Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reverse engineering a forgotten 1970s Intel dual core beast: 8271, a new ISA

scarybeastsecurity.blogspot.com

Post reply on HN
Print view View original

21–30 of 40 posts

Re: Reverse engineering a forgotten 1970s Intel dual core beast: 8271, a new ISA

#21

Post by pvg »

rbanffy wrote: post #6
ajross wrote: post #2

I love these die shot RE walkthroughs. This is such a weird choice though; almost no one used this chip for production hardware. The WD 17xx series was the king of floppy controllers in the 70's and early 80's (well, if you ignore Woz's masterpiece, which was discrete logic). Seems like if you're going to reverse an obscure chip, something with a more exotic application would have been more fun?

> Woz's masterpiece, which was discrete logic It had the downside of requiring precise timing. This is an issue if you wanted a faster (or even a slightly improved) 6502 in the machine. Oh well...

This made me realize that Zip chips were a lot more complicated than kid-me thought:

https://en.wikipedia.org/wiki/Apple_II_accelerators#Zip_Chip...

Re: Reverse engineering a forgotten 1970s Intel dual core beast: 8271, a new ISA

#22

Post by segfaultbuserr »

userbinator wrote: post #16

A lot of special-purpose ICs are actually general-purpose processors with a mask ROM (or sometimes EEPROM, with interesting consequences), since writing the "firmware" for different functionality is easier than doing a whole "hard-coded" chip design --- the various USB-to-X adapters are one common example of this.

A few days ago, I brought an USB-to-serial chip made by an obscure manufacturer. I found the RX/TX ports were working but control signals were not, I poked around the chip with an oscilloscope and found those pins were high-impedance, the chip didn't even attempt to output anything. I contacted tech support. They told me to buy a new one because my chip was an old batch without this feature (I guess it's a bug), but they can also provide a firmware update to me under NDA.

It's microcontroller all the way down.

Fun fact: It's also how those fake FTDI FT232 chips on the gray market were made. Counterfeiters just picked a cheap general-purpose microcontroller in mass production and wrote a Mask ROM for it. What's funny is that, the counterfeit chips actually have better process node than the real one (it doesn't mean it's better, though).

https://zeptobars.com/en/read/FTDI-FT232RL-real-vs-fake-supe...

Re: Reverse engineering a forgotten 1970s Intel dual core beast: 8271, a new ISA

#23

Post by krallja »

intricatedetail wrote: post #14

Is there a tech available currently to decap and photo chips at home? For example reverse engineering old PAL chips?

Scanning just uses a microscope and open source panorama stitching software: http://www.righto.com/2015/12/creating-high-resolution-integ...

Home decapping is possible, from what I can tell, but uses methods like “fuming nitric acid” and “blowtorch”, neither of which I would really want to experiment with right now.

resilicon.reddit.com is becoming fairly active, if you have an interest.

Re: Reverse engineering a forgotten 1970s Intel dual core beast: 8271, a new ISA

#24

Post by marcan_42 »

segfaultbuserr wrote: post #22
userbinator wrote: post #16

A lot of special-purpose ICs are actually general-purpose processors with a mask ROM (or sometimes EEPROM, with interesting consequences), since writing the "firmware" for different functionality is easier than doing a whole "hard-coded" chip design --- the various USB-to-X adapters are one common example of this.

A few days ago, I brought an USB-to-serial chip made by an obscure manufacturer. I found the RX/TX ports were working but control signals were not, I poked around the chip with an oscilloscope and found those pins were high-impedance, the chip didn't even attempt to output anything. I contacted tech support. They told me to buy a new one because my chip was an old batch without this feature (I guess it's a bug), but…

They are better though: the clones fixed bugs that the original FTDIs had (bugs bad enough to make certain modes completely useless).

https://twitter.com/marcan42/status/695292366639378433?s=19

Don't buy FTDI chips; their malicious driver incident that bricked clones (by exploiting another bug in the EEPROM write support in their own chips!) should be enough to convince every board designer to stay away from them.

Re: Reverse engineering a forgotten 1970s Intel dual core beast: 8271, a new ISA

#25

Post by kens »

intricatedetail wrote: post #14

Is there a tech available currently to decap and photo chips at home? For example reverse engineering old PAL chips?

These chip come in a ceramic package, so decapping is a simple matter of tapping along the seam with a chisel. If you want high-quality die photos, you'll need a metallurgical microscope, which shines the light down through the lens. I got my microscope on eBay. Once you have a bunch of die photos, you can stitch them together with a program such as Hugin.

Re: Reverse engineering a forgotten 1970s Intel dual core beast: 8271, a new ISA

#26

Post by segfaultbuserr »

marcan_42 wrote: post #24
segfaultbuserr wrote: post #22

Earlier quoted context omitted.

A few days ago, I brought an USB-to-serial chip made by an obscure manufacturer. I found the RX/TX ports were working but control signals were not, I poked around the chip with an oscilloscope and found those pins were high-impedance, the chip didn't even attempt to output anything. I contacted tech support. They told me to buy a new one because my chip was an old batch without this feature (I guess it's a bug), but…

They are better though: the clones fixed bugs that the original FTDIs had (bugs bad enough to make certain modes completely useless). https://twitter.com/marcan42/status/695292366639378433?s=19 Don't buy FTDI chips; their malicious driver incident that bricked clones (by exploiting another bug in the EEPROM write support in their own chips!) should be enough to convince every board designer to stay away from them.

The clone chips are not better, they could've fixed some bugs in the original chip but they may have their own bugs. While there may be some good clones, there's no way to confirm the chip you got is good. Better to avoid FTDI, real or fake, altogether. For the record, I never used or purchased any FTDI chips since that driver incident, the chip I mentioned was not a FTDI chip.

Re: Reverse engineering a forgotten 1970s Intel dual core beast: 8271, a new ISA

#27

Post by nradov »

rbanffy wrote: post #6
ajross wrote: post #2

I love these die shot RE walkthroughs. This is such a weird choice though; almost no one used this chip for production hardware. The WD 17xx series was the king of floppy controllers in the 70's and early 80's (well, if you ignore Woz's masterpiece, which was discrete logic). Seems like if you're going to reverse an obscure chip, something with a more exotic application would have been more fun?

> Woz's masterpiece, which was discrete logic It had the downside of requiring precise timing. This is an issue if you wanted a faster (or even a slightly improved) 6502 in the machine. Oh well...

Back then no one really expected microcomputer hardware architectures to have a long lifespan or allow for incremental CPU upgrades every year.

Re: Reverse engineering a forgotten 1970s Intel dual core beast: 8271, a new ISA

#28

Post by Marazan »

Jeema101 wrote: post #15
__d wrote: post #10

The decision to use this chip (vs the WD) in the BBC Micro made me wonder if there were other obvious-in-hindsight bad/weird/hackish choices in classic computer design? The PC-AT's use of the keyboard controller to control A20 and CPU reset comes to mind. Any others?

Several video game consoles from back in the day (the Magnavox Odyssey 2 and Entex Adventurevision) used the MCS-48 microcontroller mentioned in this write up instead of more conventional CPUs of the time like the 6502 or Z80, which seems a bit strange. Having dabbled in both MCS-48 and 6502 assembly I can tell you it was probably not done to make software development easier. :) I suspect maybe the hardware was just…

Both the 6502 and Z80 were designed/imagined for use in embedded systems, not the general purpose computers they became famous in.

Re: Reverse engineering a forgotten 1970s Intel dual core beast: 8271, a new ISA

#29

Post by tonyedgecombe »

ChickeNES wrote: post #20
jandrese wrote: post #19

Earlier quoted context omitted.

The Commodore 64's disk drive was more powerful than the CPU, containing the same 6502 as well as a pair of 6522s. Amusingly some programs would upload mathematical calculations to the disk drives to speed up processing. https://www.lemon64.com/forum/viewtopic.php?t=27911

Same thing with early laser printers. The original Apple Laserwriter had a faster clocked 68000 compared to the original 128k/512k Mac

But then it did have to run PostScript which was very slow on those early devices.

Re: Reverse engineering a forgotten 1970s Intel dual core beast: 8271, a new ISA

#30

Post by linker3000 »

segfaultbuserr wrote: post #22
userbinator wrote: post #16

A lot of special-purpose ICs are actually general-purpose processors with a mask ROM (or sometimes EEPROM, with interesting consequences), since writing the "firmware" for different functionality is easier than doing a whole "hard-coded" chip design --- the various USB-to-X adapters are one common example of this.

A few days ago, I brought an USB-to-serial chip made by an obscure manufacturer. I found the RX/TX ports were working but control signals were not, I poked around the chip with an oscilloscope and found those pins were high-impedance, the chip didn't even attempt to output anything. I contacted tech support. They told me to buy a new one because my chip was an old batch without this feature (I guess it's a bug), but…

It's the same situation with USB Bluetooth dongles - many purport to be based on a Cambridge Silicon Radio (CSR - now owned by Qualcomm) chip, but are in fact using one of several cheap alternatives.

Many of these clones have their own quirks, and the amount of work-arounding that's been added to the Linux drivers is quite notable. Kernel 8.5 onwards seems to incorporate most of the fixes, but along the way, patches like this were available:

https://gist.github.com/nevack/6b36b82d715dc025163d9e9124840...

Despite the fantastic efforts of the driver maintainers, I still managed to find a "CSR 4" cheap dongle that threw all sorts of errors in the logs and didn't work. I'm waiting for some Broadcomm chip-based replacements to arrive.

Post reply on HN