Comments for debugmode

Comment on ${stupid-syscall-02(*)-joke-here} by happy_bunny

happy_bunny — Mon, 09 Aug 2010 15:08:37 +0000

Congratulations

everytime she smiles it will melt your heart ;-)

Comment on What’s Inside, Part III: TP-Link TL-SG1008D by Bebert

Bebert — Tue, 27 Jul 2010 18:39:27 +0000

Ok, my TL-SG1008D seems to be different : no Broadcom chipset but two realtek IC : RTL8368S and RTL8214

My TL-SG1008D is rev 1.1 (printed on the pcb board).

The eeprom is a CSI 24C08. I dumped it but I don’t talk the hexa.

http://pastebin.ca/1909504

Comment on What’s Inside, Part III: TP-Link TL-SG1008D by Bebert

Bebert — Tue, 27 Jul 2010 07:16:01 +0000

Hi,

I ordered a TL-SG1008D. I unsoldered the eeprom and now I am stuck at dumping. I only have an arduino (my bus pirate is coming). My goal is to add a small web interface to enable/disable all options of the ethernet chipset (vlan, qos …)

Comment on Scope pr0n by tmbinc

tmbinc — Mon, 26 Jul 2010 22:28:26 +0000

Congratulations toxic, you hit it right on the head!

In fact, the picture above shows:

Green trace: HF data coming from the laser pickup.
Yellow trace: Recovered clock
Blue trace: Recovered data

The data is from a Datel disc (“ultimate cheatcodes”) and shows the “laser mark”; except that it’s not written with an actual laser, but simply embedded in the datastream!

To compare it with the picture from the last post, which showed a real, genuine GC disc. There are subtle differences (like the “noise” in the zeroed region).

So toxic is also right with his assumption that this will be the cliffhanger for the 3rd part of the story.

Comment on Scope pr0n by toxic

toxic — Sat, 24 Jul 2010 12:27:04 +0000

After reading again the post in question it’s very likely that the traces are taken from on of the Datel discs, paving the way for the 3rd part of the story :)

Comment on Scope pr0n by backatyou

backatyou — Thu, 22 Jul 2010 21:02:33 +0000

I’d guess it’s related to this post:
http://debugmo.de/2008/11/anatomy-of-an-optical-medium-authentication/

Just as toxic stated.

Comment on Scope pr0n by toxic

toxic — Tue, 20 Jul 2010 18:59:40 +0000

After a bit more thought, it is much more likely that the data is in fact analog+efm data from a GC disc, the breakthrough being that someone was able to create one in his kitchen? :) (and maybe burning the corresponding BCA using the same technique?)

Comment on Scope pr0n by toxic

toxic — Sun, 18 Jul 2010 21:20:28 +0000

I’ll even try the bonus points: The data is unique because that piece takes a break from RLL (as you just said), and it’s a breakthrough because it’s related to PS3 disc protection?

Comment on Scope pr0n by toxic

toxic — Sun, 18 Jul 2010 21:13:16 +0000

I’ll try: raw blueray data, analog + digitalized efm ?

Comment on Scope pr0n by tmbinc

tmbinc — Sun, 18 Jul 2010 08:57:54 +0000

Nice guesses so far! Some of them are closer, some of them not-so-close, but certainly valid based on the available material in this post. Thanks a lot already!

First, the information-density of the green trace is equal to that of the blue trace, as Tyler pointed out. Blue is in fact, as adam pointed out, the digitized, or “sliced”, version of the green one. Yellow is the recovered clock.

adam is also right when comparing the green signal to an overdriven opamp output; however, no opamp characteristics are involved here. But the waveform distortion can be described as a kind of low-pass filter. In this case, the low-pass effect is caused by the physical proportions of two elements in the system.

You will likely notice the sparseness of the blue signal compared to the clock; that indicates that a special line code has been used, in this case a code to limit the minimum and maximum number of consecutive ones or zeros; this is called an RLL-code, a run-length limited code. The upper bound is set to allow a successful clock recovery, the lower bound to limit the high-frequency components that would get lost due to the “low-pass filter” characteristics. Because of the used code, there is 50% redundancy on top of the payload data. Quite a lot, but that’s life, and also already a 1/17th improvement over the previous generation of this technology.

The long zero sequence, however, is a violation of the RLL rule. And while the data is NRZI encoded, so the data polarity doesn’t matter, the violation will always be low, and never high.