B981 3762 1D30 CA05 E2C1 CD7F 3C68 C8DB CBA783EF
The x86 is a major architecture
- Popularity
- 32-bit and 64-bit versions with some backward compatibility to 16-bit
- Von Neumann
- Cheap
- Monoculture
- Cheap to break out
B981 3762 1D30 CA05 E2C1 CD7F 3C68 C8DB CBA783EF
Old Non-x86 Architectures are too hard!
Qemu supports
aarch64 alpha arm cris i386 lm32 m68k microblaze microblazeel mips mips64 mips64el mipsel moxie nios2 or1k ppc ppc64 ppcemb s390x sh4 sh4eb sparc sparc64 tricore unicore32 x86_64 xtensa xtensaeb
MAME supports many old architectures!
CTF Challenges use your bias against you!*
B981 3762 1D30 CA05 E2C1 CD7F 3C68 C8DB CBA783EF
Aside #1: Don't Let Computers
Computers are an easy excuse to not socialize, don't use it!
To meet someone is to like someone.
B981 3762 1D30 CA05 E2C1 CD7F 3C68 C8DB CBA783EF
What is the goal?
Outline
- 6502 -- NES
- M68k -- Sega Genesis
- Z80 -- Pacman
- 8051 -- Ruleta RE-900, coastermelt
- 6809 -- Robotron: 2084
- 8086 -- Boot sector
- Write a Program.
- Emulate it.
- Debug it.
- Disassemble it.
- Reverse it.
If you want a real game or a console, I recommend Pink Gorilla in the U-district or in the Intl-district. They have knowledgeable staff and excellent selection and prices.
Please download these tools and my paper in case you're playing a CTF and need to hack a ROM.
B981 3762 1D30 CA05 E2C1 CD7F 3C68 C8DB CBA783EF
B981 3762 1D30 CA05 E2C1 CD7F 3C68 C8DB CBA783EF
Systems that feature 6502 architecture:
- NES
- SNES
- TurboGrafx-16
- Apple II
- Atari 2600
- Atari 800
- Tamagotchi
- Commodore 64
- Too many arcade systems
- A lot of chips use this architecture and are not named 6502.
6502 Family Tree
6502
|
+------+--------+--+--+-------+-------+
| | | | | |
6510 deco16 6504 6509 n2a03 65c02
| |
+-----+-----+ r65c02
| | | |
6510t 7501 8502 +---+---+
| |
65ce02 65sc02
|
4510
https://wiki.nesdev.com/w/index.php/CPU_memory_map
B981 3762 1D30 CA05 E2C1 CD7F 3C68 C8DB CBA783EF
Common Pitfalls
- The program you write isn't exactly the assembly the compiler generates (compiler bugs).
- The compiler wasn't designed for the architecture you're compiling for (compiler bugs).
- The assembly you write isn't exactly the machine code the assembler generates (assembler bugs).
- The machine code the assembler generates isn't exactly the machine code the linker writes (linker bugs).
- The machine code the emulator executes isn't the same as the machine code that you give it (emulator bugs).
- The hardware the emulator is emulating isn't the same as the hardware that you are targeting (emulator bugs).
- System ROM might not be correct for all systems.
- Compiling someone else's code for a new architecture can be fraught!
- Endianness, Von Neumann, stack size, dependencies, colors, int size, floating point, speed, ROM
- Think you can compress your executable with gzip? Only if you have enough space in RAM and you can exec there!
- Yes, you can compress assets if you have enough program ROM.
- Ask me why I wrote these roms from scratch besides init.
http://docs.mamedev.org/techspecs/m6502.html
B981 3762 1D30 CA05 E2C1 CD7F 3C68 C8DB CBA783EF
CC65
CC65 is a C compiler and assembler targets multiple systems that use 6502 architecture. What is a C compiler? A simple C compiler needs to take any valid C program:
int main()
{
int i;
char buf[10];
for(i = 0; i < 10; ++i) {
buf[i] = i;
}
return 0;
}
and turn it into a valid assembly program for a certain architecture.
libc!
int i;
So that's step 1: Write a program.*
* Use volatile and learn what it does. Trust me.
B981 3762 1D30 CA05 E2C1 CD7F 3C68 C8DB CBA783EF
libc
- _start libc_start_main
- stdio.h: printf open read write printf
- unistd.h: memcpy memcmp
- stdlib.h: malloc free
- string.h: strcpy strncpy strcat strncat
- socket.h: socket bind htons ptoa itoa getaddrinfo
- ...
What would happen when you decide to turn off libc?
B981 3762 1D30 CA05 E2C1 CD7F 3C68 C8DB CBA783EF
Mednafen vs. MAME
Mednafen has a debugger and is nice.
MAME has a featureful debugger with file output and a scripting language (Lua).
MAME's scripting language made significant improvements in a recent version in regards to automated debugging.
Both Mednafen and MAME give you step 2 and 3.
- Emulate it.
- Debug it.
B981 3762 1D30 CA05 E2C1 CD7F 3C68 C8DB CBA783EF
Radare2
Radare2 supports a large set of non-x86 architectures. But Radare2 has bugs. It can help you reverse a lot, but only if it works.
There are bugs in many old versions.
r2 -e asm.arch=6502 file.nes
r2 -e asm=m68k file.md
r2 -e asm.arch=8051 ihex://harvard1.ihx
r2 -e asm=z80 file.bin
aaa
pdf
# write disassembly to a file
pd >harvard1.dis
# Visual mode
V
p
# Graph mode
V
# If it complains, define a function
df
# go to the top of anything
g
# go to the bottom of anything
G
# It's trying to be vim D=
B981 3762 1D30 CA05 E2C1 CD7F 3C68 C8DB CBA783EF
M68k aka M68000
- puts(const char *data) in 68k assembly
- music_init(void), play_note(uint16_t freq), stop_music(void) in C
- sleep(void), clearScreen(void), WaitVBlankStart(void), WaitVBlankEnd(void), btohex(char *dst, uint8_t src) in C
B981 3762 1D30 CA05 E2C1 CD7F 3C68 C8DB CBA783EF
M68k aka M68000
Systems that feature M68k architecture:
- Sega Genesis
- Atari Jaguar
- Apple Macintosh
- Neo Geo
- Amiga
- Atari ST
- TI-89
- SUN workstation
- Too many arcade systems
Examples of M68k in CTF:
B981 3762 1D30 CA05 E2C1 CD7F 3C68 C8DB CBA783EF
8051 aka Intel MCS-51
- Popular in arcade and embedded applications
- 8-bit
- Harvard
Systems that feature 8051 architecture:
B981 3762 1D30 CA05 E2C1 CD7F 3C68 C8DB CBA783EF
8051 aka Intel MCS-51
Fail quickly.
B981 3762 1D30 CA05 E2C1 CD7F 3C68 C8DB CBA783EF
- _start, sleep(int dt)
- no puts
- Shell script creates random palette
- Python script converts png with font to tile rom (same font as Genesis)
B981 3762 1D30 CA05 E2C1 CD7F 3C68 C8DB CBA783EF
Systems that feature Z80 architecture:
- Sega Genesis (sound coprocessor*)
- Sega Master System
- Sega *1000
- Pacman, Donkey Kong
- Too many arcade systems
Examples of Z80 in CTF:
Let's Disassemble from SECCON CTF 2014
B981 3762 1D30 CA05 E2C1 CD7F 3C68 C8DB CBA783EF
Writing a Pacman ROM in 10 hours:
Video RAM picks tiles. (1024 bytes)
Color RAM picks two palettes per tile. (1024 bytes)
Tile ROM is a weird packing of bits. (4096 bytes == 256 tiles)
Palette ROM is a list of colors. (32 bytes)
Program ROM is your code (4096 bytes * 4 == 16kB)
Sound ROM is where you put your music and sfx (?)
ASCII tiles is inefficient, but useful.
B981 3762 1D30 CA05 E2C1 CD7F 3C68 C8DB CBA783EF
Gameboy is a combination of Z80 and 8080, so it's a bit special. SDCC supports Gameboy, but I decided to skip this architecture for now.
Examples of Gameboy in CTF:
gameboy from Plaid CTF 2017
At Gunpoint from hack.lu 2014
B981 3762 1D30 CA05 E2C1 CD7F 3C68 C8DB CBA783EF
Systems that feature 6809 architecture:
- Williams Arcade
- Robotron
- TRS-80
So you want to implement a new architecture in MAME?
Examples of Robotron in CTF:
Church of Robotron at Toorcamp! http://churchofrobotron.com/
B981 3762 1D30 CA05 E2C1 CD7F 3C68 C8DB CBA783EF
Aside #2: Computers are Wonderful
Computers are able to do things you didn't expect.
https://exploitee.rs/
The State of the World
We have the opportunity to do things that I originally thought were fantasy. This will repeat, let us be clear, more times than you will wish. Don't let that be your excuse to not write code. Find something that benefits you or someone else and take a look from the perspective of: this is possible by means of effort.
/
