Researchers Bypass RP2350 Secure Debug Lock with Laser Fault Injection and Photon Emission Microscopy

Security researchers have successfully bypassed the permanent Secure Debug lock on the RP2350 microcontroller (revision A4) by combining photon emission microscopy with targeted laser fault injection.

The Raspberry Pi RP2350 is a dual-core device that can run either Arm Cortex-M33 or RISC-V Hazard3 cores. Its security architecture includes secure boot, TrustZone, permanent debug disable fuses stored in OTP memory, and active glitch detectors. After the first Hacking Challenge, Raspberry Pi released revision A4 with several fixes; the new research targeted this hardened silicon.

The team first used differential photon emission microscopy (PEM) to locate the physical transistors corresponding to the DEBUGEN register bits. By repeatedly toggling specific bits from secure-mode software and subtracting averaged infrared frames, they produced high-resolution maps that narrowed the target area to a few square micrometers.

With the locations identified, they performed laser fault injection using a 980 nm pulsed laser at approximately 1.2 W focused through a 50× objective. Two adjacent spots were found that respectively set the PROC1 and PROC1_SECURE bits. An automated script alternated between the two locations until both bits were correctly asserted, restoring full Secure Debug access through the Mem-AP port.

The attack works because the DEBUGEN register has no hardware redundancy or parity protection, unlike the OTP security fields. Once the bits are flipped, they remain set without further intervention, allowing an external debugger full read/write access to protected memory regions before firmware can re-apply soft locks.

Researchers note that the technique requires backside decapsulation, a high-end laser setup, and roughly $250,000 worth of laboratory equipment. It is therefore relevant primarily to sophisticated physical attackers rather than remote threats.