Photon-Emission-Guided Laser Fault Injection Enables RP2350 Secure Debug | Ledger Donjon
- TL;DR — Photon-emission microscopy allowed us to locate a register responsible for the enabling of debug features on the Raspberry Pi microcontroller.
- — Laser pulses at two nearby positions then restored debugger access to the chip’s Secure world, even though debug had been permanently disabled.
- — Using that access after a rescue reset, we recovered a secret from one-time-programmable memory.
Unverified
- TL;DR — Photon-emission microscopy allowed us to locate a register responsible for the enabling of debug features on the Raspberry Pi microcontroller.
- — Laser pulses at two nearby positions then restored debugger access to the chip’s Secure world, even though debug had been permanently disabled.
- — Using that access after a rescue reset, we recovered a secret from one-time-programmable memory.
Sources: Ledger