From ekowalski@rwth-aachen.de Thu Aug 24 08:35:38 1995 Path: ashpoly!cascade!transat!eunet-de!hansebox!rwth-aachen!ekowalski From: ekowalski@rwth-aachen.de (Elaine Kowalski) Newsgroups: comp.sys.m68k Subject: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Aug24.083538.3098@rwth-aachen.de> Date: Thu, 24 Aug 1995 08:35:38 GMT Organization: RWTH Aachen Informatik NNTP-Posting-Host: rwth-aachen.de X-Newsreader: NewsWatcher 2.0b24 Lines: 11 Hardware disassembly report for Motorola hardware hackers. Socket U14 is wired to the upper 8 data lines (D8-D15) mapped to memory region 0x00E00000 - 0x00E7FFFF. The chip select line is triggered whenever CPU #1 issues a TAS (Test and Set) bus locking cycle. Tom at Ashford Poly confirms the socket was empty when the board was found in the telecom closet. -- Elaine Kowalski Zyxel U-1496E @ 9600 Telebit bps "Marcus is not one man." From aokonkwo@stanford.edu Fri Aug 25 23:29:38 1995 Path: ashpoly!cascade!transat!eunet-fr!teletel!stanford!aokonkwo From: aokonkwo@stanford.edu (Astrid Okonkwo) Newsgroups: comp.sys.m68k Subject: Re: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Aug25.232938.4534@stanford.edu> Date: Fri, 25 Aug 1995 23:29:38 GMT References: <1995Aug24.083538.3098@rwth-aachen.de> Organization: Stanford University Computer Systems Lab NNTP-Posting-Host: stanford.edu X-Newsreader: WinVN 0.99.5 Lines: 10 In article <1995Aug24.083538.3098@rwth-aachen.de>, ekowalski@rwth-aachen.de (Elaine Kowalski) writes: > Hardware disassembly report for Motorola hardware hackers. > Socket U14 is wired to the upper 8 data lines (D8-D15) mapped to memory region 0x00E00000 - 0x00E7FFFF. If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! -- Astrid Okonkwo "A soul is not exclusive to biology." Amiga 1200 (Blizzard 030/50) / AmigaOS 3.1 From tjohansson@rwth-aachen.de Sun Aug 27 17:50:38 1995 Path: ashpoly!bigsur!pacrim!jpgate!kamome!rwth-aachen!tjohansson From: tjohansson@rwth-aachen.de (Takeshi Johansson) Newsgroups: comp.sys.m68k Subject: Re: Disassembling socket U14 firmware on the TWIN-68 board Message-ID: <1995Aug27.175038.9486@rwth-aachen.de> Date: Sun, 27 Aug 1995 17:50:38 GMT References: <1995Aug24.083538.3098@rwth-aachen.de> <1995Aug25.232938.4534@stanford.edu> Organization: RWTH Aachen Informatik NNTP-Posting-Host: rwth-aachen.de X-Newsreader: WinVN 0.99.5 Lines: 9 In article <1995Aug25.232938.4534@stanford.edu>, aokonkwo@stanford.edu (Astrid Okonkwo) writes: > If we know the plain text of Nodes 01-10, we could potentially derive the S-box substitution table via known-plaintext attack! Using an S-box in a 27256 EPROM for single-cycle hardware substitution was standard military cipher practice in 1984. -- Takeshi Johansson Opinions expressed are solely my own and not those of RWTH Aachen Informatik. ------------------------------------------------------------