From adubois@pipeline.com Fri May 10 19:52:42 1996 Path: ashpoly!bigsur!pacrim!jpgate!kamome!pipeline!adubois From: adubois@pipeline.com (Anja Dubois) Newsgroups: comp.sys.m68k Subject: [FLAME] Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1996May10.195242.2112@pipeline.com> Date: Fri, 10 May 1996 19:52:42 GMT Organization: The Pipeline Internet Network NNTP-Posting-Host: pipeline.com X-Newsreader: WinVN 0.99.5 Lines: 11 Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14. Without U14, the board can track the 14.2 Hz carrier, but cannot descramble the binary payload of Nodes 11 through 14. Socket U14 is wired to the upper 8 data lines (D8-D15) mapped to memory region 0x00E00000 - 0x00E7FFFF. Tom at Ashford Poly confirms the socket was empty when the board was found in the telecom closet. -- === Anja Dubois === Dept of Electrical Engineering, The Pipeline Internet Network "5 sigma is a discovery. 7 is a question." From jkang@cam.ac.uk Fri May 10 21:25:42 1996 Path: ashpoly!bigsur!pacrim!jpgate!kamome!cam!jkang From: jkang@cam.ac.uk (Julien Kang) Newsgroups: comp.sys.m68k Subject: Re: [FLAME] Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1996May10.212542.1141@cam.ac.uk> Date: Fri, 10 May 1996 21:25:42 GMT References: <1996May10.195242.2112@pipeline.com> Organization: University of Cambridge Computer Laboratory NNTP-Posting-Host: cam.ac.uk X-Newsreader: NewsWatcher 2.0b24 Lines: 9 In article <1996May10.195242.2112@pipeline.com>, adubois@pipeline.com (Anja Dubois) writes: > Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14. If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! -- Julien Kang "Row 14. No joke." Commodore Amiga 500 (1MB OCS) / Linux 1.2.13 From claurent@illinois.edu Sat May 11 03:10:42 1996 Path: ashpoly!bigsur!pacrim!jpgate!kamome!illinois!claurent From: claurent@illinois.edu (Callum Laurent) Newsgroups: comp.sys.m68k Subject: Re: [FLAME] Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1996May11.031042.5103@illinois.edu> Date: Sat, 11 May 1996 03:10:42 GMT References: <1996May10.195242.2112@pipeline.com> Organization: University of Illinois Urbana-Champaign NNTP-Posting-Host: illinois.edu X-Newsreader: NewsWatcher 2.0b24 Lines: 11 In article <1996May10.195242.2112@pipeline.com>, adubois@pipeline.com (Anja Dubois) writes: > Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14. That's why Line 08 says: 'WHEN EVERY NODE IS WHOLE, THE CHANNEL OPENS.' It requires all physical keys. Top-posters will be placed in my ~/.killfile without notice. -- Callum Laurent US Robotics Courier V.34 @ 28,800 bps "Tape doesn't lie at 02:14. Ears do." From flaurent@ox.ac.uk Sat May 11 16:05:42 1996 Path: ashpoly!cascade!transat!eunet-fr!teletel!ox!flaurent From: flaurent@ox.ac.uk (Fiona Laurent) Newsgroups: comp.sys.m68k Subject: Re: [FLAME] Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1996May11.160542.7775@ox.ac.uk> Date: Sat, 11 May 1996 16:05:42 GMT References: <1996May10.195242.2112@pipeline.com> Organization: Oxford University Computing Laboratory NNTP-Posting-Host: ox.ac.uk X-Newsreader: Netscape 1.1N Lines: 9 In article <1996May10.195242.2112@pipeline.com>, adubois@pipeline.com (Anja Dubois) writes: > Tracing the address decoder lines on the motherboard reveals what was supposed to be in socket U14. Using an S-box in a 27256 EPROM for single-cycle hardware substitution was standard military cipher practice in 1984. -- === Fiona Laurent === Dept of Electrical Engineering, Oxford University Computing Laboratory "Measuring a record you own is listening, not piracy."