Bypassing debug password protection on the RH850 family using fault injection

Introduction The RH850 family is a range of high-performance and high-reliability 32-bit microcontrollers for Renesas, dedicated to the automotive industry. These microcontrollers are the most common ones we have to work with in the various Electronic Control Units (ECU) we audit at Quarkslab. Like other microcontrollers, they embed a debug access for development purposes to flash new firmware or monitor its behavior. To ensure the firmware could not be extracted or tampered with in production, ...