6.3 Basics of Reverse-Engineering Art
531
Software
Just like hardware, software also requires a detailed analysis using the same two
methods: reverse engineering and functioning analysis. Reverse software engineering
is the process that consists in extracting the source machine code and converting it
to a human-readable form. The first task is often to extract the embedded code from
the memory of chip. Here, it is possible to use various methods, such as EEPROM
programmers, bus monitoring during code uploading, and extraction of circuit parameters. The code is sometimes protected with software or hardware interlock. It is
frequently blocked using several methods at once. A good method of accessing its
contents can be the port for chip testing. Different methods of micro-intervention in
the IC design can be used to modify or bypass hardware interlocks. As a rule, these
methods require performing detailed analysis of the electrical circuit in advance in
order to identify all possible interlocks and find technical solutions that will disable
them.
Any encrypted code requires analysis of the method of its encryption, followed by
the decryption process. This requires knowledge of the key and clear understanding
of the encryption algorithm used by the manufacturer. Keys can be often read from
local memory using the above methods. The encryption algorithm can be sometimes
determined with the help of a simple analysis of the available technical documentation or functioning analysis. If these methods fail to achieve a positive result, it is
possible to use complete extraction of the circuit parameters in order for the reverse
engineering to determine the original algorithm of the device operation.
If the type of the code and the system of commands are known in advance, the
reverse assembler program can be used after extracting the code. After that, it is
possible to use other standard system software means in order to extract the assembler
code and convert it to the format most similar to the C language. Then this structured
code can be analyzed by software experts. The code obtained may be analyzed either
in static (dead) mode or in dynamic (live) mode. Live analysis is used if it is possible
to obtain full control over the processor: start and stop code, registers for inspection,
memory, code execution tracking. Of course, it is always more preferable to work
with live analysis than with analysis of dead code, which only includes analyzing
instructions without the possibility to inspect the code during its operation. Using
various standard software simulators, one can apply another RE mode, which is
placed between these two.
Software functioning analysis is very similar to hardware functioning analysis.
Special testing blocks are developed, special test effects and testing equipment are
created, and, finally, the program is executed. Output data of this program can take
various forms, from creating graphic diagrams or controlling GUI to controlling a
robot or playing a song. These output data can be later easily analyzed to get a better
understanding of a software or a system in general.
531
Software
Just like hardware, software also requires a detailed analysis using the same two
methods: reverse engineering and functioning analysis. Reverse software engineering
is the process that consists in extracting the source machine code and converting it
to a human-readable form. The first task is often to extract the embedded code from
the memory of chip. Here, it is possible to use various methods, such as EEPROM
programmers, bus monitoring during code uploading, and extraction of circuit parameters. The code is sometimes protected with software or hardware interlock. It is
frequently blocked using several methods at once. A good method of accessing its
contents can be the port for chip testing. Different methods of micro-intervention in
the IC design can be used to modify or bypass hardware interlocks. As a rule, these
methods require performing detailed analysis of the electrical circuit in advance in
order to identify all possible interlocks and find technical solutions that will disable
them.
Any encrypted code requires analysis of the method of its encryption, followed by
the decryption process. This requires knowledge of the key and clear understanding
of the encryption algorithm used by the manufacturer. Keys can be often read from
local memory using the above methods. The encryption algorithm can be sometimes
determined with the help of a simple analysis of the available technical documentation or functioning analysis. If these methods fail to achieve a positive result, it is
possible to use complete extraction of the circuit parameters in order for the reverse
engineering to determine the original algorithm of the device operation.
If the type of the code and the system of commands are known in advance, the
reverse assembler program can be used after extracting the code. After that, it is
possible to use other standard system software means in order to extract the assembler
code and convert it to the format most similar to the C language. Then this structured
code can be analyzed by software experts. The code obtained may be analyzed either
in static (dead) mode or in dynamic (live) mode. Live analysis is used if it is possible
to obtain full control over the processor: start and stop code, registers for inspection,
memory, code execution tracking. Of course, it is always more preferable to work
with live analysis than with analysis of dead code, which only includes analyzing
instructions without the possibility to inspect the code during its operation. Using
various standard software simulators, one can apply another RE mode, which is
placed between these two.
Software functioning analysis is very similar to hardware functioning analysis.
Special testing blocks are developed, special test effects and testing equipment are
created, and, finally, the program is executed. Output data of this program can take
various forms, from creating graphic diagrams or controlling GUI to controlling a
robot or playing a song. These output data can be later easily analyzed to get a better
understanding of a software or a system in general.