Epic reverse-engineering - Page 1
Forum section: electronics / projects

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: May 24, 2015, 09:37:01 am
content: Just watched these 2 vids on investigating a blu-ray drive - some awesome reverse-engineering ( and video editing).www.misc.name/coastermelt/

author: apelly
author_rank: Unknown
timestamp: May 24, 2015, 11:42:41 am
content: She does cool stuff. I've encountered her before when googling for info on other things. Also, I think an Amp Hour guest has spoken about her.

author: Howardlong
author_rank: Super Contributor
timestamp: May 24, 2015, 12:48:15 pm
content: Quote from: apelly on May 24, 2015, 11:42:41 amShe'd be an excellent AmpHour guest. I see she spent a good few years at the hardware emulation end of VMWare, that explains a lot.

author: GK
author_rank: Super Contributor
timestamp: May 24, 2015, 01:01:51 pm
content: More than a bit "out there" in some respects, IMO, like, ummmm..........http://scanlime.org/2012/11/hacking-my-vagina/

author: Howardlong
author_rank: Super Contributor
timestamp: May 24, 2015, 01:17:56 pm
content: Quote from: GK on May 24, 2015, 01:01:51 pmDon't knock it 'til you've tried it.

author: wreeve
author_rank: Unknown
timestamp: May 24, 2015, 04:24:32 pm
content: and she has a cat in the video....win win!

author: Howardlong
author_rank: Super Contributor
timestamp: May 24, 2015, 04:26:22 pm
content: Quote from: wreeve on May 24, 2015, 04:24:32 pmNot quite a Mrs Slocombe though.

author: nctnico
author_rank: Super Contributor
timestamp: May 24, 2015, 04:46:32 pm
content: I love the stone tablets when the subject 8051 comes up.Also is that cat on her desk still alive?Interesting hacking techniques; looking at a binary file as grey scale data reveals patterns quickly.

author: SeanB
author_rank: Super Contributor
timestamp: May 24, 2015, 05:03:38 pm
content: Well trained cat, it fetches thrown things, and even goes to look for them. Most I have met look at you like " well, you threw it, you bleeding well fetch it! I'm busy" in that situation.

author: abyrvalg
author_rank: Frequent Contributor
timestamp: May 25, 2015, 07:20:20 am
content: 10:36+ - what are you doing?! See "FF B5" -> press 'P'! Hurts my IDA reflexes )))

author: SArepairman
author_rank: Frequent Contributor
timestamp: May 25, 2015, 07:43:18 am
content: for some reason i felt like i was watching c-span and lol @ software patent trolling

author: AndreasF
author_rank: Frequent Contributor
timestamp: May 25, 2015, 08:47:24 am
content: Quote from: Howardlong on May 24, 2015, 12:48:15 pmShe was the most recent guest on Elicia & Christopher White'sEmbedded podcast.

author: jaxbird
author_rank: Frequent Contributor
timestamp: May 25, 2015, 09:22:12 pm
content: Look at me and my pink hair.What is the deal with the funny colored hair?

author: Monkeh
author_rank: Super Contributor
timestamp: May 25, 2015, 10:39:33 pm
content: Quote from: jaxbird on May 25, 2015, 09:22:12 pmWhat's the deal with your funny coloured shirt?It's hair. She happens to want it pink.. so what?

author: jaxbird
author_rank: Frequent Contributor
timestamp: May 25, 2015, 10:43:41 pm
content: Quote from: Monkeh on May 25, 2015, 10:39:33 pmMy shirt is always either White, Shade of Blue or when I feel rebellish, I might wear crazy colors like green or even a patterned design, never pink or purple though.

author: jaxbird
author_rank: Frequent Contributor
timestamp: May 25, 2015, 10:53:56 pm
content: Quote from: Monkeh on May 25, 2015, 10:39:33 pmThe saddest thing though is that her technique is less advanced than what we used in the mid/late 80s to break protections on Commodore 64 games.We've come so far in 25-30 years

author: timofonic
author_rank: Frequent Contributor
timestamp: May 25, 2015, 10:58:20 pm
content: Her site screams HIPSTER everywhere. Pink hair is part of the style, like Lemor Fried.She did CIA.vc and many other projects.

author: nctnico
author_rank: Super Contributor
timestamp: May 25, 2015, 11:29:53 pm
content: Quote from: jaxbird on May 25, 2015, 10:53:56 pmAfter some though it also occured to me that there are better ways to determine how to control the motors and lasers but I guess her aim is to keep using the processor which is already on the board. Getting a datasheet / user manual would be a shortcut to that but then again that would take away some of the fun of learning that information through reverse engineering. Sometimes I take the long road as well for hobby hacking projects.

author: miguelvp
author_rank: Super Contributor
timestamp: May 25, 2015, 11:50:24 pm
content: How hard is really to figure out a Commodore 64 really?In those days, systems where so simple that it doesn't compare to now, 20 KB of Rom with 6502 code is hardly a challenge.

author: jaxbird
author_rank: Frequent Contributor
timestamp: May 26, 2015, 12:00:46 am
content: Quote from: miguelvp on May 25, 2015, 11:50:24 pmWe are going off topic, but it mostly relied on clever tricks, e.g. one of the "encryption" techniques used was to execute a loader code in screen memory, so in case you break the execution, the screen clears and the code is gone.Just one example, another example is executing certain tasks on the 6502 located in the disk drive to obfuscate operations.Not as simple as you think. (c64 was based on the mos6510 with about 20kB ROM, bank switchable)Anyway, better keep the thread on subject.

author: miguelvp
author_rank: Super Contributor
timestamp: May 26, 2015, 12:26:58 am
content: I guess you are saying that the old school reverse engineering, and by that I assume making duplicate copies was not Epic.I kind of agree of the old school reverse engineering not being epic so it's off-topic, I myself did an assembly routine to copy zx spectrum tapes that had fake headers for copy protection, maybe it was a huge deal then, but now systems are so complex with different processor etc that is not that simple.Back in those days we knew every special memory addresses by heart and we had access to the full disassembly of the ROM.Making a simple reader to get the data from tapes, etc was a simple task, as it was decompiling the opcodes by hand because we didn't have the tools available now, but because those old systems where so simple it was possible to do things manually, to the point that I would recognize the opcodes and didn't have to resort to look at the z80 instruction set. Edit: and the z80 is way more complex as far as number of opcodes than the 6502.Today that's not really that simple, unless you are talking about a cortex m0 that hardly that many opcodes or legacy 8 bit MCUs.Old systems didn't have any encryption at all, they did however did have schemes to try to protect their work. Even now a days on PCs that's still the case, nothing is truly protected because the amount of tools out there, but what she is doing is not taking the protection out of a piece of software, reverse engineering that blue-ray disc is orders or magnitude more complex than trying to break some copy protection scheme on some software running on a computer that you have full access to.So not off-topic really, but if you are going to downplay what she is doing there and try to ridicule the work done and compare it to those old simple times you can't just make your comment go away by just saying we are taking things off-topic.Quote from: jaxbird on May 25, 2015, 10:53:56 pm

author: jaxbird
author_rank: Frequent Contributor
timestamp: May 26, 2015, 12:39:29 am
content: Quote from: miguelvp on May 26, 2015, 12:26:58 amI see it more as equal to buying a piece of hardware on ebay or aliexpress without the datasheet and just figuring out how to make it work.

author: miguelvp
author_rank: Super Contributor
timestamp: May 26, 2015, 12:47:41 am
content: Quote from: jaxbird on May 26, 2015, 12:39:29 amThat's just a useless missquote as is the comments about hair color etc.

author: SArepairman
author_rank: Frequent Contributor
timestamp: May 26, 2015, 06:18:14 am
content: pink hair is hot

author: dexters_lab
author_rank: Unknown
timestamp: May 26, 2015, 07:13:09 am
content: interesting videos, thanks for sharing themmade me think how different people would tackle the same problem, ie hardware hacking vs software

author: Howardlong
author_rank: Super Contributor
timestamp: May 26, 2015, 08:19:36 am
content: Quote from: SArepairman on May 26, 2015, 06:18:14 amYip.

author: ataradov
author_rank: Super Contributor
timestamp: May 26, 2015, 09:08:25 am
content: This is how hacking should look in movies. And not typing a bunch of random characters into turned off notebook

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: May 26, 2015, 09:30:26 am
content: Quote from: jaxbird on May 26, 2015, 12:00:46 amISTR when I was hacking game protection on the BBC Micro, one clever scheme used a hardware timer as the XOR key to decrypt code, so any change to the code would make the results meaningless. They also arranged it so that on completion it dropped straight into the code, so you couldn't easily stop it once the decrypt had happenned. I think the first pass of the loop modified part of the decrypt code as well.

author: Kjelt
author_rank: Super Contributor
timestamp: May 26, 2015, 11:39:06 am
content: Quote from: mikeselectricstuff on May 26, 2015, 09:30:26 amI don't get this. That would imply that the flow of the program code has to be 100% predictable (always the same) and fully (hardware) time(r) aligned?

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: May 26, 2015, 01:15:46 pm
content: Quote from: Kjelt on May 26, 2015, 11:39:06 amYes. That is why it was so clever. Remember this was a 2MHz 6502 where you have very tight control over timing - the timing between the code initialising the timer and using the value is fixed - it just makes it hard to simulate.

author: madires
author_rank: Super Contributor
timestamp: May 26, 2015, 01:16:21 pm
content: Quote from: Kjelt on May 26, 2015, 11:39:06 amTake the code as binary blob, write the decoder function (setting up the timer and a XOR loop) and determine the start value of the timer for the first XOR and the cycles needed for each loop run. Then use those numbers to encrypt the code, put the decoder in front of the encrypted code and have a cup of tea. The timer's start value is the first key. The second key is the start value plus the number of cycles for one loop run. And so on for the other keys. If you don't count CPU cycles, i.e. using the timer with a prescaler, you have to devide the cycles per loop run too. Basically you could use the decoder to encode too

author: Kjelt
author_rank: Super Contributor
timestamp: May 26, 2015, 02:15:26 pm
content: Quote from: mikeselectricstuff on May 26, 2015, 01:15:46 pmOk that could work, I read it as that the software was using a free running hardware timer which will not work.Still tricky if there are HW interrupts that could interfere.And I guess you have to (re)set that timer for every branch in the code?Still the regular setting of the timer gives this neat trick away to the hacker.

author: Kalvin
author_rank: Super Contributor
timestamp: May 26, 2015, 02:46:09 pm
content: Quote from: Kjelt on May 26, 2015, 02:15:26 pmLike a  debugger used for reverese-engineering the copy protection?

author: SArepairman
author_rank: Frequent Contributor
timestamp: May 26, 2015, 06:33:49 pm
content: Quote from: Howardlong on May 26, 2015, 08:19:36 ambro common whats next goatse

author: Muxr
author_rank: Super Contributor
timestamp: May 26, 2015, 07:18:50 pm
content: Old school reverse engineering was hard core because there was no web or google. Now days it's all about how much time you want to spend cracking something, provided you have some fundamentals, time and will.

author: ataradov
author_rank: Super Contributor
timestamp: May 26, 2015, 07:58:30 pm
content: And grass was greener and trees were taller as well.In the old days they could not have engineered that much in a first place. Both engineering and reverse-engineering techniques go hand in hand, so no need to complain.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: May 26, 2015, 08:50:16 pm
content: Quote from: ataradov on May 26, 2015, 07:58:30 pmA major difference is that nowadays, the amount of code is vastly bigger, and may well have stuff like bought-in libraries and leftovers from other versions, which makes disassembly a lot harder.Gone are the days when you could hook up a logic analyser to an address/data bus to capture every read/write cycle & follow code execution paths

author: Kjelt
author_rank: Super Contributor
timestamp: May 26, 2015, 09:10:17 pm
content: That said look at the Rigol scope hack, I2C and the hint of an ECC lib and a very talented hacker/engineer.

author: Muxr
author_rank: Super Contributor
timestamp: May 26, 2015, 09:27:47 pm
content: Quote from: ataradov on May 26, 2015, 07:58:30 pmTrue. Also agree with Mike's point.I believe that democratization that Internet provided has made it far more accessible than it used to be however. Sure the technical complexity has gone up, but so have the tools, like this for instance:https://hackaday.io/project/956-chipwhisperer-security-researchAs well as the accessibility of tools in general. I am looking at it from the other side. If you were tasked with securing something I think it would be harder today.I am not complaining at all, I think it's fascinating, just reading through that Rigol thread was pretty cool, to see the community coming together to hack the product in such a short amount of time.

author: eneuro
author_rank: Super Contributor
timestamp: May 26, 2015, 09:33:16 pm
content: Quote from: Muxr on May 26, 2015, 07:18:50 pmProbably you watched too many james Bond filmsTry to crack this message:Ok, maybe it is not message but... ATTiny85 code?I can help you-do not waste your time-it is not possible to crack this

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: May 26, 2015, 10:30:45 pm
content: Of course the flipside of code sizes getting bigger is that when manufacturers are effectively forced to choose an off-the-shelf OS, this allows all sorts of potential ways in because of it's general-purpose functionality, like with the Flir E4 !Bigger code can sometimes mean more ways in

author: T3sl4co1l
author_rank: Super Contributor
timestamp: May 26, 2015, 11:05:46 pm
content: Quote from: mikeselectricstuff on May 26, 2015, 08:50:16 pmAnd you can't tell what they were thinking.What is this shit? It's all just moving around, going in circles...Why are we jumping into this? We were already here a hundred times...Nevermind, probably just some dumbass compiler......But then, if you gain familiarity with the typical compilers, you can recognize their output. It may be dumb output, but it's characteristically dumb. Like the dull kid at school, easily recognized. That helps to distinguish not just between functions, but between internal and library functions, for example.Same goes for libraries, whether purchased or free -- it's all bad! Free software is often better, rarely so much in quality (unless it's an exceedingly popular distribution with a lot of exposure), but just because, at least you can fix it from the source level when it does break.Tim

author: Dongulus
author_rank: Regular Contributor
timestamp: May 27, 2015, 12:02:22 am
content: Take a look at 2:18 into her second video. It seems that Scanlime is a fan of Dave's videos.