ChipWhisperer Adapter Helps Reverse-Engineer A Controversial Game Cartridge

The Chipwhisperer adapter plugged into a ChipWhisperer, with the STM chip mentiuoned soldered on

The ChipWhisperer has been a breakthrough in hobbyist use of power analysis and glitching attacks on embedded hardware. If you own one, you surely have seen the IDC and SMA sockets on it – usable for connecting custom breakouts housing a chip you’re currently probing. Today, [MAVProxyUser] brings us a ChipWhisperer adapter for STM32F446ZEJx, which comes in a UFBGA144 package – and the adapter has quite a backstory to it.

In retro gaming world, a crowdfunding campaign for a game called PAPRIUM has seen a huge success getting funded in 2017. However, the campaign has grossly underdelivered throughout the last five years, and out of those rare cartridges delivered to backers, quite a few have faulty hardware. Getting replacements isn’t realistic at this point, so the repair attempts and game preservation efforts have been ongoing. Trouble is – there are protection mechanisms against dumping the cartridges, and one of the protection mechanisms is the built-in flash read protection of the aforementioned STM32 found on the cartridge. This board adapts the chip to a ChipWhisperer interface for protection bypass exploration, and has quite a few configuration jumpers anyone facing a similar chip is able to use – Eagle files are out there as well, in case your chip needs a slightly different approach.

With reverse-engineering underway, are we likely to see this cartridge’s defenses fall? Our assessment is ‘yes’ – it’s not like there’s a shortage of mechanisms for bypassing security ; from modchips to EMP attacks to blasting the die with a laser, hardware-reliant security is, still, quite bypassable. All in all, despite the drama around the project, this is one more reference design for the ChipWhisperer, and a fun journey to look forward to.

7 thoughts on “ChipWhisperer Adapter Helps Reverse-Engineer A Controversial Game Cartridge

  1. Remember when Hackaday ran a design contest, and in total surprise to many readers awarded the grand prize to a project almost no one cared about instead of a practically useful tool that is directly relevant to what many of us are actually interested in?

    Who are we still talking about 9 years later? I’ll give you a hint.. this post is about them… and it’s not satNOGS.

    So is the ChipWhisperer a “breakthrough” or is it a second place project to a thing that Wikipedia can only describe with buzzword salad?

    “SatNOGS (Satellite Networked Open Ground Station) project is a free software and open source hardware platform aimed to create a satellite ground station network. The scope of the project is to create a full stack of open technologies based on open standards, and the construction of a full ground station as a showcase of the stack”

    OK, after reading that I should really apologize. I guess the 200K (instead of SPACE!!111) must have bought them one of those “full stacks”.

    1. I bought into the satnogs thing – I have a funky fluorescent green SDR in a drawer somewhere, it is a nicely engineered product. It’s a shame the project as a whole seems to have lost momentum, and although I’ve still had a fair bit of fun with the SDR I can’t help but feel I’ve not got as much out of it as I could have done.

      Perhaps there’s scope for Tindie to have a child with Patreon so projects like chip whisperer and satnogs have a platform that provides both financial and moral support on an on-going basis.

      PS. Chuck in a discussion board for good measure.

      1. I have been having a blast with SDR recently. Rekindled my usage of rtl_433, created .cu8’s from scratch with python and tx_tools, set up trunked p25 radio and listened to police/fire, aircraft tracking. Even bought a higher end chinese clone SDR.

        There is always something to look at and explore!

        1. You’re right, of course. If I lived in an urban environment I’d have more opportunity – I haven’t seen a police car in, errr, 3 years, probably. And TETRA is a whole different kettle of fish to P25.
          The point stands, though – subscription support as an option for projects like this might give them longer legs.

  2. I naively ordered a copy of PAPRIUM back in Dec 2019 and have not recieved anything. Nothing at all. Sent emails, no responses. Just sob stories of how paypal stole all their money and whatever. I just want my game that I paid money for, but I highly doubt at this point im gonna get it.

    1. i pre-ordered a copy of Pier Solar at the 3’rd run May of 2014.
      it was payed and everything but when it was time to ship was when Tulio left the company and everything hit the fan over there and Fonzie kicked most out the door.
      “paypal this and that” was the excuse that time too (though my money was received by em long before that problem occurred)
      got hold of someone that worked there that recalled that my package was on the shelf ready together with a load more that was for international customers.
      an amount that was very similar to the amount that Fonzie “just happen” to get for the kickstart campaign of PAPRIUM…

      with all this in mind is a reason why i didn’t use a single dime on that kickstart.

Leave a Reply

Please be kind and respectful to help make the comments section excellent. (Comment Policy)

This site uses Akismet to reduce spam. Learn how your comment data is processed.