Reply to thread

Message: <blockquote data-quote="Lakshan-Seram" data-source="post: 18054951" data-attributes="member: 358904"><img src="http://www.nycresistor.com/wp-content/uploads/2014/04/Ghosts-in-the-ROM-300x143.jpg" alt="" class="fr-fic fr-dii fr-draggable " style="" /> While digging through dumps generated from the Apple Mac SE ROM  images we noticed that there was a large amount of non-code, non-audio  data.  Adam Mayer tested different stride widths and found that at 67  bytes (536 pixels across) there appeared to be some sort of image data  that clearly was a picture of people.  The rest of the image was skewed  and distorted, so we knew that it wasn’t stored as an uncompressed  bitmap.   After some investigation, we were able to decode the scrambled mess  above and turn it into the full image with a hidden message from “Thu, Nov 20, 1986“:   <a href="http://www.nycresistor.com/2012/08/21/ghosts-in-the-rom/mac-se-engineers-0x1d93c/" target="_blank"><img src="http://www.nycresistor.com/wp-content/uploads/2014/04/Mac-SE-engineers-0x1D93C--300x199.jpg" alt="" class="fr-fic fr-dii fr-draggable " style="" /></a>   Read on for the reverse engineering details of how we recovered this  and the other three photographs stored in the ROM, and some information  about the Motorola 68000 era Macintosh. <a href="http://www.nycresistor.com/2012/08/21/ghosts-in-the-rom/treasure-in-the-trash/" target="_blank"><img src="http://www.nycresistor.com/wp-content/uploads/2014/04/Treasure-in-the-trash-224x300.jpg" alt="" class="fr-fic fr-dii fr-draggable " style="" /></a> We found this Macintosh SE on the side of the road in Brooklyn and  carried it to NYC Resistor.  It boots, but lacks any media, so we  decided to do some further digital archeology.   <a href="http://www.nycresistor.com/2012/08/21/ghosts-in-the-rom/mac-se/" target="_blank"><img src="http://www.nycresistor.com/wp-content/uploads/2014/04/Mac-SE-300x224.jpg" alt="" class="fr-fic fr-dii fr-draggable " style="" /></a>   We removed the two ROM chips (the ones in the middle of the board,  above the VLSI ASIC that is the Integrated Woz Machine) and dumped them  with my <a href="http://bitbucket.org/hudson/prom/" target="_blank">PROMdate</a> device.  The pinout for the chips is the same as the M27C512 PROM, but with the Vpp  pin reused for A17.  Since it is a mask ROM that can’t be reprogrammed  there is no need for the programming pin (Thanks, Nick!).  This exapnds  the address space to 128 KB (1024 kilobits) compared to the 64 KB of the  M27C512 programmable ROM.   <a href="http://www.nycresistor.com/2012/08/21/ghosts-in-the-rom/promdate-now-with-avr-support/" target="_blank"><img src="http://www.nycresistor.com/wp-content/uploads/2014/04/PROMdate-Now-with-AVR-support-300x224.jpg" alt="" class="fr-fic fr-dii fr-draggable " style="" /></a>   The m68k has a 16-bit wide bus, so each 128 KB 8-bit ROM has half a  word and they need to be merged into a single 256 KB binary file.  We  knew we had a good dump and merge when strings on the file contained human readable textlike “Chicago“, “PACK” and “CDEF” (if you have the byte order wrong these will be “APKC“, etc).   <a href="http://www.eeggs.com/items/2258.html" target="_blank">Reports of the easter egg</a> said that it could be found by jumping to address 0x41D89A.  I was able to boot the ROMs in <a href="http://minivmac.sourceforge.net/" target="_blank">Mini vMac</a>  and confirm that these were indeed the secret images that had already  been discovered.  That could have been the end of it, but we wanted to  know how they were stored and displayed, and to be able to look for any  other surprises stored in the ROM, so further investigation was  required.   To disassemble the ROM, I found it easiest to convert the raw binary dump to an ELF file so that objdump will process it.  We know from history that the ROM was mapped to address 0x0040_0000  (24 MB) in memory, so we set the starting address of the ELF file  there.  IDA Pro is another great tool for doing exactly this sort of  reverse engineering, but we’re using free software for this analysis. ------ More [HTML]http://www.nycresistor.com/2012/08/21/ghosts-in-the-rom/[/HTML]</blockquote>

Verification: Awruddata maasa keeyada?

Top Bottom