Emu now on final straight.

[nozzer]

What is the difference between the ROM and EMU? How do they deal with the incorrect byte of the key?

The Emulator is the thing that creates an environment that looks like the hardware of a Nagra card. Within that environment the code from the Rom is run, along with any code from Emm's etc.

The present problem is down the the emulator not fully copying the cards hardware functions. Kudelski (the creators of Nagra) have exploited this weakness in the emulator by creating an Emm that attempts to manipulate a hardware control register in a particular way that a real card wouldn't allow.

In order to fix the problem the emulator needs to be fixed so that the hardware emulation of this particular register is more consistant with what happens on a real card.

An alternative fix, which isn't really a fix (its more of a kludge) is to patch the ROM code in such a way that whenever an Emm is delivered to the emulator the patch gains control, examines the Emm, determines if its a keyroll and, if it is, then patches that keyroll to make the problem code go away. The emulator will no longer see the bad hardware manipulation.

In essance the, the patch changes a keyroll like so -

You don't have permission to view the code content. Log in or register now.

The loads from register 2 are replaced by constant value loads (obviously loading the correct values that would be expected from Register2 on a real card).

 

[gr0wl]

A simpler patch is just to patch

0084: A4 10 and #$10

and

0092: A4 18 and #$18

To

0084: A6 10 lda #$10

and

0092: A6 18 lda #$18

That way the correct values are loaded for xor'ing parts of the key with. Not only is it a smaller patch, but iirc you mentioned something about the linux emulators not liking the bit clear opcodes all that much in another thread (i.e. you can't set bit 0 of $02 to 0?), so it's necessary for the correct xor values to be calculated (and this is indeed what's done in the current patches for the roms used with evocamd etc.).

That said, if the values they pulled out of $02 and manipulated didn't turn out to be $10 and $18 anyway then a patch like yours would be entirely necessary, I think (as well as nop'ing out the bit clear).

 

[k-net2020]

The Emulator is the thing that creates an environment that looks like the hardware of a Nagra card. Within that environment the code from the Rom is run, along with any code from Emm's etc.

The present problem is down the the emulator not fully copying the cards hardware functions. Kudelski (the creators of Nagra) have exploited this weakness in the emulator by creating an Emm that attempts to manipulate a hardware control register in a particular way that a real card wouldn't allow.

In order to fix the problem the emulator needs to be fixed so that the hardware emulation of this particular register is more consistant with what happens on a real card.

An alternative fix, which isn't really a fix (its more of a kludge) is to patch the ROM code in such a way that whenever an Emm is delivered to the emulator the patch gains control, examines the Emm, determines if its a keyroll and, if it is, then patches that keyroll to make the problem code go away. The emulator will no longer see the bad hardware manipulation.

A simpler patch is just to patch

0084: A4 10 and #$10

and

0092: A4 18 and #$18

To

0084: A6 10 lda #$10

and

0092: A6 18 lda #$18

That way the correct values are loaded for xor'ing parts of the key with. Not only is it a smaller patch, but iirc you mentioned something about the linux emulators not liking the bit clear opcodes all that much in another thread (i.e. you can't set bit 0 of $02 to 0?), so it's necessary for the correct xor values to be calculated (and this is indeed what's done in the current patches for the roms used with evocamd etc.).

That said, if the values they pulled out of $02 and manipulated didn't turn out to be $10 and $18 anyway then a patch like yours would be entirely necessary, I think (as well as nop'ing out the bit clear).

God you sure know your stuff :Clap: :Clap: :Clap:

 

[Trapex]

A simpler patch is just to patch

0084: A4 10 and #$10

and

0092: A4 18 and #$18

To

0084: A6 10 lda #$10

and

0092: A6 18 lda #$18

That way the correct values are loaded for xor'ing parts of the key with. Not only is it a smaller patch, but iirc you mentioned something about the linux emulators not liking the bit clear opcodes all that much in another thread (i.e. you can't set bit 0 of $02 to 0?), so it's necessary for the correct xor values to be calculated (and this is indeed what's done in the current patches for the roms used with evocamd etc.).

That said, if the values they pulled out of $02 and manipulated didn't turn out to be $10 and $18 anyway then a patch like yours would be entirely necessary, I think (as well as nop'ing out the bit clear).

Ex-Squeeze me?...Baking powder?!!!