{"id":630240,"date":"2026-09-20T06:34:12","date_gmt":"2026-09-20T06:34:12","guid":{"rendered":"https:\/\/www.newsbeep.com\/ie\/630240\/"},"modified":"2026-09-20T06:34:12","modified_gmt":"2026-09-20T06:34:12","slug":"laser-your-way-into-debug-mode-on-the-rp2350","status":"publish","type":"post","link":"https:\/\/www.newsbeep.com\/ie\/630240\/","title":{"rendered":"Laser Your Way Into Debug Mode On The RP2350"},"content":{"rendered":"

The RP2350 is actually a pretty secure chip, all things considered. It has secure boot, ARMv8\u2019s TrustZone to split secure and non-secure execution, and you can permanently disable debug \u2014 the Pi Foundation even included glitch detection, meaning the traditional \u2018zap the chip until it obeys\u2019 technique is blocked. That\u2019s why the [Ledger Donjon] security team went full Bond Villain and strapped everyone\u2019s favourite fruit-flavoured microcontroller to a table with a slowly-approaching laser beam.<\/a><\/p>\n

\"\"<\/a>The bench setup to do all this is pretty impressive\u2013 and came with an impressive 250,000 USD price tag.<\/p>\n

Okay \u2014 movie clich\u00e9s aside, the laser was in fact very carefully focused on target before they turned it on. That target was the register that enables the 2350\u2019s debug features. Said register was located by decapsulating the chip and examining the die with photon-emission electron microscopy; the actual attack was carried out on a chip that had been decapped on the back side, with IR shining through the silicon wafer. There was probably more than a little trial-and-error to figure out exactly where on the die adjacent to the register to zap with the laser to flip those bits. But flip they did, restoring the debugger\u2019s access to the secure execution zone. Then, after resetting the chip, [Ledger]\u2019s team read the 128-bit secret the Pi Foundation hid in memory as part of the 2350 hacking challenge<\/a>.<\/p>\n

It\u2019s long been accepted that once the black hats \u2014 or white hats, for that matter \u2014 have their hands on your hardware, they\u2019re going to find a way in. The effort it takes to break into a simple microcontroller here is actually kind of impressive. We\u2019ve talked about laser fault injection<\/a> before; ironically, we\u2019ve also featured Pi Pico-powered glitching attacks<\/a> \u2014 the kind that this chip\u2019s glitch detection thwarts.<\/p>\n","protected":false},"excerpt":{"rendered":"The RP2350 is actually a pretty secure chip, all things considered. It has secure boot, ARMv8\u2019s TrustZone to…\n","protected":false},"author":2,"featured_media":630241,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[61,60,80],"class_list":["post-630240","post","type-post","status-publish","format-standard","has-post-thumbnail","category-technology","tag-ie","tag-ireland","tag-technology"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/posts\/630240","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/comments?post=630240"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/posts\/630240\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/media\/630241"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/media?parent=630240"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/categories?post=630240"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/ie\/wp-json\/wp\/v2\/tags?post=630240"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}