Photon-Emission-Guided Laser Fault Injection Enables RP2350 Secure Debug

Researchers targeted the RP2350 A4’s debug-enable path and showed that faulting a single memory-mapped register can restore Secure debug despite permanent debug-disable settings. They used differential photon-emission microscopy (PEM) to localize switching activity tied to DEBUGEN bits, then applied focused laser fault injection (LFI) pulses at two nearby micrometre-scale spots to flip the bits that enable a core’s Mem-AP and permit Secure accesses. By iteratively pulsing the two sites until both PROC1 and PROC1_SECURE reported enabled, an external debugger regained Secure Mem-AP access. After triggering a rescue reset that halted firmware before it applied a runtime lock, Secure-readable access to an OTP page yielded recovery of the 128-bit challenge secret. The technique required physical access, destructive backside decapsulation, and roughly $250k of lab equipment.

Technically, the attack exploited the lack of redundancy for DEBUGEN (bits for PROC0/1, PROC0/1_SECURE, and MISC) versus the triple-redundant OTP fields and the RP2350’s boot/runtime lock model. PEM used repeated bit-toggle loops, frame averaging and subtraction to reveal compact emission hotspots and reduce the laser search to a few micrometres. LFI employed a 980 nm pulsed laser (~1.2 W, 100 ns pulses, 50x objective) with SWD feedback to calibrate two responsive positions; a wider 20x spot hit both sites and failed, so tight optical focus was critical. The result demonstrates a practical, invasive path to regain Secure debug on a device designed to permanently disable it.