If anyone wants them I have some emulator execution trace capture files of the IO_LEARN sequence. Somewhere within this listing the 'calculation' is performed. The capture, IIRC, is MANY loops within loops but I believe it's all there. The above mentioned capture file is 125Kbytes long, there's ALOT of information in it. There are some other trace capture files I saved too, just say the word and thier yours. Dave ----- Original Message ----- From: Mike Coates <mcoates@mame.net> To: <TechToolsList@flippers.com> Sent: Thursday, November 08, 2001 5:55 PM Subject: Re: Cracking the 9010A ROM signature generator
I've done some dissassembly on the code for both the pod and the base, and have to agree with David, whatever it was written in had an awful compiler! - It's not easy tracking down anything, since the code is so illogical!
the code in the pod is a little more understandable, but only just, and not understanding (yet) how the pod communicates to the UUT makes ot difficult to follow as well.
My next step in the attack on understanding the code is to try and create an emulator for the pod software, at least then I may be able to trap all of the reads/writes that communicate with the pod (I need to know this for a later project anyway!) - hopefully, seeing the data transfers may help gain understanding in how the entire thing works
from your examples, it certainly follows no checksum algorithm I know of, reversing the bit pattern either needs a lookup table (which I will check for in a minute) or some nasty calculations (which again, should be obvious!). I'm going to have another troll though the 48k of code looking for anything that may implement such things.
just out of interest, does the 6502 pod (or another 8 bit pod) generate the same checksum, and secondly, does it generate the same checksum for the same data at a different address ?
To UNSUBSCRIBE from techtoolslist, send a message with "UNSUBSCRIBE" in the message body to: techtoolslist-request@flippers.com. Please direct other questions, comments, or problems to jrr@flippers.com.