PAL Brute Forcing - Revision history

Mcmaster: /* DuPAL */

2022-05-21T05:39:47Z

DuPAL

← Older revision		Revision as of 05:39, 21 May 2022
Line 57:		Line 57:
	==DuPAL==		==DuPAL==
	https://github.com/DuPAL-PAL-DUmper		https://github.com/DuPAL-PAL-DUmper

			[[DuPAL\|Main page]]


Line 64:		Line 66:
	*As a stand alone solution, board is much more complex than readpal		*As a stand alone solution, board is much more complex than readpal
	*More powerful than others?		*More powerful than others?


	~~Pre-compiled: https://proghq.org/media/dupal/~~

	<br />		<br />

Mcmaster: /* DuPAL */

2022-05-20T06:13:54Z

DuPAL

← Older revision		Revision as of 06:13, 20 May 2022
Line 64:		Line 64:
	*As a stand alone solution, board is much more complex than readpal		*As a stand alone solution, board is much more complex than readpal
	*More powerful than others?		*More powerful than others?


			Pre-compiled: https://proghq.org/media/dupal/

	<br />		<br />

Mcmaster: /* ReGAL */

2021-04-11T03:43:08Z

ReGAL

← Older revision		Revision as of 03:43, 11 April 2021
Line 83:		Line 83:

	"Obviously, this method is limited to devices implementing combinational logic (PAL working in registered mode are out-of-scope for this proof-of-concept)."		"Obviously, this method is limited to devices implementing combinational logic (PAL working in registered mode are out-of-scope for this proof-of-concept)."

			"The current implementation uses an arduino mega to drive the device under test. The setup required to perform the IO probing on the example defined above can be described as follow:"

	==Test vectors==		==Test vectors==
	"For combinatorial stuff, I use my Unisite to apply all possible combinations of inputs via JEDEC test vectors and then record the output. I then do a bit of processing and use espresso to create equations for the table. For registered stuff, I usually capture traces from the device in-circuit with a logic analyzer and then use that as a basis to write test vectors"		"For combinatorial stuff, I use my Unisite to apply all possible combinations of inputs via JEDEC test vectors and then record the output. I then do a bit of processing and use espresso to create equations for the table. For registered stuff, I usually capture traces from the device in-circuit with a logic analyzer and then use that as a basis to write test vectors"

Mcmaster: /* ReGAL */

2021-04-11T03:42:23Z

ReGAL

← Older revision		Revision as of 03:42, 11 April 2021
Line 79:		Line 79:
	<br />		<br />

	== ReGAL ==		==ReGAL==
	https://github.com/psurply/ReGAL		https://github.com/psurply/ReGAL

	== Test vectors ==		"Obviously, this method is limited to devices implementing combinational logic (PAL working in registered mode are out-of-scope for this proof-of-concept)."

			==Test vectors==
	"For combinatorial stuff, I use my Unisite to apply all possible combinations of inputs via JEDEC test vectors and then record the output. I then do a bit of processing and use espresso to create equations for the table. For registered stuff, I usually capture traces from the device in-circuit with a logic analyzer and then use that as a basis to write test vectors"		"For combinatorial stuff, I use my Unisite to apply all possible combinations of inputs via JEDEC test vectors and then record the output. I then do a bit of processing and use espresso to create equations for the table. For registered stuff, I usually capture traces from the device in-circuit with a logic analyzer and then use that as a basis to write test vectors"

Mcmaster at 02:36, 11 April 2021

2021-04-11T02:36:22Z

← Older revision		Revision as of 02:36, 11 April 2021
Line 4:		Line 4:
	.jed		.jed

	* Industry standard fuse format		*Industry standard fuse format


	BP Microsystems .bin		BP Microsystems .bin

	* Presumably this is the JED fuses converted directly into a binary w/o metadata		*Presumably this is the JED fuses converted directly into a binary w/o metadata
	* Maybe like the MAME .bin w/o the small header?		*Maybe like the MAME .bin w/o the small header?


	MAME .bin		MAME .bin

	* Custom format with a very small amount of metadata		*Custom format with a very small amount of metadata
	* Can be converted to .jed etc using tools included in MAME		*Can be converted to .jed etc using tools included in MAME
	* TODO: add link		*TODO: add link


	"EPROM" .bin		"EPROM" .bin

	* Output from techno-junk 27C020 adapter		*Output from techno-junk 27C020 adapter


	.jl		.jl

	* Output from pal866		*Output from pal866

	<br />		<br />
Line 79:		Line 79:
	<br />		<br />

	==Test vectors==		== ReGAL ==
			https://github.com/psurply/ReGAL

			== Test vectors ==
	"For combinatorial stuff, I use my Unisite to apply all possible combinations of inputs via JEDEC test vectors and then record the output. I then do a bit of processing and use espresso to create equations for the table. For registered stuff, I usually capture traces from the device in-circuit with a logic analyzer and then use that as a basis to write test vectors"		"For combinatorial stuff, I use my Unisite to apply all possible combinations of inputs via JEDEC test vectors and then record the output. I then do a bit of processing and use espresso to create equations for the table. For registered stuff, I usually capture traces from the device in-circuit with a logic analyzer and then use that as a basis to write test vectors"

Mcmaster at 02:01, 7 April 2021

2021-04-07T02:01:11Z

← Older revision		Revision as of 02:01, 7 April 2021
Line 1:		Line 1:
	Page on analyzing PAL devices by supplying a large number of test vectors. This may be extendable to other devices like GALs, but this type of analysis typically works best on very simple devices.		Page on analyzing PAL devices by supplying a large number of test vectors. This may be extendable to other devices like GALs, but this type of analysis typically works best on very simple devices.

	== readpal ==		==Data formats==
			.jed

			* Industry standard fuse format


			BP Microsystems .bin

			* Presumably this is the JED fuses converted directly into a binary w/o metadata
			* Maybe like the MAME .bin w/o the small header?


			MAME .bin

			* Custom format with a very small amount of metadata
			* Can be converted to .jed etc using tools included in MAME
			* TODO: add link


			"EPROM" .bin

			* Output from techno-junk 27C020 adapter


			.jl

			* Output from pal866

			<br />
			==readpal==
	http://techno-junk.org/readpal.php		http://techno-junk.org/readpal.php

Line 7:		Line 36:
	Summary:		Summary:

	* An EPROM like adapter to enable brute forcing using COTS programmers		*An EPROM like adapter to enable brute forcing using COTS programmers
	* Fast since it uses standard algorithms		*Fast since it uses standard algorithms
	* Doesn't handle registers		*Doesn't handle registers
	* Reference post processing workflow		*Reference post processing workflow

	<br />		<br />
Line 20:		Line 49:
	<nowiki>http://techno-junk.org/readpal.php</nowiki>		<nowiki>http://techno-junk.org/readpal.php</nowiki>

	* <nowiki>https://github.com/pascalorama/paldumper</nowiki>		*<nowiki>https://github.com/pascalorama/paldumper</nowiki>
	* Eagle design files provided for EPROM adapter		*Eagle design files provided for EPROM adapter
	* Windows binary provided to analyze EPROM into equations		*Windows binary provided to analyze EPROM into equations

	<br />		<br />

	== DuPAL ==		==DuPAL==
	https://github.com/DuPAL-PAL-DUmper		https://github.com/DuPAL-PAL-DUmper

Line 32:		Line 61:
	Summary:		Summary:

	* Hardware + software toolchain for copying PAL devices		*Hardware + software toolchain for copying PAL devices
	* As a stand alone solution, board is much more complex than readpal		*As a stand alone solution, board is much more complex than readpal
	* More powerful than others?		*More powerful than others?

	<br />		<br />

	== pal866 ==		==pal866==
	https://github.com/JohnDMcMaster/pal866/		https://github.com/JohnDMcMaster/pal866/

Line 44:		Line 73:
	Summary		Summary

	* FOSS tl866 software to read out PAL16 family devices		*FOSS tl866 software to read out PAL16 family devices
	* Registered PAL WIP		*Registered PAL WIP
	* Doesn't require any adapters		*Doesn't require any adapters

	<br />		<br />

	== Test vectors ==		==Test vectors==
	"For combinatorial stuff, I use my Unisite to apply all possible combinations of inputs via JEDEC test vectors and then record the output. I then do a bit of processing and use espresso to create equations for the table. For registered stuff, I usually capture traces from the device in-circuit with a logic analyzer and then use that as a basis to write test vectors"		"For combinatorial stuff, I use my Unisite to apply all possible combinations of inputs via JEDEC test vectors and then record the output. I then do a bit of processing and use espresso to create equations for the table. For registered stuff, I usually capture traces from the device in-circuit with a logic analyzer and then use that as a basis to write test vectors"

Mcmaster at 22:59, 1 March 2021

2021-03-01T22:59:18Z

← Older revision		Revision as of 22:59, 1 March 2021
Line 46:		Line 46:
	* FOSS tl866 software to read out PAL16 family devices		* FOSS tl866 software to read out PAL16 family devices
	* Registered PAL WIP		* Registered PAL WIP
	* Doesn't require any adapters		* Doesn't require any adapters

			<br />

			== Test vectors ==
			"For combinatorial stuff, I use my Unisite to apply all possible combinations of inputs via JEDEC test vectors and then record the output. I then do a bit of processing and use espresso to create equations for the table. For registered stuff, I usually capture traces from the device in-circuit with a logic analyzer and then use that as a basis to write test vectors"

Mcmaster: Created page with "Page on analyzing PAL devices by supplying a large number of test vectors. This may be extendable to other devices like GALs, but this type of analysis typically works best on..."

2021-03-01T22:57:49Z

Created page with "Page on analyzing PAL devices by supplying a large number of test vectors. This may be extendable to other devices like GALs, but this type of analysis typically works best on..."

New page

Page on analyzing PAL devices by supplying a large number of test vectors. This may be extendable to other devices like GALs, but this type of analysis typically works best on very simple devices.

== readpal ==
http://techno-junk.org/readpal.php

Summary:

* An EPROM like adapter to enable brute forcing using COTS programmers
* Fast since it uses standard algorithms
* Doesn't handle registers
* Reference post processing workflow

<br />
This approach does not work for the following devices:
All registered PAL devices. (PAL16R4, PAL16R6, PAL16R8, etc.)
All GAL devices configured to be registered. (GAL16V8, etc.)
PEEL devices (18CV8, etc.) which have a different architecture than PALs/GALs.
Non-PAL or GAL devices (82S153, PLS153, etc.) which have a different architecture and pinout than PALs/GALs.
<nowiki>http://techno-junk.org/readpal.php</nowiki>

* <nowiki>https://github.com/pascalorama/paldumper</nowiki>
* Eagle design files provided for EPROM adapter
* Windows binary provided to analyze EPROM into equations

<br />

== DuPAL ==
https://github.com/DuPAL-PAL-DUmper

Summary:

* Hardware + software toolchain for copying PAL devices
* As a stand alone solution, board is much more complex than readpal
* More powerful than others?

<br />

== pal866 ==
https://github.com/JohnDMcMaster/pal866/

Summary

* FOSS tl866 software to read out PAL16 family devices
* Registered PAL WIP
* Doesn't require any adapters