Ledger's Donjon hardware security team used photon-emission microscopy and precision infrared lasers to defeat the RP2350's fused debug locks, prompting Raspberry Pi to publicly confirm the breach.
Security researchers at Ledger's Donjon hardware lab announced on 18 September 2026 that they had successfully re-enabled secure debug access on a locked Raspberry Pi RP2350 microcontroller and extracted a 128-bit secret key from its one-time programmable memory, using a technique called photon-emission-guided laser fault injection. Raspberry Pi confirmed the result the same day in a blog post titled "Everything is better with lasers," and Hackaday detailed the methodology in a report published 19 September 2026. The target was an RP2350-A4 chip that Raspberry Pi had deliberately locked down as part of a public security challenge, with secure boot, ARMv8 TrustZone partitioning, glitch detection, and OTP fuses such as DEBUG_DISABLE and SECURE_DEBUG_DISABLE all enabled according to the company's recommended provisioning procedures.
How Donjon Located and Exploited a Single Vulnerable Register
The Donjon team began by decapsulating the chip — physically removing its protective packaging to expose the bare silicon die — and then used photon-emission microscopy to observe light emitted by transistors during operation. This allowed researchers to map specific physical locations on the die to functional registers, eventually identifying the exact register responsible for enabling debug features, including secure debug access to the chip's protected core.
With that target identified, the team decapped a second chip from the back side so an infrared laser could fire directly through the silicon substrate. Using a pulsed laser at approximately 980 nanometers wavelength, set to roughly 1.2 watts of optical power out of a maximum 2.97 watts, and focused through a 50x objective lens, researchers fired 100-nanosecond pulses at systematically tested positions on the die. According to Donjon's technical write-up, "laser pulses at two nearby positions then restored debugger access to the chip's Secure world, even though debug had been permanently disabled."
From Bit-Flip to Full Key Extraction
The attack sequence required precise choreography with the chip's internal state. Researchers first triggered a "rescue reset" by setting and then clearing the CTRL.RESCUE_RESTART flag to place the chip into a recoverable condition, then placed it into controlled boot ROM wait paths with debug control registers preconfigured. Targeted laser pulses then flipped the DEBUGEN register to a value of 0xc, specifically manipulating bit settings tied to PROC1 and PROC1_SECURE, effectively overriding the OTP fuses that were supposed to make debug disablement permanent.
Once secure debug access was restored, the team used standard ARM debugging tools — specifically the Mem-AP interface and the Debug Halting Control and Status Register — to halt the chip's secure core. From there, researchers read out protected OTP contents, recovering the 128-bit secret key that Raspberry Pi had hidden inside the chip specifically for this challenge. Raspberry Pi's own account corroborates the outcome, stating the Donjon team "re-enabled the debug interface on a secured RP2350-A4 chip" and enabled "OTP readout" through the laser-guided technique.
Why the RP2350 Was Considered Hard to Break
The RP2350, which powers products including the Raspberry Pi Pico 2, was engineered specifically to resist exactly this class of attack. Hackaday's coverage notes the chip "has secure boot, ARMv8's TrustZone to split secure and non-secure execution, and you can permanently disable debug" — and crucially, "the Pi Foundation even included glitch detection, meaning the traditional 'zap the chip until it obeys' technique is blocked." Documentation from the PicoKeys project shows that Raspberry Pi's provisioning process locks entire OTP pages containing cryptographic key material after fuses are set, specifically to prevent later direct access.
This layered defense reflects lessons from earlier fault-injection research. A budget laser fault injection project targeting the RP2350 in January 2025, documented by independent researcher Courk, used a different infrared wavelength of 1064 nanometers to manipulate QSPI bus reads during boot — a precursor approach that operated within different constraints than Donjon's later photon-emission-guided method. Raspberry Pi's decision to add glitch detection and fused secure-debug-disable options was a direct response to that kind of earlier threat, raising the technical bar substantially before Donjon's breakthrough.
Raspberry Pi's Response and the Real-World Threat Assessment
Raspberry Pi's public reaction was notably measured rather than alarmed. The company acknowledged that "if you have a lab full of smart, motivated people with about $250,000 worth of specialised microscopy and laser equipment, you too can re-enable the debug interface on a secured RP2350-A4 chip." The Foundation emphasized several mitigating factors: the attack is destructive, requiring the chip to be physically removed and de-encapsulated; it operates on a single-device basis, especially where manufacturers use unique per-device keys rather than shared secrets; and it demands what the company called "a very particular set of skills, together with a lab full of bougie equipment and/or a spare $250K."
Reaction from the broader hardware security community, including discussion on aggregator sites like Hacker News, has focused on praising the transparency of both Donjon's and Raspberry Pi's technical disclosures, alongside recognition of the sophistication required for photon-emission-guided targeting. Russian-language technical coverage of the attack underscored the extensive trial-and-error positioning needed to locate the exact die coordinates where laser energy reliably flipped the intended bits, reinforcing that replication remains impractical outside well-funded laboratories.
What Comes Next for Chip Security Design
Raspberry Pi and Ledger have both published detailed technical accounts of the attack, a transparency that industry observers expect to drive further hardening of future microcontroller designs. Likely responses include relocating or redundantly encoding critical debug-enable registers so that a single successful laser pulse cannot flip a security-critical bit, alongside expanded guidance to device manufacturers on using unique per-device secrets and locked OTP pages to prevent a single compromised unit from threatening an entire product line.
For the vast majority of consumers and commercial deployers using RP2350-based products, the practical risk remains minimal given the roughly $250,000 equipment cost and specialized expertise required. However, for high-value targets and critical infrastructure applications, the research is a reminder that no fused, "permanently disabled" hardware protection is absolute against a sufficiently resourced physical attacker — reinforcing the industry principle that layered security must assume eventual physical compromise by capable adversaries.
