IN Brief:
- Ledger Donjon restored Secure debug access on an RP2350 A4 by faulting the chip’s DEBUGEN control with a focused infrared laser.
- The demonstrated attack required backside decapsulation, specialist hardware-security expertise, and laboratory equipment valued at roughly $250,000.
- Raspberry Pi does not plan another silicon respin, citing the destructive physical-access requirement and single-device scope when per-device keys are used.
Raspberry Pi has disclosed a physical fault-injection attack that can restore Secure debug access on secured RP2350 A4 microcontrollers, despite permanent configuration intended to close that route into the device.
The work was carried out by the Ledger Donjon hardware-security team, which combined photon-emission microscopy with laser fault injection to identify and alter the state of the RP2350’s DEBUGEN control. Once the required bits had been forced into the appropriate state, the researchers regained Secure-attributed access through the Arm Serial Wire Debug interface and demonstrated recovery of secret data from the configuration used for Raspberry Pi’s hacking challenge.
The technique does not provide a remote route into deployed RP2350 systems. Ledger’s setup required physical possession of the target, destructive backside decapsulation, precision optical equipment, and detailed knowledge of the device’s security architecture. Raspberry Pi puts the laboratory equipment requirement at roughly $250,000 and says the work demands specialist sample preparation and fault-injection skills.
RP2350 stores permanent security configuration in one-time-programmable memory, including settings used to disable debug access. The research focused on a separate memory-mapped register called DEBUGEN, which can override the effect of the permanent debug-disable configuration when the correct control bits are asserted. Ledger found that this register did not use the same redundant encoding mechanisms applied to several of the chip’s OTP security fields.
Locating those controls inside the silicon required differential photon-emission microscopy. The researchers repeatedly toggled selected DEBUGEN values and compared the resulting infrared emissions, narrowing the search to small areas of the die. A 980nm pulsed laser was then used to inject faults at two positions associated with the debug-control bits required for Secure access.
With the fault parameters calibrated, Ledger enabled the processor memory-access port and then Secure transactions through it. The DEBUGEN_LOCK mechanism, which prevents software from changing locked DEBUGEN bits, did not stop the laser-induced state changes. In successful tests, the laser could therefore create a debug state that normal software writes could not simply reverse.
The hacking-challenge configuration added another protection layer. Firmware normally tightened a runtime lock around the OTP page containing the secret after boot, so restoring Secure debug alone did not expose the data. Ledger used the RP2350 rescue-reset path to reset the runtime OTP lock while preventing user firmware from executing, then re-enabled Secure debug and read the challenge secret.
Signed firmware authentication still operates during normal boot, and the demonstrated sequence depends on invasive work against an individual decapsulated device. The research instead exposes an interaction between persistent OTP configuration, a mutable debug override, runtime locks, and reset behaviour that creates an additional physical attack path.
Raspberry Pi has decided against another silicon respin. Its assessment rests on the destructive nature of the procedure, the specialist equipment and expertise required, and the expectation that systems using unique per-device secrets confine the consequences to the individual device under attack. Products designed to withstand invasive laboratory analysis will have a different threat model from ordinary embedded equipment and will need to account for the demonstrated path.
The result arrives as semiconductor suppliers put more security functions into hardware roots of trust and protected execution environments. Recent Caliptra security development has included explicit side-channel and fault-injection protection alongside cryptographic functions and lifecycle controls. RP2350 shows why debug logic, reset behaviour, locking, and physical attack resistance have to be considered alongside the cryptographic blocks themselves.
Ledger disclosed the finding privately to Raspberry Pi in July before publishing its technical work on 18 September. Raspberry Pi’s second RP2350 hacking challenge, which concentrates on side-channel analysis, remains open until the end of October, extending external examination of the microcontroller’s security architecture.
