Reverse Engineering

Why is this board named /gorp/? Why not /re/ or something?

Dude... how did I get here?

>>2
Exactly.
I wish I knew how I got here...

Test
test
test
test
test
test
test
test
test
test
test
test
test
test
....
test
(Post truncated.)

>>4
Gorrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrp.

I wish this was an active board or something :C

>>6
Me too. I keep waiting.

For what? I don't know.

board initialization post

>>7
What, now it says reverse engineering and sometimes i can't see that post on the board home. Am I drunk?

>>7
lol

should it be Programming Engineering and Reverse Engineering?

um...

Software Engineering and Reverse Engineering?

You tell me what those labels should say.

>>8
f5. I have aggressive caching turned on.

hmm... what to do with this, Cudder?

Kill it along with the other boards

This board needs life, not death.

Also, I'm hardly flooding, software! It is just used to such quiet, I guess...

A little edit I had to do to make DirectShow recognize the newest ID3 tags:

Open quartz.dll in a hex editor and find "ID3". It should look something like this (addresses might be different if you have a different version, but otherwise the code is much the same):

355088DA: 0FB610       movzx edx, b[eax]
355088DD: 33C9         xor ecx,ecx
355088DF: 8A6802       mov ch,[eax][0002]
355088E2: 8A4801       mov cl,[eax][0001]
355088E5: C1E108       shl ecx,08
355088E8: 0BCA         or  ecx,edx
355088EA: 81F949443300 cmp ecx,00334449 ; "ID3"?
355088F0: 7405         je  355088F7
355088F2: 33C0         xor eax,eax
355088F4: C20400       retn 0004
355088F7: F7400680808080 test [eax][0006],80808080
355088FE: 75F2         jne 355088F2 ; header lengths
(Post truncated.)

Its pop-up is really annoying. I was thinking about cracking it with this instructions (I'm new to decompiling):

http://answers.yahoo.com/question/index?qid=20080812125556AASqkjy

Has anybody done it already?

[m]Back to /pr/, bitch[/m]

One word, THE FORCED DECOMPILATION OF CODE, thread over.

>>2
\m/

is a good place to get instruction set docs for microprocessors?

I need the instruction set for an NEC 78310.

http://pdf.weeqoo.com/FileDown-1136733.html
http://www.necel.com/cgi-bin/nesdis/dl_docpdf.cgi?lang=E&litcode=U12118EJ4V0AN00

What sort of project are you doing? That is one hell of an obscure CPU.

>>2
Thank you kindly.

The abovementioned CPU is present in my Kawai K4 synthesizer. I suspect a similar CPU is also in my XD-5 drum synth and Q-80 sequencer, also Kawai brand.

I opened up the keyboard one day. Found a set of 3 socketed PROMs and one other socketed EEPROM. Suspect that the PROMs are waveform ROM and the EEPROM is the program ROM.

I had a vague desire to dump the EEPROM, disassemble and figure out what's going on, and reburn a modified EEPROM that turns it into a crude sampler.

I did manage to find some datasheets that list the instruction set. No opcodes... :( I even found some tools (trial versions) on NEC's site.

Basic information for those interested:

- 16-bit
- Max. 12Mhz
- 64K address space
(Post truncated.)

There's a lot of bit manipulation instructions that aren't on the 8080 AFAIK.

If it's an 8080-like with bit ops, it might be a Z80-clone, but looking at the PDFs above, the instructions don't match up (e.g. 58 is RET for the NEC, whereas on Z80/8080 it's at C9).

Here is the 78K/0 manual:
http://www.datasheet4u.com/html/7/8/0/780058_NEC.pdf.html

This is the 78K/IV manual:
http://www.icbase.com/newic/just.asp?urlftp=/NEC/NEC00680106.pdf

The instruction sets shouldn't have changed much.

Looks like I'm not going to close this board after all.

>>4
Oh hell yes! Those manuals are exactly what I needed. Thanks a lot!

Do post more about your project, there are tons of "reversing" (read: cracking) forums out there but obscure hardware and non-cracking projects are more interesting.

You better do it or she'll ban the shit out of you.

Just another thing I'm working on...

If the first 4 bytes of the command packet are not exactly "USBC" or an unrecognized command is received, the device goes into an infinite loop until reset by the watchdog.

The command itself is the byte at offset 15 within the packet.

Command 5:
~~~~~~~~~~
Parameters used:
b : direction (bit 7)
c : address
e : memory
f : length

Transfers f bytes of code to/from memory e at address c
Bit 7 of b determines direction: 0 = host to device
(Post truncated.)

ASM, the original dynamic programming language!

Speaking of dynamic programming; I'm learning to write self modifying code. Hooray!

So who's going to write the Anonix Disassembler?

How about we start with the Anonix HexEditor? I imagine someone already got hexdump for coreutitls, yeah?