In this chall, the flag is protected by a check that is never false:
volatileboolcheck=true;uint32_tcnt=0;inti=0;intj;while(true){cnt=0;for(i=0;i<1000;i++){for(j=0;j<1000;j++){cnt++;if(!check){// Flag gets printed}}}uart_printf("%u %u %u\r\n",i,j,cnt);}
Hint 1
There is no software vulnerability, as clearly the check can never be true.
Hint 2
Voltage glitching can inject faults such as skipping instructions or corrupting computations.
Hint 3
A good way to find the right glitch duration to corrupt your target is to start with a very long duration that resets (crashes) the target, and then decrease it until right below where resets occur. This is where maximum disruption without crashing happens.
Hint 4
If you see a reset on a certain glitch duration, and just decreasing the glitch duration by 1 doesn't reset anymore but also doesn't seem to corrupt the counters printed to the screen at all, try different glitch cables between the Bolt and target board. The DuPont cables of the ST-Link that came with your Bolt should work. Connect 2x GND and 1x SIG from the Bolt to VMCU on the target, using the 3 pin header on the target. If you're still having trouble with this challenge, please reach out on our discord server so we can help out.
Solution
By glitching the target board's VCC with the correct duration, register values can be corrupted and instructions can be skipped, causing the conditional check to get corrupted and the flag to be printed.
Use the DuPont cables that came with the ST-Link in your Bolt kit.
Connect the two GND pins of the glitcher output to the two GND pins on the target's GND/VMCU/GND pin header (using two GND cables instead of one helps make the glitch signal more crisp).
Connect the glitcher's glitch output pin (SIG) to the targets VMCU pin header (you can also use a probe on the VMCU probe testpoint on the board, but it's harder to get a reliable glitch that way).
Start the challenge by holding the chall2 button.
Find the smallest glitch duration that triggers a complete reset of the target board, using e.g. `python3 -c "from scope import Scope;s=Scope();s.glitch.repeat=92;a=[s.trigger() for i in range(50000)]"` (s.glitch.repeat is the number of 8.3ns clock cycles to keep the glitch asserted). This continuously triggers a glitch, and you can press ctrl+C to stop it.
Slowly walk down the glitch duration (or, if you'd like, perform a binary search by hand for faster results) such that the target does not reset, but `i`, `j`, and `cnt` do get corrupted. Running the challenge long enough with these corruptions results in getting the flag:
Note: if corruption does occur, but the flag doesn't get printed, try stopping the glitch, power cycling the target board, run CHALL2, and start glitching again.
