On Wed, 8 May 2002 22:50:54 +0100, "Phillip Eaton" <inbox@phillipeaton.com> wrote:
AFAIK, the signature that Rom Ident uses is a standard CRC-32 calculation, which is calculated in an identical way to CRC-16 and CCITT CRCs, using all bits of each byte in the file.
The polynomial may be different (i.e. more bits for CRC-32), but the technique is the same for any CRC/Signature calculation. Have a search for CRC-16 and CRC-32 on Google, you get back loads of results.
WinZip uses CRC-32, as does MAME, to see the CRC-32 for a file, zip it up in WinZip (8.0?) and set the configuraiton options to show the CRC. You'll see it's 8 hex characters i.e. 32 bits.
Just for the fun of it I wrote a quick program that tried all possible feedback combinations for 16 bit CRCs (65536 combinations), none of them generated the proper signatures, so it's more than just a variation of the standard CRC calculations. (FWIW: I also tried reversing the bit read order. I ran this shifting in both the LSB and the MSB first, neither worked.) The signature may be easily cracked though, assuming no hidden states are saved in the Fluke processor. If this is similar to a standard signature, then given a starting CRC of 16 bits, and a new bit to shift in, the new CRC value will always be one of two new values, depending upon whether the bit value is a zero or a one. For instance if the current CRC is AB12, and the new bit to be shifted in is a one, and that creates a new CRC of 34F7, and if shifting a one into a CRC of AB12 *always* creates a new CRC of 34F7, then the signature can be calculated using two 128k lookup tables. If the above is true then a program could be written that would: if (next bit == 0) crc = CrcTbl0[crc]; else crc = CrcTbl1[crc]; That would pretty much be the whole signature calculation, and you can ignore any internal functions being done by the Fluke code. This would work assuming the signature does work similar to a CRC. If Fluke, for some reason, wants to make things really tough, they could do something similar to what a MD5 calculation does. It keeps track of previous bytes and changes the results based on what it previously read. For instance a CRC of AB12 with a one shifted in would only become 34F7 if the previous bit was a 0, otherwise it would be something else. That would be bad :^( There is hardware for running an HP signature in the 9010a. I found this in the service manual (page 4 of 4 of the main board schematic, or something like that, there was no page number). Included in the calculation was a counter that counts the number of high to low transitions made by the incoming data bitstream. If this circuit is being used to calculate the sigs, it could be that this count value is being added back into the calculation to convolute things. If this is the case, the above solution won't work. This could be tested by, finding two identical signatures, using different bytes, that created the same CRC, and then adding a third byte to see if they are both still equal. For instance if the bytes: 00 45 = CRC-1234, and, 12 BC = CRC-1234, then the CRC for the three bytes "00 45 01" should equal the CRC for "12 BC 01". This would be an immediate indicator as to whether or not we are dealing with a "standard" CRC calculation of some type. It would also be an indicator as to how hard it will be to crack the code. Anybody know of two different ROMs, or byte streams that result in the same signature? -Zonn
Cheers, Phillip Eaton
-----Original Message----- From: John Robertson [mailto:jrr@flippers.com] Sent: 08 May 2002 22:44 To: Phillip Eaton; TechToolsList@flippers.com Subject: RE: Gottlieb / Q*bert scripts for the 9010A/9100
Home today fighting a small chest infection...
I don't think these ROM Signatures generated by the base numbers are true "Signatures" after all. Note that the coding for them does not follow the convention of using HP's ACFHPU, rather the "signature" generated uses standard HEX nomenclature.. Now I wonder what this number actually is...I'm going to try to use my new Arium ML1400 Logic Analyzer to see if I can find the section of code in the base that actually is used to create the ROM signature and report back.
I think it is more likely a signature similar to the one ROMIDENT uses... anyone know it's root formula?
John :-#)#
At 10:06 AM 07/05/2002 +0100, Phillip Eaton wrote:
Ah ha! You've just spotted the reason for my previous question - What's the polynomial?
I worked out the Cat Box polynomial directly from the PCB, you can actually _see_ the address counter and the XOR feedback points. Apparently the Cat Box polynomial is the same as the HP one.
Now it gets a bit confusing... (Especially as I've not actually had time to get stuck into my Fluke and confirm all of this!)
/As far as I can see/ The Fluke creates a signature with a similar procedure to a boring old checksum, by reading each byte of a region of memory space and performing a calculation on it to produce a single 16 bit signature. To create the signature, it right shifts each bit of each byte into the polynomimial XOR 'circuitry'. On the Cat Box the 'circuitry' is physical, but is probably software on the 9010a for reasons shown below.
On a Fluke, there seems to be a bit of general confusion as to where the calculation is done, in the pod or in the main unit. I would be very surprised if it were done in the pod but I could be wrong. (I hope to have a look myself in the summer, when I've finished college...)
Anyway, the Cat Box performs Signature /Analysis/, which also produces a signature, but not by reading in a chunk of bytes and creating a signature from them via software.
Using a probe, it reads the chain of bits that occur at a particular point on a PCB when the address bus is ramped from 0 to FFFFH. To test one part of a circuit e.g. a single ROM, you would tie a sig analysis start and stop line to the chip enable of the ROM which in effect maps to that ROMs address space only.
If you point the probe at the one data line of the ROM, you will get a stream of bits which you can XOR in a similar way to the standard Fluke signature. BUT the calculation will only be performed on one bit of each byte as there are 8 data lines and you only have one probe! Thus, you get 8 signatures per ROM as shown in the Atari Cat Box signature reference for each PCB.
A Fluke signature is an improved way of testing a ROMs integrity over a checksum, but it can't be used to analyse anything other than a fixed areas of memory space i.e. ROM. Signature /Analysis/ can test /any/ digital part of a circuit as long at it derives from the processor's address and data decoding (i.e you can't do the video circuitry).
My program uses a software way of calculating the signature, but it emulates the Atari probe hardware i.e. by testing only 1 bit of a byte and thus it is an emulator, as opposed to just a signature generator.
I originally wrote it to do the 8 bits of a ROM, but this added an extra loop, and all I was really trying to do was show how it worked, so I went back to just one bit for clarity.
Note BASIC has no bitwise operators so the code is a bit cumbersome, if you rewrote it in C, or even better Forth, it would be a fraction of the size.
You could quite easily modify my emulation to either create all 8 checksums together like the Cat Box or pass all of the information from each byte serially into the calculation like the Fluke (if you knew it's polynomial).
Cheers, Phillip Eaton http://www.phillipeaton.com
---- Original message ----
Date: Mon, 06 May 2002 21:45:41 -0700 From: John Robertson <jrr@flippers.com> Subject: RE: Gottlieb / Q*bert scripts for the 9010A/9100 To: "Phillip Eaton" <inbox@phillipeaton.com>, <TechToolsList@flippers.com>
Hi Phillip,
I just tried your emulator on a bunch of Asteroid files and compared them with the signatures on the 9010 and I do not get the same results... Does it not setup the same Signature that HP designed and thus should it not give the same results for any file as the Fluke would do on a ROM signature test? The signatures generated by your emulator are consistent - identical files give identical signatures...
Might I ask what the "Bit number <0 - 7>" refers to in the emulator?
John :-#)#
At 11:08 PM 06/05/2002 +0100, Phillip Eaton wrote:
I wrote one of these a few years back. It's part of my Atari Cat Box signature analysis write-up which is held at http://www.gamearchive.com/video/manufacturer/atari/vector/s ignatures/
It includes a very simple program source code (to aid understanding) to do what you mentioned in MS DOS QBasic for the Cat Box.
You could quite easily use it as a base to write your own, or simply change the polynomial in mine and it'd do what you need.
How did you work out the ploynomial?
Cheers, Phillip Eaton
-----Original Message----- From: owner-techtoolslist@www.flippers.com [mailto:owner-techtoolslist@www.flippers.com]On Behalf Of John Robertson Sent: 06 May 2002 22:03 To: TechToolsList@flippers.com Subject: Re: Gottlieb / Q*bert scripts for the 9010A/9100
What we need is for some bright person to write a simple utility that converts data files to signatures. The signature formula is fairly simple and if combined with Bill Ung's ROMSUM would be a nice tool for our package. If you don't know ROMSUM it is a dos utility that will give a checksum listing plus the ROM size for a single or group of files...
The Signature process is a CRC process that uses the following feedback equation: X(to the 16th) + X(to the 12th) + X(to the 9th) +X(to the 7th) + 1 or P(X) = X(15th) + X(9th) + X(7th) +X(4th) + 1
So who wants to make a simple (not for me!) binary program that allows one to input a file and outputs it's signature?
John :-#)#
At 09:11 AM 06/05/2002 -0400, Kev wrote:
>Anyone written any test scripts for these or at the very least have some >checksum signatures? > >Thanks, >Kev