nikitalita
commented
5 months ago BTW, this is currently based on 0dfd148 rather than current main. Current main does not build with the chipwhisperer lite firmware in the chipwhisperer repo, as it requires missing functions that are no longer implemented in naeusb. Is there a more up to date version of the cwlite firmware somewhere?
alex-dewar
This PR adds support for ICP programming Nuvoton NuMicro 8051 chips. It is adapted from my work here.
The reason for ICP programming being used here is that, while Nuvoton chips do have an ISP protocol, it requires an LDROM to be loaded onto the chips first. The chips do not come pre-programmed with that and have to be loaded using an ICP tool, and if we have an ICP tool, we can just program the APROM directly. The LDROM also induces substantial latency when booting, which is not really suitable for our purposes, where the chips may be resetting thousands of times during glitch attempts.
The USB wire protocol implementation here is largely derived from the XPROG one; I've tried to conform to the expectations there (putting all responses in the rambuf, putting all transmitted bulk data into the rambuf before programming, etc.)
Since this requires toggling nRST, this requires that AVR ISP be set first.
This should work for all the chips that are supported for the NuMicro CW308 target board, but I have only tested this with the N76E003, the MS51FB9AE, and the MS51FC0AE.
I have the chipwhisperer userland programmer implementation up here, but I'm going to wait until this gets into naeusb before PRing it.
The reason this is a draft is because there are a couple of points that are marked as TODO:
int N51PGM_init(void)(), I want to be able to check to see if we are in AVRISP mode and fail if we aren't, but I do not know how to do that from the firmware.NuvoICP_Reentry_glitch(). What this does is cause the configuration bytes to be loaded at consistent times when entering ICP mode, the idea being that we can potentially glitch a locked chip to boot into ICP mode in an unlocked state. It activates a trigger right before entry (vs. after, because the delay between entry and config load is like two microseconds) so that the config load process can be captured and glitched. However, I don't know how to toggle any of the TIO lines from the firmware, and I don't know if there's a way to manually trigger a glitch from the firmware. Any advice here?