ChipSHOUTER-PicoEMP Documentation

The PicoEMP C firmware provides basic control for Colin O'Flynn's PicoEMP hardware. Key capabilities include:

• Manual Control: Arming and pulsing the device manually.
• Serial Interface: Remote control of arming, disarming, and pulsing via a serial connection.
• Safety Features: Automatic disarming after a 60-second timeout.
• Fast-triggering: High-speed, consistent triggering via GPIO0 using PIO (Programmable I/O).
• External HVP Mode: Allows an external pulse generator (such as a ChipWhisperer) to control EM pulse insertion.

The ChipSHOUTER-PicoEMP supports two types of firmware for the Raspberry Pi Pico, depending on your requirements for control and robustness:

1. C Firmware: The most robust and future-proof option. It includes a serial console (similar to the original ChipSHOUTER) and supports an external trigger input.
2. MicroPython Firmware: A basic implementation intended for manual usage via a physical button. It does not include a serial console.

While inspired by the ChipSHOUTER, the PicoEMP is a different tool optimized for cost and hobbyist use rather than professional performance.

The PicoEMP uses a floating high-voltage side to prevent the output connector from being permanently "hot" (a common hazard in low-side switching designs).

Key Design Details:

• Isolation: There is no electrical path between the EMFI probe output and the input voltage ground.
• Architecture: It uses a transformer-based architecture (simplified gate drive transformer/GDT) to isolate the gate drive.
• Safety Note: While designed for safety, high-frequency spikes may still cause some current to flow. Always use the plastic shield to prevent accidental contact with high-voltage capacitors and circuitry.

By default, cspico_simple.py includes a safety/power-saving feature that turns off the High Voltage (HV) if no activity is detected after 60 seconds.

To prevent the HV from turning off automatically, locate the timeout check in the code and comment it out:

    # Turn off HV if no activity after 60 seconds
    if enabled:
        if utime.ticks_diff(utime.ticks_ms(), timeout_start) > 60000:
            enabled = False
            pwm_off()
            ledArm.off()

Note: The default implementation keeps charging even after the 'charged' pin goes high. While you can improve power consumption by toggling charging on/off, doing so will increase the recovery time between pulses.

For custom wire-wrapped probes, use the following design principles:

Conical Probe

• Example Specs: Base diameter of 1.5mm, approximately ten contiguous turns.
• Optimal Distance: For an average probe diameter of 1500µm, the optimal distance to the target circuit is 500µm.
• Mathematical Model: The ideal probe radius $R$ follows the relationship $R = \sqrt{2} \cdot z$, where $z$ is the distance between the target and the probe (based on "New probe design for hardware characterization by ElectroMagnetic Fault Injection" by C. Gaine et. al.).

Precise Probe

• Example Specs: Diameter of 750µm, approximately five contiguous turns, using 40µm diameter wire.
• Use Case: Ideal for high-precision targets like SoCs.

Instead of winding your own coils, you can use off-the-shelf ferrite-core inductors.

Recommended Inductor Examples

• Coil Craft PCV-0-472-03L: A hollow-core ferrite inductor that remains effective for fault injection.
• Würth Elektronik 744710603: A smaller inductor available on Digi-Key. To use this, you must unwind some of the wrapping to create a connection point for the SMA. It is recommended to keep the remaining windings as close to the 'active' end as possible.
• Würth Elektronik 744779068: A radial leaded wire wound inductor that can be modified by removing the top ferrite cover and some windings.

To ensure the safety and reliability of the device, especially for partially assembled units, perform a Hi-pot (High Potential) test to validate isolation.

• Test Voltage: Apply 1kV.
• Purpose: This voltage is well beyond the operational voltages the device generates and is used to confirm that the isolation is reasonable and safe for use.

Bantam-milled versions of the PicoEMP require specific jumper configurations:

• Required Jumper: There is one mandatory jumper that must be installed (refer to the design images for the exact location).
• GND Connections: Ground connections are handled via the Raspberry Pi Pico. No specific jumper is required for GND, provided that you solder all the connected pins on the Raspberry Pi Pico.

Follow these steps to perform an EMFI attack:

1. Arm the device: Press the ARM button. The red ARMING LED will illuminate, indicating the high voltage is charging.
2. Verify charge: Wait a few seconds. The red HV LED will illuminate once the device is charged to voltage.
3. Position probe: Place the injection tip (coil) directly over the target component.
4. Trigger pulse: Press the Pulse button to deliver the fault.

⚠️ WARNING: High Voltage Hazard

• The high voltage is applied across the SMA connector.
• If no injection tip is attached, the SMA connector is an open high-voltage source and can shock you.
• Do NOT touch the output SMA tip. Treat the output as if high voltage is always present.
• Unlike the professional ChipSHOUTER, the PicoEMP does not have a failsafe to detect a missing connector tip.