Laser Fault Injection Beats RP2350's 'Permanent' Debug Lock, Extracts OTP Secret

Researchers at Ledger Donjon defeated the hardware security on Raspberry Pi’s RP2350 microcontroller, restoring debug access on a chip whose debug interface had been permanently disabled. The weak point was an architectural override: even though the one-time-programmable CRIT1.DEBUG_DISABLE flag is meant to permanently cut off the debugger’s memory access ports, the memory-mapped DEBUGEN register can re-enable them if all its bits are set. Unlike the OTP security fields — which the datasheet protects with redundant three-of-eight and majority-vote encodings — DEBUGEN has no such redundancy, making it a viable target for a bit-flipping fault.

The core difficulty was aiming. Setting a single register bit requires hitting one storage cell, far more precise than the instruction-skip faults where any of many flip-flops will do. To solve this, the team used differential photon-emission microscopy: by running loops that repeatedly toggle specific DEBUGEN bits, they collected the faint near-infrared light emitted by the switching transistors and mapped the register’s physical location, narrowing the laser search to a few micrometres. Two laser pulses at nearby positions then set the two bits needed to re-enable Secure-world debug.

With debug restored, a rescue reset halted the chip before its firmware could apply the runtime ‘soft’ lock that normally hides the challenge secret, leaving the OTP page Secure-readable and exposing a 128-bit secret. The work, done against the hardened A4 revision released for Raspberry Pi’s RP2350 Hacking Challenge, is a reminder that permanent-disable settings are only as strong as the enforcement chain behind them — though the attack is far from casual, demanding physical access, destructive backside decapsulation, and roughly $250,000 of lab equipment.