Laser pulses crack Raspberry Pi RP2350's permanent debug lock, exposing Secure world
Photon-Emission-Guided Laser Fault Injection Enables RP2350 Secure Debug
Ledger Donjon used photon-emission microscopy to pinpoint the register that re-enables debug on Raspberry Pi's RP2350, then fired laser pulses at two nearby spots to set the bits, restoring Secure debug access despite a permanent disable flag. After a rescue reset halted firmware before its runtime lock, they read a secret from one-time-programmable memory. The attack needs physical access, destructive chip preparation, and about $250,000 in lab gear.
Once both bits were set, they remained set without further pulses or software writes.