Raspberry Pi Asked Researchers to Break Its New Chip. They Used a Laser.

The "permanent" debug-disable on Raspberry Pi's RP2350 microcontroller is a fuse, not a wall, and a laser can flip it back. Researchers at Ledger Donjon, the hardware security arm of the crypto-wallet company, used the chip's own faint photon emissions to localize a register that gates Secure debug, then pulsed a focused laser at two nearby positions to flip two bits and restore debug access on an A4 stepping where it had been designed to be irreversible. A separate maneuver, a hardware rescue reset racing the chip's firmware lock, read a secret from one-time-programmable memory before the runtime guard could land.

The RP2350 is Raspberry Pi's flagship microcontroller, a dual-core part where each socket can boot as an Arm Cortex-M33 or a RISC-V Hazard3 core. It carries a secure boot path that stores public-key fingerprints in OTP, Armv8-M TrustZone-M for separating secure and non-secure code, and a permanent debug-disable fuse intended to lock out production parts. The A4 revision, the one Ledger Donjon tested, is the step Raspberry Pi shipped after the company ran its 2024 RP2350 Hacking Challenge and absorbed the prior round of outside findings.

The first trick was finding the right register. On a decapped chip, switching transistors leak tiny amounts of light, and differential photon-emission microscopy picks that light up well enough to map activity down to individual logic blocks. The team watched the chip's debug state machine and triangulated a register whose access pattern matched the enable signal. That narrowed the laser target from a few square millimeters of silicon to a few square micrometers.

The second trick was the laser itself. Laser fault injection pulses a focused beam at a precise instant to flip individual bits inside a transistor without destroying it. Two well-timed pulses on adjacent positions inside that register cleared the debug-disable fuse and put the chip back into a state where the Secure debug interface would accept a connection. The full chain, decapsulation, photon mapping, two laser shots, ran on a setup the lab values at roughly $250,000, and it requires the chip to be in hand and physically prepared.

The OTP read is a separate finding and a sharper one. OTP is memory whose bits can be flipped from 0 to 1 once and never back, the durable place a chip stores keys and security configuration that must survive power cycles. The RP2350 datasheet organizes that memory in 128-byte pages guarded by two persistent lock rows, PAGEn_LOCK0 for keys and PAGEn_LOCK1 for hardware permission state, with a one-way transition and a three-of-eight redundant vote for security-critical fields. Pulling a hardware reset at the right moment halted the chip before firmware could apply its runtime lock, leaving a Secure-readable page from which the team recovered a secret that should have been locked away.

Physical access, destructive decapsulation, the photon-emission rig, the laser, and timing know-how: those are the requirements. The $250,000 equipment figure reflects the Ledger Donjon lab, not a per-attack cost, and HN commenters note that comparable fault-injection work has been replicated for under $25,000 once the technique is documented, with basic electromagnetic fault injection on a Pico-class board running closer to $50. A remote or software-only framing of this result would be wrong.

The cleaner read is iterative. Raspberry Pi has shipped the matching boot ROM source and treats the next stepping as the place to absorb this round of feedback from its open Hacking Challenge. The lab's own disclosure pull request is the public artifact, not a quiet drop.

The defense that holds is the secret itself, placed in OTP with the assumption that a determined, well-equipped lab can read it. "Permanent" debug-disable fuses are physically reversible, and a hardware reset at the right moment beats the firmware lock.