ChipWhisperer Husky Glitch Attack Introduction

This introduction will guide you through understanding the fundamentals of glitch attacks and their configurable parameters on the ChipWhisperer Husky platform. This is your first step to learning about clock glitching and voltage glitching techniques, covering what parameters are available and how to use them with the ChipWhisperer Husky.

Table of Contents

1. Clock Glitch Parameters
2. Voltage Glitch Parameters
3. Shared Configuration Parameters
4. Parameter Mapping to Husky API
5. Quick Reference Card

Clock Glitch Parameters

Understanding Clock Glitching

Clock glitching is a fault injection technique that temporarily disrupts the timing of a target device’s clock signal. By introducing brief anomalies in the clock, you can cause the processor to execute instructions incorrectly, skip operations, or bypass security checks. The ChipWhisperer Husky generates these clock glitches by manipulating the target’s clock signal using precise timing control.

Clock glitches work by creating momentary violations of the processor’s timing requirements. When the clock signal is disrupted at just the right moment, the processor may:

• Execute an instruction with incorrect data
• Skip an instruction entirely
• Corrupt register or memory values
• Bypass conditional checks or loops

The effectiveness of a clock glitch depends on precise timing and the right combination of parameters. Let’s explore what parameters you can control on the Husky:

All Controllable Parameters

Voltage Glitch Parameters

Understanding Voltage Glitching

Voltage glitching is another fault injection technique that temporarily reduces the power supply voltage to the target device. When the voltage drops below the processor’s minimum operating threshold, logic operations can fail or produce incorrect results. The ChipWhisperer Husky implements voltage glitching using crowbar MOSFETs that create brief voltage dips on the target’s power rail.

Voltage glitches exploit the relationship between supply voltage and digital logic reliability. When voltage is insufficient, transistors may not switch properly, leading to:

• Logic gates producing incorrect outputs
• Memory cells flipping to wrong states
• Arithmetic operations yielding incorrect results
• Timing-sensitive circuits failing to meet requirements

The Husky provides two different MOSFET circuits (low-power and high-power) that can be used individually or together to create voltage glitches of varying strength. The timing and duration of these glitches can be precisely controlled to target specific operations.

All Controllable Parameters

Shared Configuration Parameters

These parameters affect the overall experiment environment and should typically be treated as episode-level configuration, not per-step RL actions.

How to Configure Parameters in Code

Now let’s see how to actually set these parameters in your Python code:

Setting Up Clock Glitching

# Enable glitch module (REQUIRED for Husky)
scope.glitch.enabled = True

# Clock source for glitch generation
scope.glitch.clk_src = "pll"  # Use PLL for Husky

# How glitch modifies clock
scope.glitch.output = "clock_xor"  # XOR glitch with clock

# Trigger source
scope.glitch.trigger_src = "ext_single"  # Wait for firmware trigger

# Route glitch to target
scope.io.hs2 = "glitch"

# Disable ADC errors during glitching
scope.adc.lo_gain_errors_disabled = True
scope.adc.clip_errors_disabled = True

# Core glitch parameters
scope.glitch.width = 2000       # Phase shift steps (0-4592)
scope.glitch.offset = 2000      # Phase shift steps (0-4592)
scope.glitch.ext_offset = 10    # Clock cycles after trigger
scope.glitch.repeat = 5         # Number of glitch pulses

# Get available phase shift range
max_steps = scope.glitch.phase_shift_steps  # Returns 4592 for Husky

Setting Up Voltage Glitching

# Quick setup method
scope.vglitch_setup('both', default_setup=False)  # 'lp', 'hp', or 'both'

# Or manual setup
scope.glitch.enabled = True
scope.glitch.clk_src = "pll"
scope.glitch.output = "glitch_only"  # For voltage glitching
scope.glitch.trigger_src = "ext_single"
scope.io.glitch_hp = True  # High-power MOSFET
scope.io.glitch_lp = True  # Low-power MOSFET

# Same timing parameters as clock glitching
scope.glitch.width = 2000
scope.glitch.offset = 2000
scope.glitch.ext_offset = 10
scope.glitch.repeat = 5

# Reset voltage glitch state if needed
scope.io.vglitch_reset()

Quick Reference Card

Clock Glitch Setup Checklist

• scope.glitch.enabled = True
• scope.glitch.clk_src = "pll"
• scope.glitch.output = "clock_xor"
• scope.glitch.trigger_src = "ext_single"
• scope.io.hs2 = "glitch"
• Set width, offset, ext_offset, repeat

Voltage Glitch Setup Checklist

• scope.vglitch_setup('both') or manual MOSFET config
• scope.glitch.output = "glitch_only"
• Connect SMA cable from Husky crowbar output to target
• Set width, offset, ext_offset, repeat

Diagnostic Commands

# Check glitch status
print(f"Enabled: {scope.glitch.enabled}")
print(f"Phase steps: {scope.glitch.phase_shift_steps}")
print(f"HS2: {scope.io.hs2}")
print(f"Output: {scope.glitch.output}")
print(f"Width: {scope.glitch.width}")
print(f"Offset: {scope.glitch.offset}")
print(f"Ext_offset: {scope.glitch.ext_offset}")
print(f"Repeat: {scope.glitch.repeat}")

# Measure trigger window
scope.arm()
target.simpleserial_write("g", bytearray([]))
scope.capture()
print(f"Trigger duration: {scope.adc.trig_count} cycles")

References

• ChipWhisperer Husky Documentation
• Fault101 Course Materials
• NewAE Forum Discussions
• Experimental results from SAM4S target testing

Document generated from implementation experience with ChipWhisperer Husky Last updated: 2026-01-18