by Andrew D. Zonenberg, Ph.D
Associate Principal Security Consultant
The latest new widget just showed up on your desk. You excitedly crack open the case, look around a bit, and find a signal that looks interesting. You fire up your oscilloscope, touch a probe to the signal, and... the widget won't boot! Or maybe it works fine, but you see garbage on the scope screen that looks nothing like a useful digital waveform.
It's a problem that's becoming all too familiar to hardware hackers. As technology advances, signals become faster, which makes them more sensitive and less tolerant to the sloppy wiring and probing techniques commonly used in reverse engineering. Even cheap SPI flash can run at 100+ MHz in modern designs.
This article will focus on practical problems and solutions for analyzing existing boards, without digging too deep into the more advanced electrical engineering theory needed for design of high speed logic. For a more in-depth treatment of the subject, High Speed Digital Design: A Handbook of Black Magic (1993) by Howard Johnson & Martin Graham is an excellent read, as well as its successor High Speed Signal Propagation: Advanced Black Magic (2003).
|If your probing setups look like this, you're going to have a bad time reversing modern hardware!|
At this level, the main thing to be aware of is that electrical signals move through wires at a finite speed, typically around 0.6-0.7x the speed of light (roughly six inches per nanosecond), and that changing cable characteristics (more specifically, impedance) causes an impact on the signal whose duration in time is proportional to their length.
Before we proceed any further I'd also like to introduce an abbreviation from the test equipment world that you may not be familiar with: DUT (Device Under Test). This is a fancy way of saying "the thing you're trying to probe".
Avoid Long Messes of Wires
In the photo above, a JTAG adapter was connected to the DUT with several feet of wire, without paying any attention to impedance or termination. The JTAG software was unable to detect the processor. When an oscilloscope was connected to the TCK signal on the DUT, the signal looked like this:
|JTAG TCK signal with long wires|
The rising edge of the clock signal climbs for a while, then dips, then continues climbing to its full value. These non-monotonic edges are a big problem! If the position of the dip happens to line up with the threshold of the device's input pin, it will see two rising edges instead of one, resulting in a bit of data being duplicated.
You might be tempted to reduce the clock frequency of the JTAG adapter in this case, but this won't help: all it will do is move the rising and falling edges further apart without changing their shape. Fast edges at 1 kHz are just as vulnerable as edges at many MHz.
Adding filtering to slow down the edge rate (at the cost of reducing the max operating speed), adding a ~33Ω series terminating resistor at the source end of the wire, or playing with ground geometry to match the impedance of the cable more precisely can all help. In most cases, however, the easiest solution is simply to shorten the wires.
|No more spaghetti!|
|JTAG signal with shorter wires|
If you look closely a small defect on the edge is still visible since the ribbon cable isn't impedance matched, but it's much smaller because the mismatched cable length is shorter. At this edge rate, this sort of defect shouldn't be a problem since it doesn't dip, it just stops rising momentarily. When dealing with sharper edges, you might want to shorten the cable even further. You should also...
Properly Secure Wires
|Kapton tape securing a solder-in probe tip|
|Wires secured with UV glue|
Probe holders: There's a wide range of these available, ranging from DIY 3D printed bipods to $500+ three-axis micrometer jigs. More temporary in nature than any kind of adhesive, but useful for any time you want to look at more than a handful of signals while keeping your hands free. These get the probe tip right up against the board without any additional wire, which is great for probing faster signals.
|Probe held in a bipod positioner|
Avoid Long Probe Grounds
|10 MHz clock seen through a 10MΩ probe with a long ground wire|
|Test signal with no probe|
In this screenshot we see three different signals:
- Blue: The signal as seen through the probe (flatlined, since the probe isn't on the board yet).
- Pink: The signal internal to the DUT
- Yellow: A snapshot of the pink waveform frozen in time. Right now they're identical, but if the probe alters behavior of the DUT you'll see them deviate.
To start, let's use a standard 10MΩ passive scope probe (a Teledyne LeCroy PP022) and an alligator clip ground.
|Probing the easy, obvious way.|
|And here's what the scope sees|
The signal is completely unrecognizable through the probe! In addition to causing ringing on edges, the inductance of the long ground lead destroys high frequency performance.
A spring ground is a bit trickier to use since you have to find a good ground point fairly close to the signal you're probing on the DUT, but gives a much nicer looking view of the signal.
|Using a spring ground|
|Waveform seen with the spring ground|
That's a lot better looking: the edges are rounded off and not as square looking as they should be, but that's an inherent limitation of this probe (500 MHz bandwidth). Individual data bits are clearly readable, so all is well... right?
Wrong. Take a look at the signal on the DUT (pink waveform)! There's huge dips in it. This might well be enough to corrupt data and render the DUT nonfunctional. This brings us to our next topic...
Beware of Probe Loading
|Probing our test setup using a transmission line probe (Pico TA061)|
|Waveform seen through the transmission line probe|
|Waveform seen through transmission line probe with spring ground|
Open Hardware High-Speed Probes
|AKL-PT2 soldered to a board|| |
|Same Ethernet test signal seen through the AKL-PT1|