How do you deal with stray code? - Page 1
Forum section: electronics / general

author: technix
author_rank: Super Contributor
timestamp: October 18, 2018, 02:18:37 pm
content: What do I mean stray code: when you buy used components with nonvolatile memory online, the previous owner or the seller might not have wiped the chip.For my old MCU and EEPROM I purchased I always test the chip before marking it as accepted on Taobao using my universal programmer, but from time to time this process reveals code stray on the chip. Usually I save it before wiping the chip, but how should I deal with those saved ROM images? I have no idea what hardware the code is for, often not knowing that architecture the code is for. (There was once that from some old AT28C256 revealed BIOS code for some SCSI card...)

author: Ampera
author_rank: Super Contributor
timestamp: October 18, 2018, 02:24:30 pm
content: I usually call up Assembly Control, and have the stray images taken to the local pound for either adoption or euthanasia.If it's just random code on some random PROM, save it, make sure it's not important, then toss it, unless you want it. It's like buying a used wallet and finding a library card in it, there's really just nothing much it does to you.

author: taydin
author_rank: Frequent Contributor
timestamp: October 18, 2018, 02:47:57 pm
content: I think the OP wants to know how to determine CPU architecture, given only machine code.I don't think there is an automated way to do this. But what would be possible is to build a list of possible architectures, disassemble for each, and then see if the assembly code generated is sensible. For example, subroutine calls should have proper prologue/epilogue at entry/exit, some registers should be loaded upon entering a subroutine and result should be stored in a register before returning.A human programmer can easily tell if a given disassembled code is REALLY code or if it's just a random bunch of bytes. This would be quite harder to do automatically using a software.

author: technix
author_rank: Super Contributor
timestamp: October 18, 2018, 03:05:05 pm
content: Quote from: taydin on October 18, 2018, 02:47:57 pmWill I get in trouble if I upload an example for you guys to see?

author: taydin
author_rank: Frequent Contributor
timestamp: October 18, 2018, 03:13:17 pm
content: Quote from: technix on October 18, 2018, 03:05:05 pmWhat you are trying to do is a time consuming process, and you are not likely to find somebody that will do it for free.But if I were you, I would get the IDA Pro disassembler, which supports disassembly of many different CPU architectures. It can also detect libraries of many toolchains automatically, using FLIRT () technology. I have no idea how much IDA costs, if you are a hobbyist, it might be too expensive.

author: technix
author_rank: Super Contributor
timestamp: October 18, 2018, 03:22:17 pm
content: Quote from: taydin on October 18, 2018, 03:13:17 pmI don't have IDA Pro and I am not really interested in finding out what the processor is - that might as well be configuration data for all I know. What I am asking is what is the polite and safe way of handling it.

author: bd139
author_rank: Super Contributor
timestamp: October 18, 2018, 03:50:57 pm
content: You need cpu_rec:https://github.com/airbus-seclab/cpu_rec... this is a plugin for binwalkhttps://github.com/ReFirmLabs/binwalkDump the EPROM onto your PC then run it through thatOnce you've got the architecture nailed down, find a disassembler for it.Beware though that you will get false positives. Also some architectures are 16-bit wide so you might only have 8 of those bits at which point you are screwedAlso worth running "strings" on it to look for ASCII stuff.Disclaimer: I've never done this at all. Not once

author: NivagSwerdna
author_rank: Super Contributor
timestamp: October 18, 2018, 04:10:00 pm
content: I got one recently... all locations had FF. I wonder what architecture and opcode FF is for?PSThe ones containing explicit images can be used for blackmail of the original seller

author: technix
author_rank: Super Contributor
timestamp: October 18, 2018, 04:49:44 pm
content: Quote from: NivagSwerdna on October 18, 2018, 04:10:00 pmThat means the chip you bought was new or properly wiped before shipping. Mine wasn't wiped at all and had non-FF code in it.

author: rstofer
author_rank: Super Contributor
timestamp: October 18, 2018, 04:57:27 pm
content: Quote from: technix on October 18, 2018, 04:49:44 pmWhy mess around? Trying to analyze bytes is an infinite time sink. Erase the thing and more on!

author: Mechatrommer
author_rank: Super Contributor
timestamp: October 18, 2018, 05:03:53 pm
content: yes a good time waster. who knows you might find pamela anderson in it or bill gates' bank account number.

author: Siwastaja
author_rank: Super Contributor
timestamp: October 18, 2018, 05:18:24 pm
content: How about shopping lists you find on shopping mall floors? What do you do with them?

author: T3sl4co1l
author_rank: Super Contributor
timestamp: October 18, 2018, 06:44:31 pm
content: Well... being an open-ended task, do it the same you'd do anything else.Stare at it a while.Is it repeating? Might be tables of some sort.Any ASCII (or EBCDIC, or other encoding for that matter) apparent?As mentioned, if it's slices of a 16 (or more) bit bus, you'll see that more obviously in human-readable formats like ASCII, but less so in others...Basic stat and crypto checks: do a frequency analysis. Do an entropy analysis. Look for sentinel codes, or magic numbers. Look for checksums or hashes (often at the top or bottom of the image).If it's very high entropy, it's possible it is compressed or encrypted. Would be unusual for a ROM I would think, but who knows. Back in the ROM days, that sort of thing was rather expensive to do, except when absolutely needed (and that, mainly for tape and demo purposes?).If you aren't familiar with many (or any) instruction sets, binary will just look like gibberish to you. You'll have to learn a few first -- x86, Z80, 6502 and 68k might be good starting points. This will take the better part of a year; queue up some projects to use each one, so you have motivation.Offhand, I know that:- Z80 machine code is pretty simple, and makes frequent use of middling-range (ASCII readable) codes. This can make it difficult to eyeball if a passage is code or data!- x86 tends to be noisier, with occasional patches of recognizable offsets (e.g., load-immediate, absolute address, index indirect..). That is, groupings of similar numbers keep appearing, often either small addresses or offsets or values (say "01 00" = 0x0001), or addresses to the same region of memory (0x70a4, 0x70a8, ..) suggesting a data segment there. The most recognizable, and usefully so, opcodes are push reg: you regularly see a "PQR" in the hex dump, for something like PUSH BP / MOV BP, SP / PUSH SI ..., or whatever they actually are. In other words, normal (Intel ABI) function preamble!- I haven't worked with other instruction sets in raw format very much, but the other ones that I'm familiar with are unlikely to be found in EPROMs anyway (e.g. AVR). So, thus ends my flavor text.If nothing else, feel free to send them to someone who loves archiving stray code, like Jason Scott.Tim

author: bson
author_rank: Unknown
timestamp: October 18, 2018, 09:38:27 pm
content: Folks, spay your codes or they will go stray!

author: SiliconWizard
author_rank: Super Contributor
timestamp: October 19, 2018, 01:20:46 am
content: Quote from: technix on October 18, 2018, 03:22:17 pmPolite and safe: just erase the chips and move on. If you're extra polite, you may even warn the seller about existing data. But I wouldn't bother. It's the responsibility of someone selling storage devices to take care of privacy issues and erase them before selling. If they didn't, why would you even care?Now if you are curious and just want to take a peek at the data - which doesn't seem to be the case - have at it. Guess that would be some rather concrete case of "data mining".

author: technix
author_rank: Super Contributor
timestamp: October 19, 2018, 05:45:33 am
content: Quote from: Siwastaja on October 18, 2018, 05:18:24 pmExecutable code of unknown architecture is inherently more interesting than shopping lists of library cards.

author: NivagSwerdna
author_rank: Super Contributor
timestamp: October 19, 2018, 03:19:01 pm
content: Slightly related.... when identifying ROMs from Arcade machineshttp://romident.coinopflorida.com/is very useful. Basically it runs a CRC and compares it to the known ROM checksums in MAME.Interestingly the ROM I left by the Window and just checked is the same architecture/instruction set as the other ones I had... all FFs...

author: technix
author_rank: Super Contributor
timestamp: October 19, 2018, 03:48:11 pm
content: Quote from: NivagSwerdna on October 19, 2018, 03:19:01 pmThe Sun can erase quartz window EPROMs given enough time.

author: Bruce Abbott
author_rank: Frequent Contributor
timestamp: October 19, 2018, 05:53:25 pm
content: Quote from: technix on October 18, 2018, 02:18:37 pmWhy?

author: technix
author_rank: Super Contributor
timestamp: October 19, 2018, 06:11:55 pm
content: Quote from: Bruce Abbott on October 19, 2018, 05:53:25 pmJust in case someone might regret losing that chip’s data.

author: NivagSwerdna
author_rank: Super Contributor
timestamp: October 19, 2018, 08:42:48 pm
content: Quote from: technix on October 19, 2018, 06:11:55 pmI always save a hex dump of my ROMs that contain all FFs just in case.

author: SiliconWizard
author_rank: Super Contributor
timestamp: October 20, 2018, 12:31:14 am
content: Quote from: NivagSwerdna on October 19, 2018, 08:42:48 pm

author: T3sl4co1l
author_rank: Super Contributor
timestamp: October 20, 2018, 02:19:07 am
content: You should erase your EPROMs with a UV laser pointer, so you have a steady supply of hand-crafted, bespoke artisinal bits and 0xFFs.Tim

author: rrinker
author_rank: Super Contributor
timestamp: October 22, 2018, 03:02:57 pm
content: The images tend to be crude on some of those older low density EEPROMS though, no matter how good your laser pointer is.The larger ones though - release that inner van Gogh!

author: james_s
author_rank: Super Contributor
timestamp: October 22, 2018, 03:58:39 pm
content: I usually dump any random ROMs I find and browse through it for recognizable strings. Occasionally I find something potentially useful or interesting like the BIOS from some vintage PC or peripheral, other times it's just interesting to see what's there.

author: legacy
author_rank: Super Contributor
timestamp: October 23, 2018, 11:16:03 am
content: Anyway, I have recently found that germicidal lamps used to clean surgery cutters are extremely good to safely wipe UVEPROMs, and there are interesting opportunity to find one for cheap (got mine for 60 Euro) from little bazaars in Russia. Even online.It just needs a timer for setting the exposure timeOnce wiped, the chip perfectly works, it keeps a new programming, but it has a weird smell. Can't describe, it's something that smells of the hospital. Maybe the germicidal lamp has a large UV spectrum and some wavelength interacts with some chemical element used in the body of UVPROM.ROMs wiped by profe$$ional tools don't have this weird smell

author: MK14
author_rank: Super Contributor
timestamp: October 23, 2018, 11:41:16 am
content: Quote from: legacy on October 23, 2018, 11:16:03 amUV of certain wavelengths, makes Ozone. Which has a distinctive smell, even in small quantities.https://en.wikipedia.org/wiki/Ozone.If it makes ozone, it is also probably harmful for your eyes (UV very bad), at those frequencies.Quote

author: legacy
author_rank: Super Contributor
timestamp: October 23, 2018, 11:46:31 am
content: Quote from: MK14 on October 23, 2018, 11:41:16 amummm ... the lamp is hosted inside an aluminum box I have homemade; I know ultraviolet light can show aging property of aluminum particles and epoxy composite (these are used in dentistry for fillings), but ... how can it make ozone?

author: MK14
author_rank: Super Contributor
timestamp: October 23, 2018, 11:47:51 am
content: Quote from: legacy on October 23, 2018, 11:46:31 amhttp://www.oxidationtech.com/ozone/ozone-production/uv-lamp.htmlQuoteQuote

author: MK14
author_rank: Super Contributor
timestamp: October 23, 2018, 11:51:11 am
content: If you are using the "wrong" type of UV light. It will makes lots of Ozone, which is dangerous to breath in. I believe.

author: legacy
author_rank: Super Contributor
timestamp: October 23, 2018, 11:55:34 am
content: yup, the lamp covers 180 nm, it's written on the label, hencebingo, it's probably ozone the smell I was talking about.Definitively this tool must be used open air, or next to an open window.Thanks for your warning

author: MK14
author_rank: Super Contributor
timestamp: October 23, 2018, 12:01:01 pm
content: With professional UV EPROM erasers, you can get a tiny/slight whiff of Ozone smell from them. If they have been on a long time (30+ minutes), and there isn't much air flow, around the area.But this is usually only a small amount of smell, which soon dissipates.Laser printers, especially the really old ones from 10/20 years ago, sometimes gave off noticeable smells of Ozone.Due to theUV lamp, which erases the laser drum (or whatever it is used for in a laser printer).EDIT (crossed out section, replaced below):Please see next post in thread:Quote

author: PA0PBZ
author_rank: Super Contributor
timestamp: October 23, 2018, 12:30:34 pm
content: Quote from: MK14 on October 23, 2018, 12:01:01 pmCorona wire - High voltage.

author: westfw
author_rank: Super Contributor
timestamp: October 24, 2018, 12:48:48 am
content: If I were to find un-erased chips, I would simply erase them immediately, since anything else might be morally and legally questionable.Part of the "big company" mentality that was drummed into me: "if you come across info that might be 'confidential' to one of your competitors", you should NOT look at it.

author: james_s
author_rank: Super Contributor
timestamp: October 24, 2018, 01:11:25 am
content: EPROMS never had any kind of code protection and what sort of confidential information is going to be on chips pulled from scrapped obsolete technology?If someone doesn't want me to look at their data, it's their responsibility to keep it from getting out. I have absolutely zero moral issues looking around in old ROMs. I have as much loyalty toward any unnamed "big company" as they have toward me, which is to say, none at all.