Category: Electronics & Production

Hackaday Project and Latest Circuit Cellar Columns

I had entered my side channel analysis project called ChipWhisperer into the Hackaday Prize. I’m honoured to have been selected as one of five finalists! This means lots more work getting everything ready, but should be exciting.

Since my last post, I’ve also published a few more columns in Circuit Cellar. If you aren’t familiar with my Programmable Logic in Practice column, I post some details of it on my dedicated website. I just posted a video for the Dec 2014 column which includes some experiments with metastability on the Xilinx FPGA. Fun times!

EELive! (ESC) Conference Slides + Programs

See my presentation at EELive? If so you can download the slides from:
http://www.newae.com/files/ThinkFastFPGADesignUsing_OFlynn.pdf

And the ISE + Vivado HLS Project from:
http://www.newae.com/files/ThinkFast_FPGA_Files.zip.

You can also check out additional details at the Programmable Logic in Practice post, which includes videos + examples of other uses of HLS.

Making a USB-HID Keyboard Encoder Board for PicoScope

Ever wanted to control something from a knobby-looking USB peripheral? In this example I wanted to control the PicoScope software from a bunch of encoders mounted on a USB peripheral:
Image

Continue reading Making a USB-HID Keyboard Encoder Board for PicoScope

Making a Simple Scope Probe Holder

Interested in a low-cost method of holding a scope probe securely against your PCB board? For this to work you’ll need a scope probe with a spring-loaded tip. I came up with this idea since the PS6000 series scope I was using from PicoScope comes with such probes. The end result looks like this:
Image

Continue reading Making a Simple Scope Probe Holder

Split Ground Plane: Example of failing high-speed signals

Image

I’ve got a SASEBO-W board, which has a FPGA & a FT2232H for high-speed USB comms. I was seeing errors on the high-speed USB device, and couldn’t figure out why:

Image

Power Split

The SASEBO-W is a multi-purpose board including a Xilinx LX150 Spartan 6 FPGA and a FTDI FT2232H USB interface. One use of the board is for measuring the power consumption of the FPGA and using that power consumption to perform power analysis attacks. I believe for this reason the ground planes are split, to facilitate making those measurements.

Continue reading Split Ground Plane: Example of failing high-speed signals

Bed of Nails Test Bed

This is the final product, it can hold a PCB for testing without needing to have soldered any pins to it:
Image

And without the PCB mounted:
Image

I got parts from ebay seller “pingf123”. Parts used were:

“4 Edge Latches for Phototype Test Fixture PCB ICT”
“20 Chisel Spring Loaded Pogo Pin”
“spring loaded guide pin for prototype fixture PCB”

Here are a few of them spread out:
Image

The bottom PCB was drilled & bolts threaded into it (I didn’t have proper taps, but with PCB you are able to thread holes w/o them if you are forceful). The top PCB is drilled to allow the pogo pins to fit through. Getting the height of the pogo pins correct is critical, so this method let me test the height easily. When the height was correct you just screw the bolts through the top PCB to lock it all together.
Image

Soldering the pins in one row at a time. Once this was done I soldered the male headers on the bottom side, and put a lot of epoxy on it. Be careful not to get epoxy anywhere that is supposed to move!
Image

 

JCOP

I recently bought some Smart Cards from [[http://www.smartcardsource.com/contents/en-ca/d9_JCOP-NXP-cards.html and has some comments/issues getting them up and running. They were NXP JCOP Cards, J2A040.

Round 1: GP Shell and Card Personalization

I was using GPShell for my initial tests, you can download from [[http://sourceforge.net/projects/globalplatform/files/|Here. There is a good [[http://sourceforge.net/p/globalplatform/wiki/Home/|Wiki too.

The first test was attempting to list all the things already on the card. The results were less than satisfactory:

C:\>GPShell-1.4.4>GPShell.exe listgp211.txt
mode_211
enable_trace
establish_context
card_connect -readerNumber 1
select -AID a000000003000000
Command -> 00A4040008A000000003000000
Wrapped command -> 00A4040008A000000003000000
Response <- 6A82
select_application() returns 0x80216A82 (6A82: The application to be selected could not be found.)

As it turns out you need to have the cards personalized (or fused) before you can use them. With GP 2.1.1 you can check this with the following script:

mode_211
enable_trace
establish_context
card_connect
select -AID A000000167413000FF
card_disconnect
release_context

Running it gives this result:

C:\GPShell-1.4.4>GPShell.exe jcop_try_this.txt
mode_211
enable_trace
establish_context
card_connect
select -AID A000000167413000FF
Command -> 00A4040009A000000167413000FF
Wrapped command -> 00A4040009A000000167413000FF
Response <- 04310033000000004E5830313143000339F8736A82
select_application() returns 0x80216A82 (6A82: The application to be selected could not be found.)

The key thing to look for in the response is the 15th byte, highlighted below:

04310033000000004E5830313143000339F8736A82

If this is 00 (as here), the card is NOT personalized. You need some secret ‘Transport Key’ to do this personalization. If you just got the card as a 1-off from a vendor you might be SOL.

My vendor sent me a replacement card, as those were presumably incorrectly setup (e.g. SHOULD have been personalized before shipping to me). On to the next part:

Round 2: GP Shell with a Good Card

Alright, now with the good cards we redo the list attempt:

C:\>GPShell-1.4.4>GPShell.exe listgp211.txt
mode_211
enable_trace
establish_context
card_connect -readerNumber 1
select -AID a000000003000000
Command -> 00A4040008A000000003000000
Wrapped command -> 00A4040008A000000003000000
Response <- 6F658408A000000003000000A5599F6501FF9F6E06479100783300734A06072A864886FC6B01600C060A2A864886FC6B02020101630906072A864886FC6B03640B06092A864886FC6B040215650B06092B8510864864020103660C060A2B060104012A026E01029000
open_sc -security 1 -keyind 0 -keyver 0 -mac_key 404142434445464748494a4b4c4d4e4f -enc_key 404142434445464748494a4b4c4d4e4f // Open secure channel
Command -> 80CA006600
Wrapped command -> 80CA006600
Response <- 6985
GP211_get_secure_channel_protocol_details() returns 0x80206985 (6985: Command not allowed - Conditions of use not satisfied.)

Well damn. I don’t want to try this too many times as the card might lock I was worried.

I never figured out how to get GPShell to work, but clearly I’m improving from my initial problems.

Round 3: JCManager

Finally I found JCManager at [[http://www.brokenmill.com/2010/03/java-secure-card-manager/.

The default keys are OK in this. But you need to change the AID address to a000000003000000. With this you can hit ‘Authorize’ and should see something like this:

Open terminal ...
EstablishContext(): ...
Wait for card in a certain reader ...
Pick reader ...
**********************
Selecting Card Manager
***********************
-> 00 A4 04 00 08 A0 00 00 00 03 00 00 00
<- 6F 65 84 08 A0 00 00 00 03 00 00 00 A5 59 9F 65 01 FF 9F 6E 06 47 91 00 78 33 00 73 4A 06 07 2A 86 48 86 FC 6B 01 60 0C 06 0A 2A 86 48 86 FC 6B 02 02 01 01 63 09 06 07 2A 86 48 86 FC 6B 03 64 0B 06 09 2A 86 48 86 FC 6B 04 02 15 65 0B 06 09 2B 85 10 86 48 64 02 01 03 66 0C 06 0A 2B 06 01 04 01 2A 02 6E 01 02 90 00
************
Init Update
*************
-> 80 50 00 00 08 26 6C 8E 3C 10 69 39 05
<- 00 00 12 02 10 25 60 95 66 19 FF 02 00 02 59 8D D3 96 1B FD CC 97 F9 DF 4F 2A 6C E2 90 00
HostChallenge: 26 6C 8E 3C 10 69 39 05
CardChallenge: 59 8D D3 96 1B FD
Card Calculated Card Cryptogram: CC 97 F9 DF 4F 2A 6C E2
Derivation Data is 01 82 00 02 00 00 00 00 00 00 00 00 00 00 00 00
Host Cryptogram Data (to encrypt) 00 02 59 8D D3 96 1B FD 26 6C 8E 3C 10 69 39 05 80 00 00 00 00 00 00 00
Card Cryptogram Data (to encrypt for verification) 26 6C 8E 3C 10 69 39 05 00 02 59 8D D3 96 1B FD 80 00 00 00 00 00 00 00
S_ENC: AD C1 16 3B A2 A1 47 FB B8 4B F4 4C 86 76 FB 7D AD C1 16 3B A2 A1 47 FB
The Current session MAC key is 3E 06 B1 C8 FC FD 78 8A 57 3B 9A 98 89 D0 CA 50
The Current session DEK key is FC 01 09 6B 6D B1 3A DE E0 D4 CB 61 D0 3F D3 AA
Encrypted CardCryptoGram is 4F FC F3 9B 4A 25 56 A2 1B 69 AA 91 D8 E3 D7 44 CC 97 F9 DF 4F 2A 6C E2
Encrypted HostCryptoGram is D8 F5 B8 41 93 59 A6 45 E1 2D 3A 9A 0A 03 13 CD 5F 64 BB 10 3F 4F 87 19
-> 84 82 03 00 10 5F 64 BB 10 3F 4F 87 19 21 48 9B A9 BF 0B F8 34
<- 90 00
Authenticated

 

QTabWidget in PySide Automatically Resize

When using PySide, a QTabWidget is handy. But the size of the QTabWidget is dictated by the largest item, even if it’s not visible.

Let’s assume self.tw is our tab widget. Then add this function:

from PySide.QtCore import *
from PySide.QtGui import *

class MainWindow(QMainWindow):
    def curTabChange(self, index):
        for i in range(self.tw.count()):
            if i == index:
                self.tw.widget(i).setSizePolicy(QSizePolicy.Preferred, QSizePolicy.Preferred)
            else:
                self.tw.widget(i).setSizePolicy(QSizePolicy.Ignored, QSizePolicy.Ignored)

    def myOtherFunction(self):
       etc etc etc

And in your initialization associate it with a tab change event:

self.tw = QTabWidget()
        self.tw.currentChanged.connect(self.curTabChange)

Remember to call self.curTabChange(0) probably too once you load tabs.

AtMega Card (Funcard) SmartCard Programming & Fuse Setup

I recently got an Atmel AtMega163-based smartcard for some side channel experiments, along with a SASEBO-W board. I owe a debt of thanks to Cryptography Research Inc. & Sakura for setting all that up!

Anyway I also got a normal smartcard reader, and wanted to experiment with programming the card & using it in a reader. I’m using SOSSE for these experiments.

It’s worth nothing these cards are pretty old now! They were used a bunch in the hayday of satellite hacking… I don’t know if that’s still going on, but you might be able to pick some up pretty easy. The AtMega163 processor itself was EOLd in 2002 (10 years ago!!), so I’m also sceptical if there are any new ones made. Note you can use any AVR & program it with the SOSSE code, the SmartCard is just a form factor.

Internally, the SmartCard has this schematic:
Image

The pinout of the card contact is looking AT the card. The easy way to figure it out is look for the GND contact, note how it covers the middle part.

What this means is you can use any old AVR programmer. I had a JTAG2 so could use that in ISP mode, although you can find an http://www.makomk.com/2010/02/04/arduino-based-funcard-programmer/|Arduino based Funcard Programmer] too. Remember you can use any AVR programmer that supports the Mega163 (more on this later). Your normal AVR programmer probably has a 6-pin or 10-pin header, so you just map between them.

Note you also need a clock! This is besides the SCK pin – you also need to provide a fast clock into the ‘CLK’ pin. If you have another AVR around program the ‘CLKOUT’ fuse & take the clock on the output pin, that is by far the easiest. Or you can use the timer to generate an output pin (see the Arduino programmer, it does that). Alternatively if you have an AVR with a crystal, you can pick off the XTAL2 (not XTAL1) pin and feed that in. Here is a photo of my setup… I’m using the SASEBO-W board for power. I’ve fed an external clock in (it does provide a clock, but I tri-stated it because I needed the IO lines tri-stated too) from an AVR using the XTAL2 trick. Finally you can see the cable to the programmer:
Image

So what software to program with? avrdude claims to support the Mega163, so you could use that. Although my tests showed it did not work – FLASH couldn’t be verified, and the fuses didn’t read properly (not good – if SafeMode asks you to change fuses back say NO!).

AVRStudio doesn’t support the Mega163. BUT – you can use the Mega363, which is essentially the same part. I used AVR Studio 4 for my programming & verification… worked perfect! Programmed both Fuses & FLASH.

One final problem: my SCR335 card reader didn’t recognize the smartcard. It turns out the default fuses have the clock mode as “Crystal Oscillator, Slowly Rising Power” (see Fuses tab in AVR Studio). While the SmartCard Specs say the Answer To Reset (ATR) needs to occur 400-40000 cycles after the SmartCard reader resets the card & starts the clock. At 67mS delay, that is 268000 cycles! So the SmartCard reader doesn’t even see the ATR, it’s given up already. You need to change the fuse to ‘fast rising power’. I also switched it to ‘Ext. Clock’, as it’s technically the correct option since you don’t have a crystal oscillator (e.g.: you don’t need the XTAL2 output).
Image

Good Luck!