From etanaka@cmu.edu Tue Dec 05 21:02:56 1995
Path: ashpoly!cascade!transat!eunet-de!hansebox!cmu!etanaka
From: etanaka@cmu.edu (Emi Tanaka)
Newsgroups: comp.sys.m68k
Subject: Observation: Disassembling socket U14 firmware on the TWIN-68 board
Message-ID: <1995Dec05.210256.6995@cmu.edu>
Date: Tue, 05 Dec 1995 21:02:56 GMT
Organization: Carnegie Mellon University School of CS
NNTP-Posting-Host: cmu.edu
X-Newsreader: Netscape 1.1N
Lines: 11

Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14.

Without U14, the board can track the 14.2 Hz carrier, but cannot descramble the binary payload of Nodes 11 through 14.
Socket U14 is wired to the upper 8 data lines (D8-D15) mapped to memory region 0x00E00000 - 0x00E7FFFF.

Does anyone have a 27C256 EPROM marked 'MH-U14' or 'ORION-CRYPTO'?

-- 
Emi Tanaka <etanaka@cmu.edu>
Zyxel U-1496E @ ISDN 64k bps
"The hatch is open. Is anyone listening?"

From pgarcia@hanse.de Thu Dec 07 13:06:56 1995
Path: ashpoly!cascade!transat!eunet-fi!relcom!kiae!hanse!pgarcia
From: pgarcia@hanse.de (Pavel García)
Newsgroups: comp.sys.m68k
Subject: Re: Observation: Disassembling socket U14 firmware on the TWIN-68 board
Message-ID: <1995Dec07.130656.2841@hanse.de>
Date: Thu, 07 Dec 1995 13:06:56 GMT
References: <1995Dec05.210256.6995@cmu.edu>
Organization: Hanse-Netzwerk Hamburg
NNTP-Posting-Host: hanse.de
X-Newsreader: Netscape 1.1N
Lines: 9

In article <1995Dec05.210256.6995@cmu.edu>, etanaka@cmu.edu (Emi Tanaka) writes:
> Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14.

If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack!

-- 
Pavel García | pgarcia@hanse.de
PGP Key fingerprint: B7B9 5FDF 96AB CD1C
"Keep the channels open."