How to read code from P87C750?

[Gary Walters]

Obsolete data controller from defunct company uses this Philips ucontroller.
Units are failing and customer has the option of either throwing out all his
infrastructure when these units fail and spending $$$$ to replace everything,
or burning new controller ICs as units fail.

<http://www.datasheetcatalog.org/datasheet/philips/P87C750EBPN.pdf>

It looks like the P87C750 comes with a 16-byte encryption table, optionally
used to encrypt the contents of program memory.

The only way, it seems, to know if the memory contents has been encrypted is
to read the contents and see if it contains legible code.

Is there another means to know if the memory contents have been encrypted?

Thanks.

 

[hamilton]

Obsolete data controller from defunct company uses this Philips ucontroller.
Units are failing and customer has the option of either throwing out all his
infrastructure when these units fail and spending $$$$ to replace everything,
or burning new controller ICs as units fail.

<http://www.datasheetcatalog.org/datasheet/philips/P87C750EBPN.pdf>

It looks like the P87C750 comes with a 16-byte encryption table, optionally
used to encrypt the contents of program memory.

The only way, it seems, to know if the memory contents has been encrypted is
to read the contents and see if it contains legible code.

Is there another means to know if the memory contents have been encrypted?

Thanks.

1K of code space is not much.

A logic analyzer and a few hours with a working unit and you will have
replacement code ready to go.

How many of these units are we talking about ?

2-3 units a month, 2-3 units a year ??

As the company is now gone, what other type of products are in that
market place ?

In this day and age, building a replacement is easier than fooling with
encryption.

My $.02

hamilton

 

[Gary Walters]

ADVANTAGES of the 8051 architecture???!!!

I hope that's not the sound of The Segue I hear...

 

[Spehro Pefhany]

"The Philips 8XC750 offers the advantages of the 80C51
architecture..."

ADVANTAGES of the 8051 architecture???!!!

Well, it sure beat the heck out of the preceding MCS-48 architecture!

 

[hamilton]

On 12/14/2012 2:18 PM, Gary Walters wrote:

How can I email you directly ?

hamilton

 

[Spehro Pefhany]

What was really the worst uP architecture? That RCA 17xx thing?

The early PICs were about unusable for anything complex (ugly paging
and no interrupts) and I wasted a bit of time trying. I never used the
RCA thing. Maybe some of the 4-bit ones- they were pretty starved of
gates.


Best regards,
Spehro Pefhany

 

[[email protected]]

What was really the worst uP architecture? That RCA 17xx thing?

The 68000. Too boring. ;-)

 

[hamilton]

What was really the worst uP architecture? That RCA 17xx thing?

Think it was this one: RCA CDP1802

http://en.wikipedia.org/wiki/RCA_1802

The Galileo spacecraft used multiple 1802 microprocessors.

http://en.wikipedia.org/wiki/Galileo_(spacecraft)

The spacecraft was controlled by six RCA 1802 COSMAC microprocessor
CPUs: four on the spun side and two on the despun side.

spun/despun ????


hamilton

 

[Spehro Pefhany]

The RCA 1802 was the champ for rad-hard applications such as spacecraft,
for a long long time.

Cheers

Phil Hobbs

IIRC, they had a Silicon-on-Saphire version for rad-hard applications.


Best regards,
Spehro Pefhany

 

[[email protected]]

The RCA 1802 was the champ for rad-hard applications such as spacecraft,
for a long long time.

CMOS static cells. Really big CMOS static cells.

 

[[email protected]]

Think it was this one: RCA CDP1802

http://en.wikipedia.org/wiki/RCA_1802

The Galileo spacecraft used multiple 1802 microprocessors.

http://en.wikipedia.org/wiki/Galileo_(spacecraft)

The spacecraft was controlled by six RCA 1802 COSMAC microprocessor
CPUs: four on the spun side and two on the despun side.

spun/despun ????

Part of the spacecraft was spin stabilized, the other not (antennas
and cameras hate that).

Spacecraft

"The spacecraft was constructed in three segments, which help
focus on these areas: the atmospheric probe; a non-spinning
section of the orbiter carrying cameras and other remote sensors;
and the spinning main section of the orbiter spacecraft which
includes the fields and particles instruments, designed to sense
and measure the environment directly as the spacecraft flies
through it. The spinning section also carries the main
communications antenna, the propulsion module, flight computers
and most support systems.

http://www.solarviews.com/eng/galfs.htm

 

[Martin Riddle]

The RCA 1802 was the champ for rad-hard applications such as
spacecraft, for a long long time.

Cheers

Phil Hobbs

--

I still have the 1802 processor manual from my old cosmac Elf.


Cheers

 

[Nico Coesel]

Think it was this one: RCA CDP1802

http://en.wikipedia.org/wiki/RCA_1802

The Galileo spacecraft used multiple 1802 microprocessors.

http://en.wikipedia.org/wiki/Galileo_(spacecraft)

The spacecraft was controlled by six RCA 1802 COSMAC microprocessor

Ahhh. Good memories. I had a book about how to build a COSMICOS
home-brew computer (a PCB with among other electronics a hex-keypad
and some 7 segment displays) around a 1802. Never build the thing but
I read the book several times just to learn about designing stuff
around microprocessors.

 

[Jasen Betts]

Hey, I love the 68K. Its assembly language is practically a
higher-level language. The architecture is beautifully symmetric, sort
of a 32-bit PDP-11.

It's big-endian and does a move from source to destination (unlike
certain popular, barbaric architectures I could name.)

Operand order is a function of the assembler, not the architecture.
Eg: if I use "gas" I get the order you, and "AT&T" prefer if I use
"nasm" I get the order intel prefers. endianness OTOH is dictated by
the hardware.

 

[[email protected]]

Hey, I love the 68K.

Precisely. ;-)

Its assembly language is practically a
higher-level language. The architecture is beautifully symmetric, sort
of a 32-bit PDP-11.

Too boring.

It's big-endian and does a move from source to destination (unlike
certain popular, barbaric architectures I could name.)

Um, name be one thing (in this universe) that moves from its
destination to source.

 

[Oppie]

Let me see if my Needhams EMP30 supports this chip. Worth a shot to see if
the program is secured or not. Some manufacturers set the
security/encryption bit(s) so you can't read it out while others leave it
readable.
I used something similar from Dallas/Maxim (now discontinued)
http://www.keil.com/dd/docs/datashts/philips/8xc750_ds.pdf

 

[[email protected]]

Intel!

Nonsense. I bet you think all programming languages were invented by
Intel, then. The "destination" variable is almost always on the left.

 

[petrus bitbyter]

Obsolete data controller from defunct company uses this Philips
ucontroller.
Units are failing and customer has the option of either throwing out all
his
infrastructure when these units fail and spending $$$$ to replace
everything,
or burning new controller ICs as units fail.

<http://www.datasheetcatalog.org/datasheet/philips/P87C750EBPN.pdf>

It looks like the P87C750 comes with a 16-byte encryption table,
optionally
used to encrypt the contents of program memory.

The only way, it seems, to know if the memory contents has been encrypted
is
to read the contents and see if it contains legible code.

Is there another means to know if the memory contents have been encrypted?

Thanks.

There's no use for encryption when the security bits are not set. If they
are set, you'd not be able to read the device anyway. So read the device if
you can, get (or write) an appropriate disassembler and you'll see whether
or not the code makes sense.

petrus bitbyter

 

[hamilton]

There's no use for encryption when the security bits are not set. If they
are set, you'd not be able to read the device anyway. So read the device if
you can, get (or write) an appropriate disassembler and you'll see whether
or not the code makes sense.

petrus bitbyter

They possibly put in some copyright text into the original source file.

If you can read the chip, if its not all 0xFF 0r 0x00, look for any
ASCII text.

hamilton

 

[petrus bitbyter]

They possibly put in some copyright text into the original source file.

If you can read the chip, if its not all 0xFF 0r 0x00, look for any ASCII
text.

hamilton

Sure, standard procedure - at least my standardprocedure - for examining
unknown .HEX files starts making a hex-dump with ASCII translation. ASCII
strings are often interesting but even if they're not they can be skipped
while disassembling.

petrus bitbyter