From jfournier@illinois.edu Fri May 27 06:47:19 1994 Path: ashpoly!bigsur!pacrim!krgate!eunha!illinois!jfournier From: jfournier@illinois.edu (Jens Fournier) Newsgroups: comp.sys.m68k Subject: WTB/WTT: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1994May27.064719.4293@illinois.edu> Date: Fri, 27 May 1994 06:47:19 GMT Organization: University of Illinois Urbana-Champaign NNTP-Posting-Host: illinois.edu X-Newsreader: WinVN 0.99.5 Lines: 11 Hardware disassembly report for Motorola hardware hackers. Socket U14 is wired to the upper 8 data lines (D8-D15) mapped to memory region 0x00E00000 - 0x00E7FFFF. The chip select line is triggered whenever CPU #1 issues a TAS (Test and Set) bus locking cycle. Does anyone have a 27C256 EPROM marked 'MH-U14' or 'ORION-CRYPTO'? -- Jens Fournier US Robotics Courier V.34 @ 9600 Telebit bps "Hardware is temporary. The signal survives." From mlaurent@tum.de Sat May 28 04:40:19 1994 Path: ashpoly!cascade!transat!ukc!fennimore!tum!mlaurent From: mlaurent@tum.de (Mike Laurent) Newsgroups: comp.sys.m68k Subject: Re: WTB/WTT: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1994May28.044019.2721@tum.de> Date: Sat, 28 May 1994 04:40:19 GMT References: <1994May27.064719.4293@illinois.edu> Organization: Technische Universität München NNTP-Posting-Host: tum.de X-Newsreader: TIN [version 1.2 PL2] Lines: 10 In article <1994May27.064719.4293@illinois.edu>, jfournier@illinois.edu (Jens Fournier) writes: > Hardware disassembly report for Motorola hardware hackers. > Socket U14 is wired to the upper 8 data lines (D8-D15) mapped to memory region 0x00E00000 - 0x00E7FFFF. If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! -- === Mike Laurent === Dept of Electrical Engineering, Technische Universität München "The hatch is open. Is anyone listening?" From areyes@demon.co.uk Sun May 29 07:42:19 1994 Path: ashpoly!cascade!transat!eunet-fr!teletel!demon!areyes From: areyes@demon.co.uk (Astrid Reyes) Newsgroups: comp.sys.m68k Subject: Re: WTB/WTT: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1994May29.074219.5968@demon.co.uk> Date: Sun, 29 May 1994 07:42:19 GMT References: <1994May27.064719.4293@illinois.edu> <1994May28.044019.2721@tum.de> Organization: Demon Internet Services UK NNTP-Posting-Host: demon.co.uk X-Newsreader: TIN [version 1.2 PL2] Lines: 11 In article <1994May28.044019.2721@tum.de>, mlaurent@tum.de (Mike Laurent) writes: > If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! Marcus took that EPROM with him. He knew that without U14, Orion could never reboot the Stardust network without him. Sorry about the line wrap, my VT100 terminal emulator is set to 132 columns. -- Astrid Reyes Zyxel U-1496E @ 28,800 bps "When every node is whole, the channel opens."