Yay, I have reliable glitching with the BP5 and an Arduino!
Here’s the BP serial console (with notes):
Getting BP connected and set for UART mode:
VT100 compatible color mode? (Y/n)> yScreen Resolution changed
HiZ> m 3
Use previous settings?
UART speed: 115200 baud
Data bits: 8
Parity: None
Stop bits: 1
Hardware flow control: None
Signal inversion: Non-inverted (Standard)
y/n, x to exit (Y) >
Actual speed: 115207 baud
Mode: UART
Running bridge
command while resetting Arduino. Arduino displays a simple power up header, then starts asking for password:
UART> bridge
UART bridge. Press Bus Pirate button to exit.
Test glitch target (victim), v 0.9
### Please enter password ###
Hit the button then run the glitch
command:
UART> glitch
Use previous settings?
Glitch trigger character: 13 (ASCII)
Glitch trigger delay: 1400 ns*10
Glitch vary time: 5 ns*10
Glitch output on time: 10 ns*10
Glitch cycle delay: 100 ms
Normal response character: 80 (ASCII)
Number of glitch attempts: 5
Bypass 'READY' input checking: Bypass enabled ('READY' check disabled)
y/n, x to exit (Y) >
UART glitching. Press Bus Pirate button to exit.
Attempt 1, delay 14000ns RX: $>
Target glitch success!
It glitched past the password on the first attempt!! (I can usually get it within 3 or 4 attempts). go back to bridge
command:
UART> bridge
UART bridge. Press Bus Pirate button to exit.
<executing ...>
$> ls
<executing ls ...>
$>
So, what’s happening here is that I didn’t write a command line interpreter, lol; instead, it just echoes back whatever you enter and gives another $>
prompt. See previous post for info on Arduino firmware, etc.
In the logic analyzer (an external one, not the built-in) channel 0 is TX from the BP, channel 1 is RX from the Arduino, and channel 2 is connected to IO00
, the gate of the glitch transistor:
The setup on my desk:
Note - good thing I ordered 40 FETs; I had to replace it already. I had the glitch time too long at first and burned it up. Ooops.