Photon-emission microscopy located a register enabling debug features on the Raspberry Pi microcontroller. Laser pulses at two nearby positions restored debugger access to the chip’s Secure world, even though debug had been permanently disabled. Using that access after a rescue reset, we recovered a secret from one-time-programmable memory. The reset halted the chip before firmware could apply its runtime lock, so the page stayed Secure-readable. The attack requires physical access, destructive preparation, and approximately $250,000 of laboratory equipment.

The RP2350 is Raspberry Pi’s dual-core microcontroller: each processor socket can select either an Arm Cortex-M33 or a RISC-V Hazard3 core at boot. Its hardware security features include Secure boot, Armv8-M TrustZone, permanent debug-disable settings, and glitch detectors. Raspberry Pi invited researchers to evaluate these protections through its RP2350 Hacking Challenges. The first challenge ran from August to December 2024 against the original chip. After several findings were addressed, Raspberry Pi released the A4 revision—the version we tested.

The permanent security configuration and boot public key fingerprints are stored in one-time-programmable (OTP) memory: each bit can be flipped from 0 to 1 once and never back. OTP is organised into 128-byte pages protected by two persistent lock rows. At an OTP reset, the persistent LOCK_S and LOCK_NS values initialise a per-page runtime lock. Firmware can tighten this lock but cannot loosen it. The runtime change does not survive that reset.

An external debugger communicates through Arm’s Serial Wire Debug (SWD) interface. Secure debug refers to Mem-AP access with Secure attribution. The permanent CRIT1.DEBUG_DISABLE flag closes this path. When set, it drives the enable signals for both cores’ Mem-APs to zero, preventing bus accesses. The SW-DP and RP-AP still respond, but neither core Mem-AP can access the system bus. However, the memory-mapped DEBUGEN register lets Secure software re-enable each core’s Mem-AP and Secure accesses. The datasheet states that DEBUG_DISABLE “can be fully overridden by setting all bits of this register”.