0

Glitch method: irrelevant for topic of conversation, assume clock injection, voltage glitch, EMFI, "lasers", whatever you like.

Device: For example modern ARM or PPC, or MIPS micros. Assuming you can run code locally.

Can the memory protection units, DMA protections, JTAG limits/protections be accessed improperly with glitching methods? Or is this an avenue that is futile to look into?

Wide topic I know. But are memory and device protections typically hard coded into the "fabric" of a micro where literally the JTAG or DMA CANNOT access this region of memory because there are no "wires" to those regions or are these things state machines and "rules"/"allowances" programmed in? If a DMA or MPU unit can access a protected region, can a well timed glitch help make the decision to expose that data?

When you see a chip has XYZ protections, given the physical constructions of modern chips, how accurate are datasheet claims of memory protection - assuming you have access to run code on a device itself. Or is the process that pulls and delivers a memory request immutable even if you messed with the specs of a chip?

Improve this question

1 Answer 1

Reset to default
1

I think it's important to differentiate security-oriented microcontrollers where advanced security measures are implemented on several levels including physical arrangement of the chip and general-purpose controllers, maybe with some basic security features. I'm going to answer mostly about the latter group.

When a technical reference manual mentions memory protection and MPU, it usually means there are several privilege levels in software. Software being run in "userspace" (I'm using quotes here because this term comes from big operating systems running on big processors) can only access certain regions of memory. However, this protection is implemented by matching the address about to be read/written with a set of allowed addresses. Actual address mapping process may be very complicated, but the important thing is that if the access is not allowed, a particular bus transaction won't even reach the memory interface of peripheral bus.

However, the bus connection doesn't go anywhere. It's still on the chip, but the invalid accesses don't even trigger any change of signals on it.

enter image description here

So, would it be possible to glitch the logic to make invalid accesses valid? Most certainly, and there are several techniques to it. Check out these links:

  1. https://www.cl.cam.ac.uk/~sps32/ECRYPT2011_1.pdf
  2. https://www.cl.cam.ac.uk/~sps32/ECRYPT2011_2.pdf
  3. http://www.quovadislabs.com/projects.html
  4. https://newae.com/tools/chipwhisperer/
Improve this answer
2
  • I'm familiar with glitching techniques. The question comes down to (if you want to use the userspace or trustzone in ARM's case example) is there a statemachine comparing good bad addresses when it comes to memory protection? Or is it just a "hardwired" denial based on the address coming over the bus. If it's the latter, glitching seems unlikely. I am not sure of how these protections a physically made.
    – mint branch conditioner
    Oct 24, 2017 at 22:13
  • "statemachine comparing good bad addresses " is a hardwired solution and it's usually MPU. For most CPU cores, memory access is checked before the transaction reaches the bus on the earlier stages of the pipeline, because otherwise it would slow down the execution.
    – Vladislav Ivanov
    Oct 25, 2017 at 6:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.