Shoot on (Core)Sight: Re-enabling Secure Debug on the RP2350 with Photon-Emission Microscopy and Laser Fault Injection
Antoine Plin
Abstract
Fault-resistant policy storage does not guarantee fault-resistant enforcement. We demonstrated this distinction on the RP2350A4 using differential photon-emission microscopy (PEM) and laser fault injection (LFI). PEM narrowed the area for laser scanning, which found two sites where pulses set the DEBUGEN bits enabling core~1 Secure debug. An online attack sequence using only Serial Wire Debug (SWD) feedback restored sustained access. After rescue reset, the sequence recovered a 128-bit test secret. This reset reloads the secret's runtime page lock from a stored policy that permits Secure reads and prevents user firmware from tightening the lock.
Create a lesson
Related papers
Integrated Identity Protection for Semantic Communications in Embodied IoT Systems
Yu Zhang, JingQi Liu, Shuangrui Zhao et al.
Signed, Sealed, Leaked: Trust Beyond Signature for MCP Toolchains
Yichiet Aun, Mohammed A. Alhartomi, Jing Jie Tan et al.
Signed but Steerable: Measuring and Closing the Text-Vector Integrity Gap in Offline Retrieval-Augmented Generation
Georgios Feretzakis, Alexandros Papaspyridis
Towards Early Warning of Real-World Vulnerabilities: An Evidence-Aware Decoupled Method for CVSS Vector Prediction Based on Unstructured Disclosures
Jianhong Ma, Wenhao Li, Xixing Li et al.
CoRTeC: A Differentially Private Release for Synthetic Tabular Data, Decodable by Any Generator
Calister Nnona
A.S.E 2.0: Understanding How Repository Context Impacts the Security of LLM-Generated Code
Jiongchi Yu, Keke Lian, Junqing Wang et al.