Reverse-Engineering the Security Module in a Mastervoice Butler in a Box

No video

Reverse-Engineering the Security Module in a Mastervoice Butler in a Box

Рет қаралды 3,484

Күн бұрын

For as little time as I've had with the Butler, I'm amazed how much effort they put into making sure a discarded or stolen unit was unusable. A "PIN" is required to unlock the unit whenever it is powered on after a battery failure. That PIN is almost never written on the unit itself and probably hides in a black brick of potting compound found inside every unit. I've taken care of the de-potting process already. After some analysis, here is what I have discovered so far. I doubt Mastervoice cares about me digging into their product like this. At least, not 30 years later. :P
Remember to follow me on Twitter at @CelGenStudios to keep up to date on what I am doing and what might be happening in the next video.

Пікірлер: 46

@pplwizard1 5 ай бұрын

Hi, I'm Gus Searcy... The pin number is a mathematical calculation of the serial number. I knew I'd never be able to keep track of remember all the PIN numbers so that's why we made it a mathematical calculation of the serial number. Enjoyed watching you go through the security module. It worked quite well for us as a deterrent for many many people for many many years

@taylorroddin 5 ай бұрын

The man himself! I know it's probably daunting, having this sudden influx of attention over a 40 year old project, but I'm glad people are finally discovering about this lost piece of technology and just how awesome it's creator is. Mr. Searcy, if you'd be willing to, you could give us some more information over this invention, either as a video or writing an article (that Wikipedia page would be welcome), detailing the thought process, the prototyping, the challenges and the eventual final development of the Butler, not only this is a valuable piece of technological history, it's also so inspiring for young inventors who are discouraged from taking their ideas to the end. My best regards!

@CelGenStudios 5 ай бұрын

You did a very good job. Even to remove the module it certainly made it a mess to tamper with it. I'm still a bit amazed you went that far to implement anti-theft as to make you enter a code every time power is lost (I remember when GM used to do this with their vehicle radios) but indeed it has proven to be very effective. Just to set the record straight though my intent with this video was nowhere near intending to be malicious. I just wanted to get my box working and until very recently there was little to no interest in the Butler in a Box, so I thought why not at least start snooping around with a unit that was already broken in multiple ways. A few people since the Popular Science video have contacted me mentioning that you still had an ability to retrieve a lost PIN. Is there somewhere I can reach you more privately?

@unmanaged 4 ай бұрын

I just got two of these in the boxes both have handwritten notes that one has updated or newer firmware version any idea what the differences are?

@CelGenStudios 4 ай бұрын

@@unmanaged No idea myself.

@unmanaged 4 ай бұрын

@@CelGenStudios let me know if you want one and I'll send it to you

@s8wc3 Жыл бұрын

Hook up a logic analyzer (a $10 saleae clone will do) to the address bus and see where it accesses when you punch in the pin code. Should pretty much give it to you. If not at least watching the startup process will narrow it down

@JacGoudsmit 11 ай бұрын

New subscriber here; I have no idea what this device does but the video was interesting and perhaps I can help a bit. 16:40 All the address decoding hardware is on the main board, so the main board needs access to the !OE input of the 74HCT245 to connect the main board hardware on the data bus (and disable the PROM from the looks of it). The !OE pin is pulled high by the 2k2 pull-up resistor, and the address decoding logic on the main board pulls it low, probably from a 74*138 or similar open-collector/open-drain chip that are commonly used for address decoding. As you mention earlier in the video, there's a missing component that was probably a diode; maybe they were considering the possibility that the address decoder might not be open-collector (I think the 74*254 was a decoder with totem-pole outputs?) while they were developing the security module. They eventually realized they didn't need the diode so they left it out. As someone already said, the PROM is simply used to scramble the address lines to the EPROM. They could be using those I/O port C lines to help with the scrambling but I suspect that they don't and those lines are just to help with programming the PROM at production time. If anything, the 4 lines of port C that go to the 27S21 only possibly generate 16 possible combinations of bit patterns so even if it matters, you would only have to try 16 times to get it right. And the part of the software that asks for the pin code cannot depend on those I/O port lines to be set correctly so that part of the code must be in an area of the EPROM that always gets decoded the same regardless of what port C is set to. And that area is probably at the top of the memory map, because that's also where the 6502 needs to have the reset vector, interrupt vector and NMI vector which should be available right from the start. So even though you don't have hardware to read the 27S21, you could put both the PROM and the EPROM on a breadboard and connect them in basically the same way as they are connected in the module, and then use e.g. a 5 Volt Arduino to generate all the 8192 addresses that are relevant to read your particular EPROM through your matching PROM descrambler. The Arduino can read all the data from the EPROM and send it to the serial port, where you can capture it with a PC to a file, and you can analyze and hack that file. Then it's a matter of finding the code that asks for the PIN, and replace it with NOP or with a JMP instruction to skip it, or whatever. Then you can burn that image file to another 2764 EPROM and hack it into another device. It doesn't even matter where or how the PIN code is stored. On the device to be liberated, you would need to: * Cut the trace that enables the Security Module EPROM enable-input and pull the pin high or low, as appropriate, to deactivate the internal EPROM forever. * Put the hacked EPROM on the address and data bus (you might be able to piggy-back the hacked EPROM on top of an EPROM on the main board, I don't know), and use the signal from the trace that originally went to the module's EPROM enable pin, as the input to enable the hacked EPROM on the main board. * Cut the traces from the address decoding logic on the main board to the !OE and DIR inputs of the 74HCT245. * Put some logic on 74HCT245 DIR and !OE pins so that the original signals are put on there whenever the hacked EPROM is not enabled, but allow data through from the main board into the HCT245 when the enable-line of the hacked EPROM is active. I'll leave that as an exercise for the reader 🙂 There's a good chance that you can pull the 74HCT245 !OE line down permanently once the internal EPROM is permanently deactivated, and you can probably use R/!W (or a boosted and/or inverted version, as appropriate) to generate the DIR signal. I don't know anything about the main board so this would require some further study! If you kill your butler, don't blame me.

@EvilNando 4 ай бұрын

what a boss

@256byteram Жыл бұрын

By my guess, it looks like the security module was potted with a blank EPROM and PROM in it, which were programmed later (Vpp being exposed) with up-to-date firmware and the PIN. I recall bipolar PROMs being programmed with a high voltage on the /G1 or /G2 pins one bit at a time, which are also exposed to the outside world. The direction and enable pins on the '245 are available too, but someone attempting to pirate the system wouldn't know they're there without depotting the module. I suspect the '245 is to prevent code from appearing on the data bus externally from the module. The address and data busses would be known externally due to the external EPROMs, so if the '245 wasn't there it wouldn't take much to sniff out the data.

@startoftext 5 ай бұрын

As a software engineer I am really curious to know how voice recognition would have worked in the 80s. I know it was pretty crap but its still interesting its amazing for the time. Also I am amazed that no one has reversed one of these yet. Good luck and look forward to seeing what you find.

@pplwizard1 5 ай бұрын

Actually it worked pretty well we were even tested by the US Air Force and they were blown away by the results we even have a letter that documents it.

@zkteletronica 4 ай бұрын

The prom can be easily readed with a counter like 4040, 4060 (osc included) on the address bus conected to a logic analyzer, you will only need to save the data to a binary file. As @s8wc3 said, connect a 16 bit logic analyzer to the address bus of the eprom and the trigger of the logic analyzer to the front panel "enter" switch, with the eprom file readed you will only have to disassembly less than 50 bytes of code that can be easily done with ida or other tools. Some of this checks are done with conditional jump instructions and changing the jump type or the data that are being compared may unlock the check routine.

@markpitts5194 Жыл бұрын

My gut is saying you will need a few of them to compare and contrast. Good effort mate!

@TheBendixSA 5 ай бұрын

searcy commented on popular sciences new video on this and said the pin is derived via algo. from the serial number and said he could give a pin to anyone with a serial.

@kneesnap1041 5 ай бұрын

that's pretty awesome that he still has the algorithm, many people wouldn't have kept code, documentation, etc.

@CelGenStudios 5 ай бұрын

Yeah I was somewhat doubtful that a registry like that would of been kept around after Mastervoice shut down as well. Not to make it sound like I'm going to abandon this project (people can see what I've done so far for inspiration if they wish) but if Gus is willing to send you the PIN if you politely ask that basically makes what I'm intending here completely redundant. I will have to reach out to him and explain my situation. Thank you! @@kneesnap1041

@TheBendixSA 5 ай бұрын

@@CelGenStudios Well I doubt he will give up the algo so if you can get the pin from him maybe change gears to figuring out the algo if you have both the serial and pin, can get a second known pin and serial from popsci and then the challenge could be to get figure out the algo for posterity.

@CelGenStudios 5 ай бұрын

I'd be more curious to just know the PIN, then you should see it hiding in the ROM in theory.@@TheBendixSA

@frankhenigman5117 3 ай бұрын

Great use of gimp. Gives me the idea that one could label pads/vias on the image, trace the traces as you've done, then a netlist could be generated automatically. Then a schematic could be generated for one's favorite EDA tool, followed of course a new PCB if desired. I dunno much about gimp, if it has the features to do this, or allows writing plugins that could do it. If not then a stand-alone application (vastly simpler and easier than gimp) might be called for. Would be wonderful to be able to just click anywhere on a trace and have the whole trace light up, then just do manual fixing/tracing as needed.

@JesseJ-ri7ll 2 ай бұрын

Amazing sir. So much work .

@deathshaker0026 Жыл бұрын

Gimp for the win! REV4 9-85.. Iv'e always wanted to play with 6502. It's clever how they made it modular like this. I almost get an image of Atari system. I wonder if you could hook it up to a computer?? I love how you went all BigClive on reverse engineer and then some.

@unmanaged 4 ай бұрын

CelGen I have two of these in the box with the serial numbers and all the paperwork ...

@KallePihlajasaari Жыл бұрын

The EPROM has no security bit to worry about. The PROM can also be read out fully even if there was a write protect bit on it. You could source a replacement CPU and just clip the legs from the old one to pull it out of circuit if there was any mystery tracks under the CPU that needed inspection. Nice job depotting, what solvent did you use? You might be able to just manually read the PROM data on your programmer display, there are only 256 nibbles after all. The PROM may be just for address decoding as you surmised.

@KallePihlajasaari Жыл бұрын

With a little thought it may be possible to connect to most of/all the required programming pins using connections on socketed ICs on the main board. It would be optimal if you could read out the data by using a harness that would just plug in. A thought did occur to me that even if the PIN was stored as a hash it might be possible to overwrite it with ZERO bits once you locate the location and then you only have to calculate/brute-force the PIN for a NULL hash once and the pin can be reset with a quick write of the specific BYTES in the EPROM.

@CelGenStudios Жыл бұрын

For a solvent I used acetone in a ventilated environment along with a suitable brush, but the resin also comes off quite easily with hot air and a sharp knife.

@CelGenStudios Жыл бұрын

@@KallePihlajasaari The thought did come across to me as well, plus getting direct hardware access lets me verify if read back was possible without having to dig into other modules by using a jig instead. That was one of the optional goals as it also them lets you crack the PIN on other units with a lot less effort.

@KallePihlajasaari Жыл бұрын

@@CelGenStudios There are some very interesting and effective solvents to be found in paint strippers still in the USA. Some of the good ones are 'banned' in the EU so we have tame paint strippers. Depotting some materials is a real challenge yours seems to have been less tenacious. I suppose I will have to go and see what these things were used for and why a PIN is even desireable. :-)

@50shadesofbeige88 Жыл бұрын

Very interesting sir.

@cocusar Жыл бұрын

I bet the tri state is just the way this module talks to the exterior world, and yes, it's probably the way they program the eprom. I bet the juicy part is the rom, which is not accesible from the outside

@deathrobloxian 5 ай бұрын

Oh yeah on the PopSci video that mentioned you Gus Searcy commented a day ago, and says in the replies can contact him to get pin based off serial number

@CelGenStudios 5 ай бұрын

Yeah I was catching up on messages and someone pointed me at that. I see Gus's own KZfaq channel has a website you can link to with an email but I'm not positive yet if that's where he wants you to email him.

@brendanvogele2531 4 ай бұрын

Hey, great video! I was wondering what solvent you used to clean up all of that resin? looking st depotting some konami "ic's" (not really ic chips) and would love to know what you used.

@CelGenStudios 4 ай бұрын

Acetone and a well-ventilated space.

@infinitecanadian Жыл бұрын

Don't worry if you are a talking head. You have a nice head.

@biologicalhazard552 3 ай бұрын

Post the dump from both PROMS and i'm sure someone will help RE the code. A TNM5000 or TNM7000 programmer should work. I guess it is anyway obvious that one of them stores the the voice data while the other one holds the code.