Photon-guided laser fault injection defeats permanent debug disable on RP2350

Researchers at Ledger Donjon have restored secure debugging on a Raspberry Pi RP2350 microcontroller whose debug interface had been permanently disabled, using photon-emission microscopy to aim laser pulses at a single control register. With that access, and after a rescue reset that halted the chip before firmware could apply its runtime lock, the team read a secret out of one-time-programmable (OTP) memory — the objective Raspberry Pi set for its RP2350 Hacking Challenge. According to the write-up, the attack needs physical access, destructive preparation and roughly $250,000 of laboratory equipment.

Permanent fuses and the register that overrides them

The RP2350 is a dual-core microcontroller in which each processor socket picks either an Arm Cortex-M33 or a RISC-V Hazard3 core at boot. Its security features include signed secure boot checked against key fingerprints stored in OTP, Armv8-M TrustZone separation between Secure and Non-secure states, permanent debug-disable settings and glitch detectors. OTP bits flip from 0 to 1 once and never back, and security-relevant fields there carry redundancy: critical flags use a three-of-eight vote across eight consecutive rows, and OTP lock bits are triple-redundant with majority voting, as the datasheet cited by Ledger Donjon describes.

Debug is meant to be closed forever by the permanent CRIT1.DEBUG_DISABLE flag. When set, it drives both cores' memory access port enable signals to zero — leaving the ports unable to perform any bus accesses — and also disables the factory-test JTAG interface and the RISC-V debug module's access port. The enforcement path has an override, though: the memory-mapped DEBUGEN register lets Secure software re-enable each core's access port and, separately, Secure transactions through it, and the datasheet states that setting all of its bits fully overrides DEBUG_DISABLE. Five bits matter: per-core enable and Secure-permission bits for both cores, plus a MISC bit for extra debug components. Unlike the OTP fields, the datasheet documents no redundancy, parity or majority vote for DEBUGEN. That single register became the target.

Aiming a laser at one flip-flop

Common laser fault injections go after instruction skips, where disturbing nearly any flip-flop in a processor pipeline yields a similar result and the sensitive area is wide enough for a scanning approach. Hitting the storage cell of one specific register bit is far harder, and Ledger Donjon considered a blind scan impractical. Its answer was photon-emission microscopy: switching transistors give off faint near-infrared photons, so by toggling chosen DEBUGEN bits in a tight loop from Secure software, the researchers could image where those bits change state. The emission map cut the subsequent laser scan down to a region a few micrometres across, and pulses at two nearby positions were then enough to set the register and return debugger access to the Secure world despite the permanent disable.

From debug access to a recovered secret

The challenge setup stores a 128-bit secret in OTP page 48. Its persistent lock keeps the page readable from the Secure world but blocks Non-secure access, and startup firmware adds a runtime lock that denies both worlds until the next OTP reset. Ledger Donjon reproduced the vendor's configuration on its own A4 device: secure boot enabled (which restricts the chip to the Cortex-M33 cores), debug permanently disabled, glitch detectors at maximum sensitivity, and the page 48 lock set to 0x3c3c3c. After gaining Secure debug, the team used a rescue reset so the chip halted before firmware could apply the runtime lock; the page therefore stayed Secure-readable and the secret could be read out.

Getting there was destructive. The sample was decapsulated from the back so near-infrared light could reach the transistors through the silicon substrate, mounted on a daughterboard driven by Scaffold — Ledger Donjon's open-source test platform — and re-grounded with a copper wire because removing the lead frame breaks the ground connection.

Why it matters

A permanent fuse is only as strong as the logic that reads it. Raspberry Pi hardened OTP security fields with redundancy and majority votes, yet a non-redundant debug-enable register sits downstream of the fuse and can fully override it; a mechanism documented for Secure software proved reachable by physical fault injection. For microcontroller threat models, the work also shows that photon-emission-guided targeting makes single-bit register faults practical rather than theoretical. The bar remains high — physical access, a destroyed sample and about a quarter of a million dollars of equipment — so this is not an attack for remote or opportunistic adversaries. But for products whose attackers include funded laboratories, permanent debug disable alone should not be treated as an absolute boundary. Raspberry Pi has invited exactly this scrutiny through its RP2350 Hacking Challenges: the first ran from August to December 2024, and the A4 revision tested here already folds in fixes from earlier findings, which makes this a fresh result against the hardened part.