Reverse Engineering

« first day (1464 days earlier) ← previous day next day → last day (2363 days later) »

12:21 PM

@IgorSkochinsky as a moderator are you able to delete chat rooms created by other users? Id like to delete the one I made but I cant figure out how or if its even possible

Igor Skochinsky

12:42 PM

yes I can remove it

SYS_V

12:56 PM

do I need to make you admin of the chat room?

(by admin i mean an owner)

Igor Skochinsky

you sure you want to delete it/

Igor Skochinsky

1:33 PM

@SYS_V poke

SYS_V

Sorry. Yes im sure. The person invited to participate in the chat room has no interest in divulging information that would confirm that what he is attempting to do is...irregular. The proprietary format he wants to reverse was developed by Honeywell, a large company that actively provides support for its clients. So why does he go to an RE forum for help instead of Honeywell? Why does he not have access to client software designed to interface with the operational historian?

Igor Skochinsky

SYS_V

I know it probably depends on the locale, but is RE of proprietary formats legally acceptable?

Igor Skochinsky

my guess would be he got asked by boss to do something the sw does not allow/support and going through Honeywell would be too slow or expensive

RE for interoperability is generally allowed AFAIK

there was a recent case in Europe about some kind of scripting language or something...

SYS_V

Since this can be inferred from the deliberate way he has omitted information there is no need to ask him directly. Thats why I wanted to delete the chat room. Its not necessary and he wont join anyway

That case in Europe about a scripting language - was the language proprietary?

Igor Skochinsky

1:43 PM

yes

this I think worldcadaccess.com/blog/2012/05/…

SAS Institute Inc v World Programming Ltd

The SAS Institute, creators of the SAS System filed a lawsuit against World Programming Limited, creators of World Programming System (WPS) in November 2009. The dispute was whether World Programming had infringed copyrights on SAS Institute Products, and Manuals and whether World Programming used SAS Learning Edition to reverse engineer SAS system in violation with its term of usage. The case is interesting because World Programming did not have access to the SAS Institute's source code, and so the court considered the merits of a copyright claim based on observing functionality only. The European...

SYS_V

"copyright protection does not extend to the software functionality, the programming language used and the format of the data files used by the program"

thats an interesting ruling. I wonder what the ramifications will be for companies that rely primarily on software products as a revenue source

but I suppose its good for European reverse engineers

@NirIzr hello

NirIzr

2:01 PM

Cheers :)

Igor Skochinsky

2:11 PM

hmm now that I looked at it again I think I may be getting somewhere with my nand dump...

SYS_V

the one in the question you posted?

Igor Skochinsky

yep

looks like page size is 4K (0x1000), consisting of 4 sectors of 0x200+ 0x10 bytes of spare data (ECC)

that's why removing 0x10 every 0x200 bytes breaks after 4 iterations

I guess page-level OOB got removed but sector one remained

or something

there's some kind of partition table at 082000, apparently the block size is 128 pages (0x1040*128==0x82000)

icx1087_nand.c in u-boot sources has code for parsing it

SYS_V

2:40 PM

In order for the encrypted user data to be decrypted the OOB data must be removed from the image dump?

Igor Skochinsky

well, the data in dump is not encrypted, but the OOB prevents me from extracting files from the filesystem.

SYS_V

3:08 PM

Oh I see

Igor Skochinsky

the firmware update is encrypted and key (and algorithm) is somewhere in the dump

SYS_V

3:48 PM

Aha thats why the dump is being analyzed. I get it now

1 hour later…

SYS_V

5:06 PM

i like the new "not enough info" close option

NirIzr

5:19 PM

yep, long overdue :)

SYS_V

its a bit general though, so we should probably tell people what additional info they should provide / what they are missing when (or before) we vote to close / close

NirIzr

I guess Igor can make it mandatory to add text when closing for that reason, making it at least easier to explain what's missing

SYS_V

Yeah that sounds good. A little explanation can go a long way. In a comment on the azure storage access key question I included a link to the discussion on the meta about "decrypt this for me" type questions so that the person who asked has an idea of why we voted to close

NirIzr

I usually like answering those questions if I have the spare time and see the OP made an effort. They're more challenging then some other question types I often see.

Take a look at this question, for example (although it is a bit more general then "decrypt this for me"): reverseengineering.stackexchange.com/questions/13475/…

SYS_V

5:34 PM

I have actually seen that question before. It was included in discussion as a reference for how such questions should be asked. If enough info is included to make answering it a realistic prospect I would say that it is fine

many unanswered questions were examined and a common problem was that people would basically dump some ciphertext and say "reverse this"

gtg

NirIzr

Actually, now that you say that.. I took a look at the original question vs the edits i've made in it and it was kinda like what you described...

see ya

1 hour later…

Igor Skochinsky

6:48 PM

wait, what new option?