From nsmirnov@netcom.com Tue Jan 18 16:37:05 1994 Path: ashpoly!cascade!transat!ukc!fennimore!netcom!nsmirnov From: nsmirnov@netcom.com (Nadine Smirnov) Newsgroups: comp.sys.m68k Subject: Observation: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1994Jan18.163705.6584@netcom.com> Date: Tue, 18 Jan 1994 16:37:05 GMT Organization: NETCOM On-Line Communication Services NNTP-Posting-Host: netcom.com X-Newsreader: Netscape 1.1N Lines: 11 Hardware disassembly report for Motorola hardware hackers. Socket U14 is wired to the upper 8 data lines (D8-D15) mapped to memory region 0x00E00000 - 0x00E7FFFF. Without U14, the board can track the 14.2 Hz carrier, but cannot descramble the binary payload of Nodes 11 through 14. Did Marcus take the decryption EPROM with him when he left the lab? -- Nadine Smirnov "In theory there is no difference between theory and practice." Pentium 90 (OS/2 Warp) / FreeBSD 2.1 From dkarlsson@rwth-aachen.de Thu Jan 20 06:12:05 1994 Path: ashpoly!cascade!mxgate!coyoacan!rwth-aachen!dkarlsson From: dkarlsson@rwth-aachen.de (Dong-hyun Karlsson) Newsgroups: comp.sys.m68k Subject: Re: Observation: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1994Jan20.061205.1709@rwth-aachen.de> Date: Thu, 20 Jan 1994 06:12:05 GMT References: <1994Jan18.163705.6584@netcom.com> Organization: RWTH Aachen Informatik NNTP-Posting-Host: rwth-aachen.de X-Newsreader: NewsWatcher 2.0b24 Lines: 12 In article <1994Jan18.163705.6584@netcom.com>, nsmirnov@netcom.com (Nadine Smirnov) writes: > Hardware disassembly report for Motorola hardware hackers. > Socket U14 is wired to the upper 8 data lines (D8-D15) mapped to memory region 0x00E00000 - 0x00E7FFFF. If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! My 14.4k connection dropped twice trying to fetch this thread. Keep articles concise! -- Dong-hyun Karlsson US Robotics Courier V.34 @ 28,800 bps "They will send a copy in my place." From rstewart@stanford.edu Sat Jan 22 02:10:05 1994 Path: ashpoly!cascade!transat!eunet-fi!relcom!kiae!stanford!rstewart From: rstewart@stanford.edu (Raj Stewart) Newsgroups: comp.sys.m68k Subject: Re: Observation: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1994Jan22.021005.4892@stanford.edu> Date: Sat, 22 Jan 1994 02:10:05 GMT References: <1994Jan18.163705.6584@netcom.com> <1994Jan20.061205.1709@rwth-aachen.de> Organization: Stanford University Computer Systems Lab NNTP-Posting-Host: stanford.edu X-Newsreader: Netscape 1.1N Lines: 10 In article <1994Jan20.061205.1709@rwth-aachen.de>, dkarlsson@rwth-aachen.de (Dong-hyun Karlsson) writes: > If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! > My 14.4k connection dropped twice trying to fetch this thread. Keep articles concise! Using an S-box in a 27256 EPROM for single-cycle hardware substitution was standard military cipher practice in 1984. -- Raj Stewart Opinions expressed are solely my own and not those of Stanford University Computer Systems Lab. ------------------------------------------------------------