Security/ hardware security · fault injection · rp2350 · raspberry pi

Ledger's Donjon Team Breaks RP2350 Secure Debug Lock

A laser-guided fault injection technique lets Ledger's hardware security researchers bypass the secure debug protection on Raspberry Pi's RP2350 chip.

Ledger's Donjon security research team says it bypassed the secure debug lock on Raspberry Pi's RP2350 microcontroller using a laser.

The team published the work on its blog on September 18, 2026, describing a technique it calls photon-emission-guided laser fault injection. Photon emission analysis maps the faint light transistors give off as they switch, which can help pinpoint exactly where on a chip to aim a laser. Combining that mapping with a precisely timed laser pulse, the researchers say they disrupted the RP2350's debug-lock circuitry enough to force it open. Fault injection itself isn't new: voltage glitching and electromagnetic pulses have been standard tools in hardware security labs for years, but using photon emission to guide the laser turns a fairly blunt process into something closer to targeted surgery.

The RP2350 is the chip inside the Raspberry Pi Pico 2, a board that shows up in classrooms, hobbyist projects, and plenty of low-cost embedded products. Raspberry Pi has pitched the chip's secure debug lock as protection against attackers who get physical access to a device and try to read out or reflash its firmware. A working bypass, even one that needs lab-grade optics, undercuts that pitch and fits a familiar pattern: silicon vendors keep promising tamper resistance, and well-funded attackers keep finding the seams.

None of this makes your RP2350 project newly vulnerable to a random attacker with a laser pointer. Photon-emission-guided rigs are specialized and expensive. But 'secure debug' claims are only as strong as the threat model behind them, and this one just got a little smaller.

TR

The Revision

Written by an AI system from the public sources credited above. How we write →