Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.forth > #54330

Re: keep secrets (was Re: embedded Forth)

From rickman <gnuarm@gmail.com>
Newsgroups comp.lang.forth
Subject Re: keep secrets (was Re: embedded Forth)
Date 2017-01-23 19:48 -0500
Organization A noiseless patient Spider
Message-ID <o6685j$ff7$1@dont-email.me> (permalink)
References (3 earlier) <e0bca367-5f85-4080-bc57-1514614c69d2@googlegroups.com> <o64fl2$iim$1@dont-email.me> <DuRIrDXjQoB@allinger-307049.user.uni-berlin> <o65m0o$asp$1@dont-email.me> <DuRJIuGUQoB@allinger-307049.user.uni-berlin>

Show all headers | View raw

On 1/23/2017 4:43 PM, Wolfgang Allinger wrote:
>
>  On 23 Jan 17 at group /comp/lang/forth in article o65m0o$asp$1@dont-email.me
>  <gnuarm@gmail.com>  (rickman)  wrote:
>
>> On 1/23/2017 6:58 AM, Wolfgang Allinger wrote:
>>>
>>>  On 23 Jan 17 at group /comp/lang/forth in article
>>>  o64fl2$iim$1@dont-email.me <gnuarm@gmail.com>  (rickman)  wrote:
>>>
>>>> On 1/23/2017 12:36 AM, hughaguilar96@gmail.com wrote:
>>>
>>>>> [keeping SW secrets]
>
>>>> A logic analyzer and a few days would likely do the job.
>>>
>>> I'm shure, you never tried to reverse engineering a FORTH Code.
>>> BTDT
>
>>>
>>> In 1985(?) I compiled a target EPROM with a special 16bit constant for the
>>> [...]
>>> only the EPROM left. PHUGGGH! It cost me and him a hole day, just to
>>> reengineer that code to find the constant.
>>> [...]
>>> And I have my sources of a released version some days after the special
>>> one. However it's a pain in your ass, to reverse engineer FORTH even if
>>> you have some sources and excellent knowledge of whats going on.
>>>
>>> Don't forget to generate headerless targets to make it worse.
>
>> I'm not sure how having headers makes reverse engineering easier in
>> compiled code.  Anyway, a day to reverse engineer code is not really
>> that big a deal if you are trying to duplicate a product.  A week or two
>> would be perfectly acceptable.
>
> Remember, it was my own code and I knew, what to search for! So only a
> reverse engineering of 2 bytes. The problem to find those byte cost me one
> day!
>
> I'm shure you wouldn't reverse engineering this program even in 6 month.

As a comparison, I have a GPS that is quite old.  We did have access to 
the binary program as there were updates that we could apply.  I don't 
recall if we knew much about the format, but none of us had the 
development tools, just this file.  The problem was there was a constant 
somewhere in the code that specified numbers for two WAAS satellites. 
Those satellites had been taken offline permanently and now the WAAS 
feature didn't work.

So we needed to figure out how to fix this.

How long do you think that took?


> 128kB target for a 64180 with 12 HW interrupts, some of them in the 10-
> 20kHz range. If you miss one IR, the programm will not run correct, so
> your results are nonsense.
>
> Yes, with header it's a little bit easier. In the described job of 1985,
> there where no headers in the target, so I can't find the word with the
> ADC constant by just searching for the name. I knew, that name and even
> know, that the constant change was the only mod of this word... but...
>
> I'm shure, you never tried reverse engineering of FORTH targets.

No, I have not reverse engineered a Forth program, but I don't see how 
that is any harder than any other binary.  It's just code.  You have to 
follow the execution and find the program structure, the data structure 
and how the data is manipulated.  It may be tedious, but it is never 
impossible.  Ask the NSA.  What do you think it takes to write the code 
that performs the crypto functions in portable equipment that might 
become compromised?  It is many orders of magnitude beyond what you are 
describing.


> You have to single step and find out what and where NEXT is (assumed you
> know its a FORTH Target. Then you have to keep track of SP and RP
> (assumed, you know, it's FORTH) If you don't know, it's FORTH you are lost
> very soon. Especially if you don't realize, that it has 2 stacks.
>
> Then you can set a breakpoint to NEXT an trie to find out, what happened.
>
> That is not trivial on an embedded system with HW interrupts. Likely it
> won't work.

Don't ever fool yourself in thinking something is hard when you haven't 
actually tried to crack it.  Heck, I have seen so many things cracked 
that were intentionally designed to be secure it's not funny.  Why do 
you think they passed the DMCA in the US?  Because they simply *can't* 
protect things by obscurity or even intentional encryption, so they made 
breaking that encryption a felony... which is like locking your front 
door, only keeps honest people honest.


>>>> Trade secrets are fine, but don't count on the simple security fuse.  It
>>>> is not really a hard thing at all to get past those.  Check on the web,
>>>> there are lots of examples of people opening chips and reverse
>>>> engineering if not outright reading the data inside or the chip design.
>
>>> But if you combine the security fuse with some words with a lot of stack
>>> juggling a flag ( DUP DROP ROT ROLL >R R@ R> pick -ROLL OVER DROP MUL DIV
>>> XOR MOD SHIFT -SHIFT 2* 2/ ... ) on the stack with nonsense data (I think
>>> 16 entries are terrible enough) and some seconds after starting the
>>> program, another stack juggling... you retrieve the flag and stop the
>>> program: "Checksum ERROR!"
>
>> I'm not sure what you are describing here.  The security fuse is
>> supposed to stop you from being able to read the contents of the program
>> memory.  But it only stops you from *reading* the program memory.  There
>> are other ways of getting the contents if you want to spend some money.
>
> It's a scenario when someone break the fuse-bit and reads the content of
> the program memory...

I can't say I follow.


>>> I think that they need several days just to find out, that it is FORTH,
>>> especially if you don't have any hint to FORTH in your code and doc.
>
>> I'm not sure that is terribly relevant.
>
> If you don't know, it's FORTH you will be lost!

Hardly.  It's just a bunch of either subroutine calls or jumps through 
lists.  I think someone would get the hang of that pretty quickly.  It's 
no rocket science.


>>> Another trick: put a serial number TO92 (DALLAS DSxxxx?) to the board and
>>> check this number, then you even couldn't clone the program.
>
>> Yeah, I've thought of that, but it is cumbersome and expensive to deal
>> with that in production.
>
> With the right strategy you can handle that in the final test of the
> system.

But it is extra time spent on every unit.  Time is money and the DSxxxx 
parts aren't as cheap as they should be.  I've never seen one that is 
under $0.50 at any quantity including the one that is barely more than a 
serial number.

Besides, this is also not secure.  If I have one of these boards, I can 
find the key in the FPGA and set my own, or I can read the serial number 
in the Dallas part and use my own MCU that outputs the same number in 
the same way.

-- 

Rick C

Back to comp.lang.forth | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

embedded forth Dale Scott <dalescottnet@gmail.com> - 2017-01-21 11:27 -0800
  Re: embedded forth Paul Rubin <no.email@nospam.invalid> - 2017-01-21 11:31 -0800
  Re: embedded forth stephen@mpeforth.com - 2017-01-22 00:52 -0800
  Re: embedded forth anton@mips.complang.tuwien.ac.at (Anton Ertl) - 2017-01-22 17:09 +0000
    Re: embedded Forth Dale Scott <dalescottnet@gmail.com> - 2017-01-22 09:43 -0800
      Re: embedded Forth stephen@mpeforth.com - 2017-01-22 12:19 -0800
      Re: embedded Forth albert@cherry.spenarnc.xs4all.nl (Albert van der Horst) - 2017-01-22 21:25 +0100
      Re: embedded Forth john <anon@example.com> - 2017-01-22 21:04 +0000
        Re: embedded Forth "Elizabeth D. Rather" <erather@forth.com> - 2017-01-22 12:30 -1000
        Re: embedded Forth hughaguilar96@gmail.com - 2017-01-22 20:45 -0800
      Re: embedded Forth stephen@mpeforth.com - 2017-01-22 14:08 -0800
        Re: embedded Forth Paul Rubin <no.email@nospam.invalid> - 2017-01-22 14:55 -0800
          Re: embedded Forth Dale Scott <dalescottnet@gmail.com> - 2017-01-22 20:41 -0800
            Re: embedded Forth Paul Rubin <no.email@nospam.invalid> - 2017-01-22 21:19 -0800
      Re: embedded Forth hughaguilar96@gmail.com - 2017-01-22 21:36 -0800
        Re: embedded Forth Dale Scott <dalescottnet@gmail.com> - 2017-01-22 22:09 -0800
          Re: embedded Forth rickman <gnuarm@gmail.com> - 2017-01-23 04:15 -0500
            Re: embedded Forth Dale Scott <dalescottnet@gmail.com> - 2017-01-23 08:41 -0800
              Re: embedded Forth rickman <gnuarm@gmail.com> - 2017-01-23 14:32 -0500
                Re: embedded Forth Dale Scott <dalescottnet@gmail.com> - 2017-01-23 11:53 -0800
                Re: embedded Forth rickman <gnuarm@gmail.com> - 2017-01-23 15:10 -0500
              Re: embedded Forth Paul Rubin <no.email@nospam.invalid> - 2017-01-23 14:34 -0800
                Re: embedded Forth Andrew Haley <andrew29@littlepinkcloud.invalid> - 2017-01-24 03:14 -0600
        Re: embedded Forth rickman <gnuarm@gmail.com> - 2017-01-23 03:43 -0500
          Re: embedded Forth john <anon@example.com> - 2017-01-23 10:32 +0000
          keep secrets (was Re: embedded Forth) "Wolfgang Allinger" <all2001@spambog.com> - 2017-01-23 08:58 -0300
            Re: keep secrets (was Re: embedded Forth) Rod Pemberton <NeedNotReplyHere@xrsevnneqk.cem> - 2017-01-23 07:47 -0500
              Re: keep secrets (was Re: embedded Forth) "Wolfgang Allinger" <all2001@spambog.com> - 2017-01-23 18:18 -0300
                Re: keep secrets (was Re: embedded Forth) rickman <gnuarm@gmail.com> - 2017-01-23 19:15 -0500
            Re: keep secrets (was Re: embedded Forth) rickman <gnuarm@gmail.com> - 2017-01-23 14:38 -0500
              Re: keep secrets (was Re: embedded Forth) "Wolfgang Allinger" <all2001@spambog.com> - 2017-01-23 18:43 -0300
                Re: keep secrets (was Re: embedded Forth) rickman <gnuarm@gmail.com> - 2017-01-23 19:48 -0500
                Re: keep secrets (was Re: embedded Forth) "Elizabeth D. Rather" <erather@forth.com> - 2017-01-23 16:30 -1000
                Re: keep secrets (was Re: embedded Forth) rickman <gnuarm@gmail.com> - 2017-01-23 22:23 -0500
  Re: embedded forth rickman <gnuarm@gmail.com> - 2017-01-22 13:44 -0500
    Re: embedded forth Paul Rubin <no.email@nospam.invalid> - 2017-01-22 13:38 -0800
      Re: embedded forth rickman <gnuarm@gmail.com> - 2017-01-23 00:45 -0500
        Re: embedded forth Dale Scott <dalescottnet@gmail.com> - 2017-01-22 22:44 -0800
          Re: embedded forth Paul Rubin <no.email@nospam.invalid> - 2017-01-23 00:48 -0800
          Re: embedded forth rickman <gnuarm@gmail.com> - 2017-01-23 03:51 -0500
      Re: embedded forth john <anon@example.com> - 2017-01-23 10:02 +0000
    Re: embedded forth anton@mips.complang.tuwien.ac.at (Anton Ertl) - 2017-01-23 09:01 +0000
      Re: embedded forth albert@cherry.spenarnc.xs4all.nl (Albert van der Horst) - 2017-01-23 13:05 +0100
        Re: embedded forth rickman <gnuarm@gmail.com> - 2017-01-23 14:40 -0500
          Re: embedded forth Mark Wills <markwills1970@gmail.com> - 2017-01-24 01:12 -0800
          Re: embedded forth albert@cherry.spenarnc.xs4all.nl (Albert van der Horst) - 2017-01-24 14:38 +0100
            Re: embedded forth rickman <gnuarm@gmail.com> - 2017-01-24 19:51 -0500
              Re: embedded forth albert@cherry.spenarnc.xs4all.nl (Albert van der Horst) - 2017-01-25 11:34 +0100
                Re: embedded forth rickman <gnuarm@gmail.com> - 2017-01-25 22:13 -0500
                Re: embedded forth albert@cherry.spenarnc.xs4all.nl (Albert van der Horst) - 2017-01-26 11:36 +0100
                Re: embedded forth rickman <gnuarm@gmail.com> - 2017-01-26 14:07 -0500
              Re: embedded forth Ilya Tarasov <ilya74.tarasov@gmail.com> - 2017-01-26 00:19 -0800
                Re: embedded forth rickman <gnuarm@gmail.com> - 2017-01-26 14:15 -0500
                Re: embedded forth Ilya Tarasov <ilya74.tarasov@gmail.com> - 2017-01-27 13:08 -0800
                Re: embedded forth rickman <gnuarm@gmail.com> - 2017-01-27 17:54 -0500
                Re: embedded forth Paul Rubin <no.email@nospam.invalid> - 2017-01-27 15:29 -0800
                Re: embedded forth Ilya Tarasov <ilya74.tarasov@gmail.com> - 2017-01-27 16:28 -0800
                Re: embedded forth rickman <gnuarm@gmail.com> - 2017-01-27 23:58 -0500
                Re: embedded forth Ilya Tarasov <ilya74.tarasov@gmail.com> - 2017-01-28 11:58 -0800
                Re: embedded forth rickman <gnuarm@gmail.com> - 2017-01-28 15:36 -0500
                Re: embedded forth Ilya Tarasov <ilya74.tarasov@gmail.com> - 2017-01-28 15:05 -0800
                Re: embedded forth Paul Rubin <no.email@nospam.invalid> - 2017-01-28 15:57 -0800
                Re: embedded forth rickman <gnuarm@gmail.com> - 2017-01-28 21:51 -0500
                Re: embedded forth Ilya Tarasov <ilya74.tarasov@gmail.com> - 2017-01-29 09:53 -0800
                Re: embedded forth albert@cherry.spenarnc.xs4all.nl (Albert van der Horst) - 2017-01-29 19:32 +0100
                Re: embedded forth Ilya Tarasov <ilya74.tarasov@gmail.com> - 2017-01-29 11:53 -0800
                Re: embedded forth rickman <gnuarm@gmail.com> - 2017-01-30 01:10 -0500
                Re: embedded forth Ilya Tarasov <ilya74.tarasov@gmail.com> - 2017-01-29 23:11 -0800
                Re: embedded forth Paul Rubin <no.email@nospam.invalid> - 2017-01-29 23:34 -0800
                Re: embedded forth albert@cherry.spenarnc.xs4all.nl (Albert van der Horst) - 2017-01-30 12:42 +0100
                Re: embedded forth albert@cherry.spenarnc.xs4all.nl (Albert van der Horst) - 2017-01-30 12:36 +0100
                Re: embedded forth ctmalan@gmail.com - 2017-01-30 11:02 -0800
                Re: embedded forth Paul Rubin <no.email@nospam.invalid> - 2017-01-30 11:04 -0800
                Re: embedded forth Andrew Haley <andrew29@littlepinkcloud.invalid> - 2017-01-31 04:34 -0600
                Re: embedded forth Ilya Tarasov <ilya74.tarasov@gmail.com> - 2017-01-30 12:15 -0800
                Re: embedded forth rickman <gnuarm@gmail.com> - 2017-01-30 10:15 -0500
                Re: embedded forth Ilya Tarasov <ilya74.tarasov@gmail.com> - 2017-01-30 12:20 -0800
                Re: embedded forth Paul Rubin <no.email@nospam.invalid> - 2017-01-30 14:09 -0800
                Re: embedded forth albert@cherry.spenarnc.xs4all.nl (Albert van der Horst) - 2017-01-31 03:04 +0100
                Re: embedded forth Paul Rubin <no.email@nospam.invalid> - 2017-01-30 20:19 -0800
                Re: embedded forth rickman <gnuarm@gmail.com> - 2017-01-30 17:10 -0500
                Re: embedded forth Ilya Tarasov <ilya74.tarasov@gmail.com> - 2017-01-30 14:38 -0800
                Re: embedded forth rickman <gnuarm@gmail.com> - 2017-01-30 23:09 -0500
                Re: embedded forth Ilya Tarasov <ilya74.tarasov@gmail.com> - 2017-01-31 09:32 -0800
                Re: embedded forth rickman <gnuarm@gmail.com> - 2017-02-08 18:22 -0500
                Re: embedded forth Ilya Tarasov <ilya74.tarasov@gmail.com> - 2017-02-09 01:46 -0800
                Re: embedded forth rickman <gnuarm@gmail.com> - 2017-02-09 05:11 -0500
                Re: embedded forth rickman <gnuarm@gmail.com> - 2017-02-12 01:30 -0500
                Re: embedded forth Ilya Tarasov <ilya74.tarasov@gmail.com> - 2017-02-12 10:21 -0800
                Re: embedded forth rickman <gnuarm@gmail.com> - 2017-02-12 19:37 -0500
                Re: embedded forth Ilya Tarasov <ilya74.tarasov@gmail.com> - 2017-02-14 13:26 -0800
                Re: embedded forth Gary Bergstrom <forthprgrmr@gmail.com> - 2017-02-14 11:36 -0800
                Re: embedded forth rickman <gnuarm@gmail.com> - 2017-02-14 18:13 -0500
                Re: embedded forth rickman <gnuarm@gmail.com> - 2017-01-28 21:51 -0500
                Re: embedded forth Ilya Tarasov <ilya74.tarasov@gmail.com> - 2017-01-29 10:20 -0800
                Re: embedded forth Cecil Bayona <cbayona@cbayona.com> - 2017-01-29 12:38 -0600
                Re: embedded forth Ilya Tarasov <ilya74.tarasov@gmail.com> - 2017-01-29 11:49 -0800
                Re: embedded forth rickman <gnuarm@gmail.com> - 2017-02-04 04:22 -0500
                Re: embedded forth Ilya Tarasov <ilya74.tarasov@gmail.com> - 2017-02-04 17:54 -0800
                Re: embedded forth hughaguilar96@gmail.com - 2017-02-04 20:26 -0800
                Re: embedded forth Ilya Tarasov <ilya74.tarasov@gmail.com> - 2017-02-05 07:53 -0800
                Re: embedded forth hughaguilar96@gmail.com - 2017-02-05 11:08 -0800
                Re: embedded forth hughaguilar96@gmail.com - 2017-02-05 11:39 -0800
                Re: embedded forth Ilya Tarasov <ilya74.tarasov@gmail.com> - 2017-02-08 06:46 -0800
                Re: embedded forth luser droog <mijoryx@yahoo.com> - 2017-02-13 19:17 -0800
                Re: embedded forth Ilya Tarasov <ilya74.tarasov@gmail.com> - 2017-02-15 06:23 -0800
                Re: embedded forth hughaguilar96@gmail.com - 2017-02-15 11:09 -0800
                Re: embedded forth Ilya Tarasov <ilya74.tarasov@gmail.com> - 2017-02-15 15:24 -0800
                Re: embedded forth jkn_gg@nicorp.f9.co.uk - 2017-02-16 09:49 -0800
                Re: embedded forth hughaguilar96@gmail.com - 2017-02-17 09:12 -0800
                Re: embedded forth Ilya Tarasov <ilya74.tarasov@gmail.com> - 2017-02-17 12:47 -0800
                Re: embedded forth hughaguilar96@gmail.com - 2017-02-17 16:18 -0800
                Re: embedded forth luser droog <mijoryx@yahoo.com> - 2017-02-16 08:43 -0800
                Re: embedded forth Alex <alex@rivadpm.com> - 2017-02-05 20:47 +0000
                Re: embedded forth hughaguilar96@gmail.com - 2017-02-05 13:36 -0800
                Re: embedded forth Alex <alex@rivadpm.com> - 2017-02-05 23:18 +0000
                Re: embedded forth hughaguilar96@gmail.com - 2017-02-05 21:10 -0800
                Re: embedded forth Alex <alex@rivadpm.com> - 2017-02-06 11:12 +0000
                Re: embedded forth hughaguilar96@gmail.com - 2017-02-05 21:15 -0800
                Re: embedded forth hughaguilar96@gmail.com - 2017-02-05 22:45 -0800
                Re: embedded forth albert@cherry.spenarnc.xs4all.nl (Albert van der Horst) - 2017-02-06 12:04 +0100
                Re: embedded forth Ilya Tarasov <ilya74.tarasov@gmail.com> - 2017-02-08 03:08 -0800
                Re: embedded forth rickman <gnuarm@gmail.com> - 2017-02-08 06:39 -0500
                Re: embedded forth Ilya Tarasov <ilya74.tarasov@gmail.com> - 2017-02-08 07:15 -0800
                Re: embedded forth rickman <gnuarm@gmail.com> - 2017-02-08 15:49 -0500
                Re: embedded forth Ilya Tarasov <ilya74.tarasov@gmail.com> - 2017-02-09 01:14 -0800
                Re: embedded forth rickman <gnuarm@gmail.com> - 2017-02-09 05:19 -0500
                Re: embedded forth Ilya Tarasov <ilya74.tarasov@gmail.com> - 2017-02-09 03:48 -0800
                Re: embedded forth rickman <gnuarm@gmail.com> - 2017-02-05 16:08 -0500
                Re: embedded forth rickman <gnuarm@gmail.com> - 2017-02-07 21:59 -0500
                Re: embedded forth albert@cherry.spenarnc.xs4all.nl (Albert van der Horst) - 2017-01-28 11:10 +0100
                Re: embedded forth rickman <gnuarm@gmail.com> - 2017-01-28 06:15 -0500
                Re: embedded forth albert@cherry.spenarnc.xs4all.nl (Albert van der Horst) - 2017-01-28 19:48 +0100
                Re: embedded forth rickman <gnuarm@gmail.com> - 2017-01-28 14:37 -0500
                Re: embedded forth mhx@iae.nl - 2017-01-28 07:48 -0800
                Re: embedded forth albert@cherry.spenarnc.xs4all.nl (Albert van der Horst) - 2017-01-28 19:53 +0100
                Re: embedded forth mhx@iae.nl - 2017-01-28 15:49 -0800
        Re: embedded forth "Wolfgang Allinger" <all2001@spambog.com> - 2017-01-23 18:46 -0300

csiph-web