satguy2
12-28-2007, 08:01 PM
Got this off another site, I hope thingsare not as grim as it looks
Here is what Fab5 had to say about this
Quote:
Battle of the Bulge?
Well, this is it folks. I am calling it the Battle of the Bulge. This is the final desperate push by Nagra to defeat all hardware emulators. The stakes could not be higher: if they win, no single stand-alone hardware emulator is coming back. If they lose, they have nothing else to throw at us, at least nothing harder than this.
Their tactic is the (expected) timer hash of Map0x57. Map0x57, as most coders know is a convoluted implementation of elliptic curve multiplication (ECC). Timing a standard ECC function is hard enough, but timing a proprietary one is much, much harder - if not impossible.
My plan is to counter this attack with my favourite weapon of choice: statistics.It worked well for us last time, lets hope it works out this time too.
For those who are culturally deprived, the Battle of the Bulge was the last desperate offensive by the Germans, prepared with skill and secrecy, to capture the key strategic city of Bastogne around Christmas of 1944. Greatly outnumbered and outflanked, the allies held the city and the men who survived came to be known as the "Battered Bastards of Bastogne".
Lets see what the battered, bastard coders can do this time around...wish me luck!
PS. The battle field (MECM0x40) is depicted below.
Code:
00:0100: 99 sec
00:0101: 8A pushcc
00:0102: 9B sei
00:0103: B6 0D lda $0D
00:0105: 88 pusha
00:0106: A4 F7 and #$F7
00:0108: B7 0D sta $0D
00:010A: B6 12 lda $12
00:010C: 88 pusha
00:010D: B6 11 lda $11
00:010F: 88 pusha
00:0110: 13 12 bclr1 $12
00:0112: 9D nop
00:0113: 13 16 bclr1 $16
00:0115: A6 00 lda #$00
00:0117: C7 0B 92 sta $0B92
00:011A: A6 0B lda #$0B
00:011C: C7 0B 93 sta $0B93
00:011F: A6 A2 lda #$A2
00:0121: C7 0B 94 sta $0B94
00:0124: A6 0B lda #$0B
00:0126: C7 0B 95 sta $0B95
00:0129: A6 B2 lda #$B2
00:012B: C7 0B 96 sta $0B96
00:012E: A6 0B lda #$0B
00:0130: C7 0B 97 sta $0B97
00:0133: A6 C2 lda #$C2
00:0135: C7 0B 98 sta $0B98
00:0138: A6 0B lda #$0B
00:013A: C7 0B 99 sta $0B99
00:013D: A6 D2 lda #$D2
00:013F: C7 0B 9A sta $0B9A
00:0142: A6 0B lda #$0B
00:0144: C7 0B 9B sta $0B9B
00:0147: A6 E2 lda #$E2
00:0149: C7 0B 9C sta $0B9C
00:014C: A6 0B lda #$0B
00:014E: C7 0B 9D sta $0B9D
00:0151: A6 F2 lda #$F2
00:0153: C7 0B 9E sta $0B9E
00:0156: A6 02 lda #$02
00:0158: B7 48 sta $48
00:015A: A6 02 lda #$02
00:015C: CD 38 40 jsr $3840
00:015F: A6 0B lda #$0B
00:0161: B7 46 sta RC1
00:0163: A6 93 lda #$93
00:0165: B7 47 sta $47
00:0167: 13 16 bclr1 $16
00:0169: 13 12 bclr1 $12
00:016B: A6 41 lda #$41
00:016D: B7 16 sta $16
00:016F: A6 49 lda #$49
00:0171: B7 12 sta $12
00:0173: A6 FF lda #$FF
00:0175: B7 15 sta $15
00:0177: B7 11 sta $11
00:0179: 3F 14 clr $14
00:017B: 3F 10 clr $10
00:017D: 12 16 bset1 $16
00:017F: 9D nop
00:0180: 12 12 bset1 $12
00:0182: A6 57 lda #$57
00:0184: CD 38 40 jsr $3840
00:0187: 13 16 bclr1 $16
00:0189: 9D nop
00:018A: 13 12 bclr1 $12
00:018C: AD 37 bsr $1C5
00:018E: A6 04 lda #$04
00:0190: B7 47 sta $47
00:0192: A6 00 lda #$00
00:0194: B7 48 sta $48
00:0196: C6 0B 93 lda $0B93
00:0199: B7 4A sta $4A
00:019B: C6 0B 94 lda $0B94
00:019E: B7 4B sta $4B
00:01A0: A6 40 lda #$40
00:01A2: CD 5B E0 jsr Move_A_RC1_to_RC2
00:01A5: B6 14 lda $14
00:01A7: 31 C7 0B 92 sta [$0B92:$0B93:$0B94]
00:01AB: AD 18 bsr $1C5
00:01AD: B6 10 lda $10
00:01AF: 31 C7 0B 92 sta [$0B92:$0B93:$0B94]
00:01B3: 84 popa
00:01B4: B7 11 sta $11
00:01B6: 84 popa
00:01B7: 97 tax
00:01B8: A4 FD and #$FD
00:01BA: B7 12 sta $12
00:01BC: 9F txa
00:01BD: B7 12 sta $12
00:01BF: 84 popa
00:01C0: B7 0D sta $0D
00:01C2: 86 popcc
00:01C3: 98 clc
00:01C4: 87 rtsp
00:01C5: C6 0B 94 lda $0B94
00:01C8: AB 08 add #$08
00:01CA: C7 0B 94 sta $0B94
00:01CD: C6 0B 93 lda $0B93
00:01D0: A9 00 adc #$00
00:01D2: C7 0B 93 sta $0B93
00:01D5: 81 rts
Here is what Fab5 had to say about this
Quote:
Battle of the Bulge?
Well, this is it folks. I am calling it the Battle of the Bulge. This is the final desperate push by Nagra to defeat all hardware emulators. The stakes could not be higher: if they win, no single stand-alone hardware emulator is coming back. If they lose, they have nothing else to throw at us, at least nothing harder than this.
Their tactic is the (expected) timer hash of Map0x57. Map0x57, as most coders know is a convoluted implementation of elliptic curve multiplication (ECC). Timing a standard ECC function is hard enough, but timing a proprietary one is much, much harder - if not impossible.
My plan is to counter this attack with my favourite weapon of choice: statistics.It worked well for us last time, lets hope it works out this time too.
For those who are culturally deprived, the Battle of the Bulge was the last desperate offensive by the Germans, prepared with skill and secrecy, to capture the key strategic city of Bastogne around Christmas of 1944. Greatly outnumbered and outflanked, the allies held the city and the men who survived came to be known as the "Battered Bastards of Bastogne".
Lets see what the battered, bastard coders can do this time around...wish me luck!
PS. The battle field (MECM0x40) is depicted below.
Code:
00:0100: 99 sec
00:0101: 8A pushcc
00:0102: 9B sei
00:0103: B6 0D lda $0D
00:0105: 88 pusha
00:0106: A4 F7 and #$F7
00:0108: B7 0D sta $0D
00:010A: B6 12 lda $12
00:010C: 88 pusha
00:010D: B6 11 lda $11
00:010F: 88 pusha
00:0110: 13 12 bclr1 $12
00:0112: 9D nop
00:0113: 13 16 bclr1 $16
00:0115: A6 00 lda #$00
00:0117: C7 0B 92 sta $0B92
00:011A: A6 0B lda #$0B
00:011C: C7 0B 93 sta $0B93
00:011F: A6 A2 lda #$A2
00:0121: C7 0B 94 sta $0B94
00:0124: A6 0B lda #$0B
00:0126: C7 0B 95 sta $0B95
00:0129: A6 B2 lda #$B2
00:012B: C7 0B 96 sta $0B96
00:012E: A6 0B lda #$0B
00:0130: C7 0B 97 sta $0B97
00:0133: A6 C2 lda #$C2
00:0135: C7 0B 98 sta $0B98
00:0138: A6 0B lda #$0B
00:013A: C7 0B 99 sta $0B99
00:013D: A6 D2 lda #$D2
00:013F: C7 0B 9A sta $0B9A
00:0142: A6 0B lda #$0B
00:0144: C7 0B 9B sta $0B9B
00:0147: A6 E2 lda #$E2
00:0149: C7 0B 9C sta $0B9C
00:014C: A6 0B lda #$0B
00:014E: C7 0B 9D sta $0B9D
00:0151: A6 F2 lda #$F2
00:0153: C7 0B 9E sta $0B9E
00:0156: A6 02 lda #$02
00:0158: B7 48 sta $48
00:015A: A6 02 lda #$02
00:015C: CD 38 40 jsr $3840
00:015F: A6 0B lda #$0B
00:0161: B7 46 sta RC1
00:0163: A6 93 lda #$93
00:0165: B7 47 sta $47
00:0167: 13 16 bclr1 $16
00:0169: 13 12 bclr1 $12
00:016B: A6 41 lda #$41
00:016D: B7 16 sta $16
00:016F: A6 49 lda #$49
00:0171: B7 12 sta $12
00:0173: A6 FF lda #$FF
00:0175: B7 15 sta $15
00:0177: B7 11 sta $11
00:0179: 3F 14 clr $14
00:017B: 3F 10 clr $10
00:017D: 12 16 bset1 $16
00:017F: 9D nop
00:0180: 12 12 bset1 $12
00:0182: A6 57 lda #$57
00:0184: CD 38 40 jsr $3840
00:0187: 13 16 bclr1 $16
00:0189: 9D nop
00:018A: 13 12 bclr1 $12
00:018C: AD 37 bsr $1C5
00:018E: A6 04 lda #$04
00:0190: B7 47 sta $47
00:0192: A6 00 lda #$00
00:0194: B7 48 sta $48
00:0196: C6 0B 93 lda $0B93
00:0199: B7 4A sta $4A
00:019B: C6 0B 94 lda $0B94
00:019E: B7 4B sta $4B
00:01A0: A6 40 lda #$40
00:01A2: CD 5B E0 jsr Move_A_RC1_to_RC2
00:01A5: B6 14 lda $14
00:01A7: 31 C7 0B 92 sta [$0B92:$0B93:$0B94]
00:01AB: AD 18 bsr $1C5
00:01AD: B6 10 lda $10
00:01AF: 31 C7 0B 92 sta [$0B92:$0B93:$0B94]
00:01B3: 84 popa
00:01B4: B7 11 sta $11
00:01B6: 84 popa
00:01B7: 97 tax
00:01B8: A4 FD and #$FD
00:01BA: B7 12 sta $12
00:01BC: 9F txa
00:01BD: B7 12 sta $12
00:01BF: 84 popa
00:01C0: B7 0D sta $0D
00:01C2: 86 popcc
00:01C3: 98 clc
00:01C4: 87 rtsp
00:01C5: C6 0B 94 lda $0B94
00:01C8: AB 08 add #$08
00:01CA: C7 0B 94 sta $0B94
00:01CD: C6 0B 93 lda $0B93
00:01D0: A9 00 adc #$00
00:01D2: C7 0B 93 sta $0B93
00:01D5: 81 rts