Cannot find glitches

[Virtual-Java]

Hi Zeus,
got some shelf labels with onboard CC2210 mcu and soldered a mosfet of type IRLML2030 to the side of the board.
The Drain is connected via a 0.2 mm² copper lack wire to the decouple pin of the mcu. The Source is connected to the RP2040 power enable pin and the gate to the "glitching-pin".
Communication to the mcu works since I could successfully reset one test-board to factory defaults.
But after that I tried to get glitching work.

Is my mosfet to slow or has other really poor characteristics?
What (different) hardware can you recommend or which one did you use?

I connected all serial bus communication pins via a RP2040-micro board plugged into a breadboard and connecting the high frequency PWM glitch pin 15 and power enable pin 16 were connected via a female pin socket with 2.54 mm spacing.
A male jumper cable was directly soldered to the mosfets gate on one side and plugged into pin socket no. 15 on the other end directly.

            USB
         |________|
 O>                       O
 O                        O
...                      ...
...        RP2040        ...
 O          micro         O
 O                        O pin 24
      O   O   O   O   O
    |  ||  ||  ||  ||  |
      ^   ^   ^   ^   ^
                  |   |
             pin 15   16

Since i was not able to get a single or even double voltage glitch working with my setup I almost stopped to believe voltage glitching is working at all.
Did you really get it working to read out all the memory of one of these shelf labels?
How can I get the code or read out the memory using your setup?

My friend and I try to find a solution to upload via the builtin OTA bootloader since flashing all shelf labels separately by opening the case and flashing the microcontrollers via a self-made pogo-pin adapter is very time consuming for more than thousand shelf labels in total.

Since the cloud based software delivered with shelf labels is very buggy and does not offer the required interface to change content autonomous via a host software that reads out a database with all the products we want to develop a software that is written in rust.

Then instead of old with a security critical linux version kernel 2.7 from around 2010 and old Ångstrom operation system we want to run it on a modern linux distro like archlinux on a raspberry pi.
Ångstrom OS was already long time out of support even at the time we bought these shelf labels in 2021.

Does somebody of you have a suggestion on how I should improve my setup

• using a different mosfet?

• using a special designed voltage-glitcher board (how high is the probability to successfully reading out the memory and not only wasting money)?

• is it more recommended to buy special hardware like a fpga based voltage glitcher that nearly guaranties you to successfully and reproducible read out all memory?

• Do you think it is possible to

• If so, are there other methods that are easier to flash all the shelf labels with a custom software like this one?
  https://github.com/OpenEPaperLink/Tag_FW_EFR32xG22/blob/main/firmware/readme.md
  https://github.com/OpenEPaperLink/OpenEPaperLink/wiki

[redfast00]

• CC2210 is not the same MCU as I mentioned in my blogpost, so it is possible that it's not vulnerable, or that it's vulnerable to another attack
• the mosfet should be connected to GND directly
• you should remove the DCOUPL capacitor, I think
• the mosfet is probalby fine, but I'm not an expert. When in doubt, replace it
• it's possible that the glitch timing is not consistent, and an FPGA would be better: I didn't have an oscilloscope at the time. However, I think it's fine and no other hardware is needed. A special target board might be useful though: it would cost around 30 EUR shipped, and will make the work a lot easier, since you can just transplant the MCU instead of having to do the targeting work on each board.

Hope this helps, but it's been a while since I touched this.

[redfast00]

Please keep me posted of your progress though!