UART bridge. Press Bus Pirate button to exit.
Test glitch target (victim), v 0.9
### Please enter password ###

Hit the button then run the glitch command:

UART> glitch


Use previous settings?
 Glitch trigger character: 13 (ASCII)
 Glitch trigger delay: 1400 ns*10
 Glitch vary time: 5 ns*10
 Glitch output on time: 10 ns*10
 Glitch cycle delay: 100 ms
 Normal response character: 80 (ASCII)
 Number of glitch attempts: 5 
 Bypass 'READY' input checking: Bypass enabled ('READY' check disabled) 

y/n, x to exit (Y) > 

UART glitching.  Press Bus Pirate button to exit.
Attempt   1, delay 14000ns RX: $> 
Target glitch success!

It glitched past the password on the first attempt!! (I can usually get it within 3 or 4 attempts). go back to bridge command:

UART> bridge
UART bridge. Press Bus Pirate button to exit.

	<executing  ...>
$> ls
	<executing ls ...>
$> 

So, what’s happening here is that I didn’t write a command line interpreter, lol; instead, it just echoes back whatever you enter and gives another $> prompt. See previous post for info on Arduino firmware, etc.

In the logic analyzer (an external one, not the built-in) channel 0 is TX from the BP, channel 1 is RX from the Arduino, and channel 2 is connected to IO00, the gate of the glitch transistor:

The setup on my desk:

Note - good thing I ordered 40 FETs; I had to replace it already. I had the glitch time too long at first and burned it up. Ooops.

6 Likes