133 lines
7.4 KiB
Markdown
133 lines
7.4 KiB
Markdown
|
# Dragonzap
|
||
|
|
|
||
|
|
## Introduction
|
||
|
|
|
||
|
|
Dragonzap is a PCB for voltage glitching. It provides both a SPDT switch for
|
||
|
|
quickly switching between a high and a low voltage (controlled by a DAC), and a
|
||
|
|
MOSFET circuit for crowbar glitching. GPIOs to interact with the DUT can go
|
||
|
|
through a level shifter.
|
||
|
|
|
||
|
|
The PCB is about 9.2 cm by 5.4 cm in size.
|
||
|
|
|
||
|
|
## Images
|
||
|
|
|
||
|
|
### Front
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
### Back
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
### 3D view, with components
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
## Notes
|
||
|
|
|
||
|
|
External module and footprint sources:
|
||
|
|
* https://github.com/ncarandini/KiCad-RP-Pico (Pico)
|
||
|
|
* https://github.com/lethalbit/aki-eda (Samtec FTSH SWD debug connector)
|
||
|
|
* https://git.lain.faith/sys64738/pcbs/src/branch/main/chip-bo (4x2 jumper,
|
||
|
|
Xenia silkscreen image)
|
||
|
|
|
||
|
|
## Usage
|
||
|
|
|
||
|
|
Firmware of the Pico controller is still TODO. Most of the documentation can
|
||
|
|
be found on the PCB silkscreen.
|
||
|
|
|
||
|
|
### Pico pinout
|
||
|
|
|
||
|
|
| Name | Pico pin | Usage |
|
||
|
|
|:---------- |:-------- |:----- |
|
||
|
|
| DUT GPIO | GP0..GP7 | Generic GPIO to the target DUT, goes through level shifter U200 and out to J200. GP0 and GP1 are also connected to JP100 for UART. |
|
||
|
|
| RV50x | ADC0, ADC1 | Potentiometers that can be used for manual parameter tweaking. |
|
||
|
|
| DACVCC/2 | ADC2 | Can be used to calculate the maximum voltage the DAC can reach, for calibration. |
|
||
|
|
| TRIG IN | GP10 | DUT trigger input. |
|
||
|
|
| GLITCH SIG | GP11 | DUT glitch (voltage supply) output, from U400. |
|
||
|
|
| CB1 (Q300) | GP12 | Crowbar gate 1 |
|
||
|
|
| CB2 (Q301) | GP13 | Crowbar gate 2 |
|
||
|
|
| DAC nLATCH | GP17 | `nLATCH` signal of the MCP4802 DAC (U401). |
|
||
|
|
| DAC CLK | GP18 | SPI clock signal of U401.
|
||
|
|
| DAC TX | GP19 | SPI controller-to-device data signal of U401. |
|
||
|
|
|
||
|
|
## BOM
|
||
|
|
|
||
|
|
### Base components
|
||
|
|
|
||
|
|
| Ref | Quantity | Product | Footprint | Description | Notes |
|
||
|
|
|:---- | --------:|:-------------- |:----------- |:----------- |:----- |
|
||
|
|
| U100 | 1 | Raspberry Pico | Pico module | Raspberry Pico module/board | This one serves as the glitch controller. Very important. |
|
||
|
|
| C100 | 1 | 47 uF | THT Radial P2.00mm | Electrolytic capacitor | Extra decoupling capacitor for the Pico. |
|
||
|
|
| J200 | 1 | Pin header 01x08 | THT 2.54mm 01x08 | Generic pin header | Main GPIO to DUT connector, goes through level shifter U200. |
|
||
|
|
| J201, J202, J205 | 3 | Pin header 01x01 | THT 2.54mm 01x01 | Generic pin header | Main glitching to DUT connectors (pin headers). |
|
||
|
|
| J203, J204, J206 | 3 | Amphenol 132289 | SMA edge-mount connector | SMA connector | Main glitching to DUT connectors (SMA connectors). Has many other compatible connectors. |
|
||
|
|
|
||
|
|
### Optional connectors
|
||
|
|
|
||
|
|
| Ref | Quantity | Product | Footprint | Description | Notes |
|
||
|
|
|:---- | --------:|:-------------- |:----------- |:----------- |:----- |
|
||
|
|
| J207 | 1 | Pin header 02x05 | THT 2.54mm 02x05 | Generic pin header | Power out (and extra external voltage in) connector. |
|
||
|
|
| D100 | 1 | 1N4001 | SOD-123 | Generic or Schottky diode. | Reset diode for external reset signal (SWD). |
|
||
|
|
| J100 | 1 | Pin header 01x04 | THT 2.54mm 01x04 | Generic pin header | UART connector (nonstandard, 2.54mm jumper) |
|
||
|
|
| J101 | 1 | Pin header 01x05 | THT 2.54mm 01x05 | Generic pin header | SWD connector (nonstandard, 2.54mm jumper) |
|
||
|
|
| J102 | 1 | FTSH-105-01-L-DV-007-K | THT 1.27mm 02x05 -OR- FTSH-105 SMD | Cortex debug connector | SWD connector (standard FTSH connector, 1.27mm pitch, either through-hole or surface-mount) |
|
||
|
|
|
||
|
|
### Manual control potentiometers
|
||
|
|
|
||
|
|
| Ref | Quantity | Product | Footprint | Description | Notes |
|
||
|
|
|:---- | --------:|:-------------- |:----------- |:----------- |:----- |
|
||
|
|
| RV500, RV501 | 2 | Potentiometer | THT 2.54mm 1x3 | Potentiometer with colinear leads. | Used for optional manual control of parameters. |
|
||
|
|
|
||
|
|
### If you need the "emergency reset button"
|
||
|
|
|
||
|
|
| Ref | Quantity | Product | Footprint | Description | Notes |
|
||
|
|
|:---- | --------:|:-------------- |:----------- |:----------- |:----- |
|
||
|
|
| Q1 | 1 | Generic NMOS | SOT-23 (GSD) | N-MOSFET transistor | Make sure it is completely on at a Vgs of 3.3V! Invertor NMOS for reset signal. |
|
||
|
|
| SW1 | 1 | Push button | THT 4-lead 6x6mm | Two-by-two push button switch, generic | Make sure the bends in the pushbutton leads are parallell with the lines on the silkscreen. |
|
||
|
|
| R1, R2 | 2 | 220k | 0805 | Resistor | Pullup/pulldown resistors. |
|
||
|
|
|
||
|
|
The emergency reset button will stop U100, and disable most other ICs (eg. U400, U200).
|
||
|
|
|
||
|
|
### If you need the DAC
|
||
|
|
|
||
|
|
The DAC can be used for the level shifter, crowbar glitcher and SPDT glitcher
|
||
|
|
(selected using JP200, JP300 and JP500).
|
||
|
|
|
||
|
|
| Ref | Quantity | Product | Footprint | Description | Notes |
|
||
|
|
|:---- | --------:|:-------------- |:----------- |:----------- |:----- |
|
||
|
|
| U401 | 1 | MCP4802 | SOIC-8 3.9x4.9 (U401a) -OR- MSOP-8 3x3mm P0.65mm (U401b) | 2-channel 8-bit DAC, SPI interface. | DAC, optional. If not placed, you probably want to short JP500, and short the two leads as indicated on the silkscreen. SOIC and MSOP both work. |
|
||
|
|
| R500, R501 | 2 | 220k | 0805 | Generic resistor | Voltage divider for max voltage sensing of U401. Only needed if you place the DAC (U401). |
|
||
|
|
| C401 | 1 | 10 nF | 0805 | Unpolarized (MLCC) capacitor | Decoupling capacitor for U401. Optional. |
|
||
|
|
|
||
|
|
### If you need the level shifter
|
||
|
|
|
||
|
|
| Ref | Quantity | Product | Footprint | Description | Notes |
|
||
|
|
|:---- | --------:|:-------------- |:----------- |:----------- |:----- |
|
||
|
|
| U200 | 1 | TXS0108EPW -OR- NXS0108PW | TSSOP-20 4.4x6.5mm P0.65mm | Bidirectional level-shifting voltage translator | The level shifter. Source from TI or Nexperia. |
|
||
|
|
| R200 | 1 | 47k | 0805 | Pulldown resistor | Used for the enable line of U200. |
|
||
|
|
| JP200 | 1 | Pin header 02x04 | THT 2.54mm 02x04 | Level shifter external voltage selector. | Place a generic pin header here, use a pin shunt to select the voltage. |
|
||
|
|
|
||
|
|
If not using the level shifter, short the leads of the footprint of U200 as
|
||
|
|
shown on the PCB silkscreen.
|
||
|
|
|
||
|
|
### If you need the crowbar glitching circuit
|
||
|
|
|
||
|
|
| Ref | Quantity | Product | Footprint | Description | Notes |
|
||
|
|
|:---- | --------:|:-------------- |:----------- |:----------- |:----- |
|
||
|
|
| Q300 | 1 | IRF7807/Si4850BDY/Si3463BDY | SOIC-8 3.9x4.9mm | N-channel Power MOSFET, SO-8 | Slower but higher-duty (current-wise) crowbar MOSFET. Need not be placed if Q301 is present. |
|
||
|
|
| Q301 | 1 | IRLML2502/IRLML6204 | SOT-23 | N-channel MOSFET, SOT-23 | Faster but more fragile crowbar MOSFET. Need not be placed if Q300 is present. |
|
||
|
|
| R300 | 1 | 50 Ohm | 0805/1206/2010/2512 | Current limiting resistor | Current limit resistor through which power is optionally supplied to the target. Several footprints work. Use eg. ESR10EZPF49R9. |
|
||
|
|
| JP300 | 1 | Pin header 02x04 | THT 2.43mm 02x04 | Generic pin header | Crowbar power supply, place generic pin header and use a pin shunt. Can be left open if target is self-powered. |
|
||
|
|
|
||
|
|
Note, Q300 and Q301 are selected by separate GPIO lines on the Pico.
|
||
|
|
|
||
|
|
### If you need the SPDT switch glitching circuit
|
||
|
|
|
||
|
|
| Ref | Quantity | Product | Footprint | Description | Notes |
|
||
|
|
|:---- | --------:|:-------------- |:----------- |:----------- |:----- |
|
||
|
|
| U400 | 1 | MAX4619CSE+ | SOIC-8 3.9x4.9mm | Triple analog SPDT switch | Fast SPDT switch IC, used for glitching (selecting between high and low voltage levels). |
|
||
|
|
| R400, R401 | 2 | 220k | 0805 | Generic resistor | Pullup/pulldown resistors for the enable line of U400. |
|
||
|
|
| C400 | 1 | 10 nF | 0805 | Unpolarized (MLCC) capacitor | Decoupling capacitor for U400. Optional. |
|
||
|
|
|