From jsato@unam.mx Mon Jun 12 18:40:04 1995 Path: ashpoly!cascade!mxgate!coyoacan!unam!jsato From: jsato@unam.mx (Ji-woo Sato) Newsgroups: comp.sys.m68k Subject: [FLAME] Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Jun12.184004.9958@unam.mx> Date: Mon, 12 Jun 1995 18:40:04 GMT Organization: Universidad Nacional Autónoma de México (DGSCA) NNTP-Posting-Host: unam.mx X-Newsreader: WinVN 0.99.5 Lines: 11 Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14. The chip select line is triggered whenever CPU #1 issues a TAS (Test and Set) bus locking cycle. Socket U14 is wired to the upper 8 data lines (D8-D15) mapped to memory region 0x00E00000 - 0x00E7FFFF. Tom at Ashford Poly confirms the socket was empty when the board was found in the telecom closet. -- === Ji-woo Sato === Dept of Electrical Engineering, Universidad Nacional Autónoma de México (DGSCA) "When every node is whole, the channel opens." From dtakahashi@delphi.com Wed Jun 14 13:55:04 1995 Path: ashpoly!cascade!brgate!saturno!delphi!dtakahashi From: dtakahashi@delphi.com (Dong-hyun Takahashi) Newsgroups: comp.sys.m68k Subject: Re: [FLAME] Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Jun14.135504.4144@delphi.com> Date: Wed, 14 Jun 1995 13:55:04 GMT References: <1995Jun12.184004.9958@unam.mx> Organization: Delphi Internet Services NNTP-Posting-Host: delphi.com X-Newsreader: WinVN 0.99.5 Lines: 11 In article <1995Jun12.184004.9958@unam.mx>, jsato@unam.mx (Ji-woo Sato) writes: > Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14. If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! Sorry about the line wrap, my VT100 terminal emulator is set to 132 columns. -- Dong-hyun Takahashi | dtakahashi@delphi.com PGP Key fingerprint: 318C A4F9 257A 3A7F "Keep the channels open." From sreyes@mindspring.com Wed Jun 14 22:11:04 1995 Path: ashpoly!cascade!transat!eunet-de!hansebox!mindspring!sreyes From: sreyes@mindspring.com (Sven Reyes) Newsgroups: comp.sys.m68k Subject: Re: [FLAME] Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Jun14.221104.4281@mindspring.com> Date: Wed, 14 Jun 1995 22:11:04 GMT References: <1995Jun12.184004.9958@unam.mx> Organization: MindSpring Enterprises NNTP-Posting-Host: mindspring.com X-Newsreader: Netscape 1.1N Lines: 10 In article <1995Jun12.184004.9958@unam.mx>, jsato@unam.mx (Ji-woo Sato) writes: > Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14. > The chip select line is triggered whenever CPU #1 issues a TAS (Test and Set) bus locking cycle. If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! -- Sven Reyes Zyxel U-1496E @ 14,400 bps "A soul is not exclusive to biology." From dito@uu.net Thu Jun 15 13:46:04 1995 Path: ashpoly!bigsur!pacrim!jpgate!kamome!uu!dito From: dito@uu.net (Dave Ito) Newsgroups: comp.sys.m68k Subject: Re: [FLAME] Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Jun15.134604.4122@uu.net> Date: Thu, 15 Jun 1995 13:46:04 GMT References: <1995Jun12.184004.9958@unam.mx> <1995Jun14.221104.4281@mindspring.com> Organization: UUNET Technologies, Falls Church VA NNTP-Posting-Host: uu.net X-Newsreader: Netscape 1.1N Lines: 9 In article <1995Jun14.221104.4281@mindspring.com>, sreyes@mindspring.com (Sven Reyes) writes: > If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! Using an S-box in a 27256 EPROM for single-cycle hardware substitution was standard military cipher practice in 1984. -- === Dave Ito === Dept of Electrical Engineering, UUNET Technologies, Falls Church VA "The hatch is open. Is anyone listening?"