J08nY / pyecsca

Python Elliptic Curve Side-Channel Analysis toolkit.
https://pyecsca.org/
MIT License
56 stars 15 forks source link

Add leakage simulation via Rainbow #19

Closed J08nY closed 1 year ago

J08nY commented 2 years ago

Rainbow: https://github.com/Ledger-Donjon/rainbow can be used to simulate execution of a binary target (like ARM-Cortex M4 or some x86). The simulated execution can then be used for leakage simulation by applying a given leakage function (+ noise).

Concretely, get inspired by: https://github.com/Ledger-Donjon/rainbow/blob/master/examples/CortexM_AES/cortexm_aes.py

# Given a configuration rendered for Platform.STM32F3 at with the elf at `elf_path` this simulates execution of the main method (which cycles indefinitely waiting for serial input).
# Note that the libc __init functions should be called before, etc..
from rainbow.devices.stm32 import rainbow_stm32f215
e = rainbow_stm32f215(sca_mode=True)
e.load(elf_path, typ=".elf")

e.mem_trace = True
e.trace_regs = True

e.start(e.functions["main"], 0)

As the actual chip that ChipWhisperer targets is an STM32F303 (and not an STM32F215 as already in Rainbow), a custom device class for it might be needed. The SVD data for it can be found here and extracted from the XML (.SVD) file. More data on the memory map can be found here or also in the LinkerScript included in the hal directory for the chip.

ddddavidee commented 2 years ago

This is a very nice idea. I tried in the past to implement something similar but I stopped when the binary is dynamically linked to a third-party library (for bigint math, for example)

I'd be interested in having other people ideas and hints on how to emulate a binary depending on external .so files

J08nY commented 2 years ago

This would be used through pyecsca-codegen which generates statically linked binaries for the ARM target case and I am unsure of what it does for binaries targeting the host (x86_64). But no matter what it does I think it could be made to generate statically linked binaries as its only dependency currently is libtommath for bigints (and that has a static .a version). Of course adding more dependencies with some dynamically linked is a whole another bag of worms.

ddddavidee commented 2 years ago

Nice.

I'll try the codegen module!