Photon-Emission-Guided Laser Fault Injection Enables RP2350 Secure Debug

Photon-emission microscopy pinpointed a debug-enable register on the RP2350 A4, allowing laser pulses at two nearby positions to restore Secure-world debugger access after the permanent debug-disable flag had been set. The restored access enabled a rescue reset that kept a one-time-programmable memory page Secure-readable, from which a secret was extracted. The attack requires physical access, destructive preparation, and roughly $250,000 in laboratory equipment.