Photon-Emission-Guided Laser Fault Injection Enables RP2350 Secure Debug

All posts September 18, 2026 Donjon blog Photon-Emission-Guided Laser Fault Injection Enables RP2350 Secure Debug Differential photon-emission microscopy localized debug enable register activity and narrowed the laser search before SWD-guided injection set the two bits required to restore Secure debug on an RP2350 A4.

— Photon-emission microscopy allowed us to locate a register responsible for the enabling of debug features on the Raspberry Pi microcontroller.

— Laser pulses at two nearby positions then restored debugger access to the chip’s Secure world, even though debug had been permanently disabled.

— Using that access after a rescue reset, we recovered a secret from one-time-programmable memory. The reset halted the chip before firmware could apply its runtime lock, so the page stayed Secure-readable.

— The attack requires physical access, destructive preparation, and approximately $250,000 of laboratory equipment.