The Raspberry Pi RP2350 microcontroller features hardware security including Armv8-M TrustZone separation of Secure and Non-secure execution states, secure boot authentication, and permanent debug-disable settings. The CRIT1.DEBUG_DISABLE flag is intended to permanently disable debugger access by driving memory access port enable signals to zero. However, researchers from Ledger Donjon identified that the DEBUGEN register provides an override mechanism that can re-enable memory access ports and permit Secure world accesses through them.
To target the DEBUGEN register for fault injection, researchers first used photon-emission microscopy (PEM) to locate the physical position of specific register bits. By running loops that toggled selected DEBUGEN bits and averaging hundreds of camera frames to suppress noise, they created emission maps that identified zones associated with DEBUGEN bits 0-3 within a few micrometers. This localization enabled precise laser fault injection using a 980nm pulsed laser at approximately 1.2W optical power. Within these PEM-identified zones, they calibrated two positions: one that toggled the PROC1 bit (enabling core 1's memory access port) and another that set the PROC1_SECURE bit (permitting Secure accesses through that port). Through iterative pulsing based on Serial Wire Debug feedback, they achieved persistent setting of both bits, restoring Secure debug access despite the permanent debug disable flag.
Illustrates the photon-emission microscopy technique used to localize DEBUGEN register bits within micrometers by suppressing noise through frame averaging.
Depicts the physical localization of DEBUGEN bits 0-3 on the silicon die, enabling precise laser targeting for fault injection.
Demonstrates the transition from photon emission localization to precise laser fault injection targeting, bridging the two-stage attack methodology.
With Secure debug access restored, researchers could read and write Secure memory-mapped resources, halt and single-step cores, and inspect registers, compromising TrustZone runtime isolation. However, the RP2350's challenge configuration still protected the OTP secret through a runtime lock that tightened after firmware execution. To bypass this, they employed a rescue reset technique using the RP-AP's CTRL.RESCUE_RESTART flag, which triggers a full system reset while holding cores in boot-ROM wait paths before user software runs. This prevented firmware from applying the restrictive runtime lock to OTP page 48, allowing extraction of the 128-bit secret from one-time programmable memory. The attack requires physical access, destructive sample preparation (backside decapsulation), and approximately $250,000 of laboratory equipment.
Shows the destructive physical sample preparation required to access the silicon from the backside for both PEM and LFI stages.
Illustrates the approximately $250,000 of specialized laboratory equipment required to execute the photon emission and laser fault injection attack.