Photon-Emission-Guided Laser Fault Injection Enables RP2350 Secure Debug
3 hours ago
- Researchers used differential photon-emission microscopy to locate the DEBUGEN register on the RP2350 microcontroller, enabling precise laser fault injection.
- Laser pulses at two nearby positions set two bits in the DEBUGEN register, restoring Secure debug access despite permanent debug-disable settings.
- After enabling Secure debug, a rescue reset halted the chip before firmware could apply runtime locks, allowing recovery of a secret from one-time-programmable memory.
- The attack requires destructive physical access (backside decapsulation), approximately $250,000 in lab equipment, and hardware security expertise.
- The RP2350's OTP uses redundant encoding for critical flags, but the DEBUGEN register lacks such protection, making it vulnerable to laser fault injection.
- The rescue reset feature (via RP-AP) restores permissive lock states without running user firmware, enabling access to otherwise protected OTP data.
- Software-based mitigations like DEBUGEN_LOCK and ACCESSCTRL are limited because the debugger can halt the core or exploit pre-firmware states after a rescue reset.
- The system-level lesson is that security relies on the complete enforcement path, from OTP configuration through mutable registers and reset behavior, not individual mechanisms.