Semi-Automatic Hacking of Masked ROM Code From Microscopic Images 42
An anonymous reader writes "Decapping chips and recovering code or data is nothing new, but the old problem of recovering Masked ROM through visual inspection (binary '0' and '1' can be distinguished within the images) is normally done by crowd sourcing a manual typing effort. Now a tool that semi-automates this process and then recovers the data automatically has been released."
Nice 8085 example (Score:5, Interesting)
Re:THIS is what we need more of on /. (Score:5, Insightful)
This is awesome... (Score:5, Interesting)
Could be useful for future MAME work if someone is able to decap (and photograph) various otherwise un-dumpable mask-ROM-based MCUs and other chips.
Re:This is awesome... (Score:5, Interesting)
Interestingly, this was done for Bubble Bobble to ensure that the emulation was perfect:
http://mamelife.blogspot.co.uk/2006/08/completed-at-last.html [blogspot.co.uk]
Re:This is awesome... (Score:4, Informative)
This is done for the SNES, and all known coprocessors have been perfectly emulated. Write-up here [byuu.org], with pictures and explanations.
Re:This is awesome... (Score:4, Insightful)
I'd like to take a moment and thank all these people for working tirelessly in uncovering these secret bits of gaming history. I'm both envious of how smart these people are and grateful that they've spent their energy on something I just so happen to love.
Re: (Score:2)
Sadly that perfect emulation also means perfect errors popping up on poorly-coded ROMs.
This is why I use ZSNES for Super Nintendo. Those errors in ROM, ZSNES can work around them without any in-game problems. Byuu does exactly as it's supposed to, and fails upon the error.
Sometimes, perfect emulation isn't warranted.
Re: (Score:2)
*crosses fingers* Please, Raiden II, please, Raiden II...
Re:This is awesome... (Score:4, Informative)
The devs have said many times that decapping will NOT help emulate Raiden II
Re: (Score:3)
Re: (Score:2)
Re: (Score:2)
My understanding was that the issue wasn't that they didn't have a dump but that there was a one-off coprocessor that nobody had specs for. Would this not be of any assistance reverse-engineering such a chip?
Re: (Score:3)
In fact, it's this very chip you mention that prevents Raiden II from being emulated at all. It's a specialized coprocessor harking back from the 386/486 era, though this chip isn't Intel-made.
The purpose of this chip was to handle the flight paths of all the bullets flying around, thus relieving the main CPU from having to raster/render all these sprites and the direction they'd go.
Also, this same chip controls the homing plasma cannon beam.
And even then, (depending upon the arcade manager) at higher diffi
Re: (Score:2)
No. The technique described here works perfectly well for ROM images. This is because the data is actually encoded in the metal layers. I would presume that the underlying silicon is just a regular grid on transistors, so you can effectively ignore it.
Now, an actual processor, on the other hand, is a completely different can of worms. In order to reverse-engineer it, you would need not only the information from the metal layers (and not just the top metal layer), but also reverse-engineer the actual cel
Re: (Score:2)
So the gist is that the basic principles ought to work but that the advances in ASIC manufacturing between the 8085 and Raiden II mean that it's not feasible now to reverse-engineer the coprocessor?
Re: (Score:2)
Not at all. I am pretty sure that there is somebody out there who could reverse-engineet it. This is rather old tech at this point. However, who is going to pay them? I would susupect that this would be too much of an effort for a hobbyist.
Re: (Score:2)
The devs don't have a working Raiden II board. I do (arcade cabinet got leaked upon from the top, ruined the CRT and controls, board left intact and undamaged.) Decapping will DEFINITELY help as Raiden II had a coprocessor to help handle the incessant bulletstorm.
As said this is not really new... (Score:5, Informative)
I use to work for a large semiconductor company that manufactures microcontrollers. (I won't say who but they really make very small micro chips) I got into hot water once as I was the geek they called into a meeting to explain to a customer just how secure their technology was and because the rom code was stored in EEPROM that all was safe and secure. Well, first, no one told me the issue that was bothering the customer and second, they just called me in cold and I was asked "Can someone reverse engineer the code that is stored in the device." Being Dilbert to a T I looked at the crowd and said, "Sure if you have enough money. Just decap the device, put it into a voltage contrast SEM and fire it up. You'll have nice pictures of bright and dark spots on the memory array and in no time you'll have the code". Customer went batshit. My boss gave me the look of death and I'm standing there saying "What?" "You asked me if it can be done" "I just told you how to do it. It's not cheap but it's possible".
These days this is probably a lot more difficult as many, not all, but many IC's are mounted in a package face down as they use bump technology to do both die attach and signal connections.
Re: (Score:2)
And really.. if your code is THAT important, you should use a security-based chip to begin with.
There are tamper-resistant packages and a variety of defenses against this, but they all cost money.
Re: (Score:1)
And even those measures (metal grid layers, e-fuses etc) can be defeated [flylogic.net] although as with any security it's about making it uneconomically difficult for most attackers to do so. Also the security shouldn't depend on any secrets like a hardcoded universal key or the fact that you fake the encryption - several "secure" flash drives have been found to do this, the unencrypted data can be read right off the flash when you bypass the controller.
Re: (Score:3)
Those fake encrypted flash drives remind me of the old Zip disks. If you put in a disk with a known password and unlocked it you could force it out and put in an encrypted disk you didn't know the password to. They didn't even bother to XOR the data with your password so any disk could be read that way.
Re: (Score:3, Interesting)
Re: (Score:2)
FWIW, in some modern ICs (that I've worked on) the most critical parts of a rom (e.g., a boot loader that validates a pre-boot image), are generally not implemented as a masked rom, but basically compiled gates. The logic compiler (more often than not the program called Design Compiler from Synopsys) is given the contents of the rom described as a big case statement: given an address, assign data output. The compiler produces a semi-optimal set of logic gates to implement the 'ROM' function.
During the lay
Re: (Score:2)
As I've learned, the correct answer is, "Sure, but it'll cost them $n megabucks, and it will take x amount of time." (I'm sure rimcrazy also figured this out since then.)
In confused America (Score:2)
Re: (Score:3)
taking the cover off a microchip and reading code that wasn't meant to be read is not a DMCA violation at all.
You're not bypassing DRM, as there is no DRM. So no violation, beyond standard copyright infringement, and even that's a grey area.
Re: (Score:2)
Hacking your XBox 360 is clearly a crime worthy of being charged for, but taking the cover off a microchip and reading code that wasn't meant to be read is not a DMCA violation at all.
That's only because the right folks haven't been getting their campaign contributions to make that illegal, too.
Wow (Score:1)
I can't help but wonder, though, if he hadn't popped the chip into a vat of boiling acid, he could have taken a note of the manufacturers code and dropped them a polite email...
A better method: captcha (Score:5, Funny)
Semi-Automatic Hacking (Score:2)
Re: (Score:2)
Isn't this banned? Or is it only the ones that have military features?
I really don't see the need for the average citizen to use a semi automatic hacking tool. We should ban them and force hackers to reboot after every hack.