0
\$\begingroup\$

I am trying to implement a power glitch attack. This is a hardware attack in which for a very short period of time (order of nanoseconds) I remove the power to a processor, using a transistor, to cause unexpected behavior.

For the shake of this question I'm using this and this as a reference.

There are not many internet resources in which it is explained which exact components to use or how they work, or how the whole circuit works, so I will divide my question in a number of doubts that arise to me.

0. My target

My target is an ARM processor running at 1.2volts. My FPGA outputs are 3.3v (to activate the transistor)

1. Does the type of transistor matter?

Most examples use MOSFET transistors. But this person used a BJT transistor as well as a resistor and successfully glitched a target.

2. Does the position of the transistor matter?

glitch circuit BJT Transistor

This is perhaps an obvious question but I'm no electrical engineer. Let's say I try to implement the circuit above, but using the BJT transistor shown above. I assume the VCC line should be connected to the COLLECTOR, the GND line to the EMITTER, and the glitch trigger to the BASE, is this correct?

Additionally, what will be the behavior of the circuit if I did it the other way around?(VCC to emitter and GND to COLLECTOR)

What I want to avoid is a permanent/long term connection between VCC and GND. I'm afraid If I mistakenly place the transistor wrong I will cause a permanent connection.

3. What is the purpose of the resistor?

I've seen in some papers being called shunt resistor. I don't know why. Is it part of the target's circuitry? Or should I provide it?

\$\endgroup\$
  • \$\begingroup\$ Surely you will have bulk capacitance distributed around your circuit that can remain “held up” for a few nano seconds hence, why do the test? \$\endgroup\$ – Andy aka Feb 9 at 15:50
  • \$\begingroup\$ @Andyaka which test? removing the power supply? Or inverting the transistor? In case of the transistor question, I was asking this because I actually destroyed a target and I think the cause could be I misplaced the transistor. The datasheet was a bit misleading and I had trouble finding which of the "legs" of the transistor was COLLECTOR and which one was EMITTER. So I wanted to know if that could be the cause of the disaster.In case of the power supply question, the idea is to remove power for enough time to cause problems on the CMOS level,but not enough time to trigger brownout protections \$\endgroup\$ – Pedro Javier Fernández Feb 9 at 16:10
  • \$\begingroup\$ You not being experienced with electronics poses a problem here; your question has too many fallacies and things that require to give you a complete intro to electronics to even be able to give an answer. For example, the PN 2222A is a rather slow transistor. When you look at the data sheet, you'll notice that none of the delays allow you to pull something low "on the order of nanoseconds". Then, when using that transistor to short capacitors, a large current will flow. Your insistence on using a BJT is bad: the Base-Emitter voltage under that condition is high enough to keep your ARM running. \$\endgroup\$ – Marcus Müller Feb 9 at 16:47
  • \$\begingroup\$ … and on it goes. Really, you'll need to understand at least the basics of linear networks (ohm's law, the time-dependence of voltage and current over capacitors) and a bit on semiconductors to build something like this with even a chance of being overly successful. \$\endgroup\$ – Marcus Müller Feb 9 at 16:48
  • \$\begingroup\$ @MarcusMüller thanks for the feedback. You are mostly right. Please, let me know which other fallacies I have said in my question. On another note, my insistence on BJT is just due to the fact I own some of such transistors, and a person successfully used them for this task. Nevertheless I agree MOSFETs should be the best choice. Could you recommend me a model for a fast type N MOSFET? \$\endgroup\$ – Pedro Javier Fernández Feb 9 at 17:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.