This is an archived, read-only copy of the United-TI subforum , including posts and topic from May 2003 to April 2012. If you would like to discuss any of the topics in this forum, you can visit Cemetech's General Open Topic subforum. Some of these topics may also be directly-linked to active Cemetech topics. If you are a Cemetech member with a linked United-TI account, you can link United-TI topics here with your current Cemetech topics.

This forum is locked: you cannot post, reply to, or edit topics. Open Topic & United-TI Talk => General Open Topic
Author Message
brandonw


Advanced Member


Joined: 12 Jan 2007
Posts: 455

Posted: 31 Jul 2009 03:05:06 pm    Post subject:

Simply amazing.

Considering the 84+/SE boot code bug with key 0004 (it worked for me on my 84+SE because it has Free83P, with the 0004 key embedded in the certificate), the next most important key would be 000A, to make this discovery as significant as it should be.

And then 0102.
And then 0002.
And then 010A.
Back to top
Michael


Newbie


Joined: 21 Dec 2007
Posts: 39

Posted: 31 Jul 2009 03:09:25 pm    Post subject:

I wish my desktop wasn't seven years old or else I'd start on one of them...

Benjamin, are you still going to do 0102 next or 000A?


Last edited by Guest on 31 Jul 2009 03:11:12 pm; edited 1 time in total
Back to top
FloppusMaximus


Advanced Member


Joined: 22 Aug 2008
Posts: 472

Posted: 31 Jul 2009 03:12:03 pm    Post subject:

010A... I don't see that one being terribly useful. Now, 0101 and 0103, on the other hand...

Edit: I agree, 0A sounds enticing. At the same time, thanks to Brandon, it's not so urgently needed anymore. Smile And to be honest, as much fun as it is to write an OS, I feel like the ability to sign apps is more potentially useful to the community.


Last edited by Guest on 31 Jul 2009 03:15:56 pm; edited 1 time in total
Back to top
IAmACalculator
In a state of quasi-hiatus


Know-It-All


Joined: 21 Oct 2005
Posts: 1571

Posted: 31 Jul 2009 03:20:26 pm    Post subject:

Two quick questions:

  1. How many keys are there?
  2. Would a distributed computing setup be out of the question? Because even 10 computers of equal speed to Flop's could theoretically break a key in a week (assuming it takes a 10th of the time). It'd probably be more like a month, as there'd be some downtime from regular use, but it'd still be a significant time difference.
I think this is the most active UTI's been in months, maybe years...

EDIT'd for parenthetical discombobulation.

EDIT2:Not to mention that the people viewing this topic haven't been sighted since...I don't know when. Amazing.


Last edited by Guest on 31 Jul 2009 03:42:54 pm; edited 1 time in total
Back to top
Graphmastur


Advanced Member


Joined: 25 Mar 2009
Posts: 360

Posted: 31 Jul 2009 03:21:41 pm    Post subject:

There is like 10 users viewing this topic. Anyway, what is the process for signing an os?
Back to top
FloppusMaximus


Advanced Member


Joined: 22 Aug 2008
Posts: 472

Posted: 31 Jul 2009 03:33:56 pm    Post subject:

There are 12 more keys, I think, that are potentially of interest to third-party developers: 01, 02, 03, 08, 09, 0A, 0101, 0102, 0103, 0108, 0109, 010A. (The "0x" keys are for OS signing, the "010x" keys for app signing. 1 = TI-92+, 2 = TI-73, 3 = TI-89, 4 = TI-83+, 8 = V200, 9 = Titanium, A = TI-84+.)

Edit: I'm not actually sure that there are 0108 and 0109 keys; can anyone confirm or deny this? Anyway, the 0108, 0109 and 010A keys are obviously less useful than the 0101, 0103 and 0104 keys.

The first two phases of factoring -- polynomial selection and sieving -- can be done in a distributed manner; it does require moving a few gigabytes of data from one place to another. The final processing needs to be done on a single PC or a tightly networked cluster.

You can sign OSes using RabbitSign; the exact process will depend on what assembler you're using, but basically you just need to generate a multi-page Intel Hex file. If you're using TASM, a process similar to what I used for PongOS will do the trick. ZMASM and tpasm can both generate multi-page hex directly. Brandon also has an OS signing tool; I don't know the details of how it works.


Last edited by Guest on 31 Jul 2009 03:35:32 pm; edited 1 time in total
Back to top
brandonw


Advanced Member


Joined: 12 Jan 2007
Posts: 455

Posted: 31 Jul 2009 03:46:19 pm    Post subject:

I'm afraid I have to take issue with going with 0102 first. Now that it's public knowledge that we can generate these keys, we need to complete a "group" of keys, which right now is the 83+ series OS signing keys, so I think 000A is more important.

I'm not sure if it's public knowledge, but I wrote something called Free73 which basically adds the 0104 key to the 73 certificate, and so you can sign applications with the 83+ key and send them, and a Flash application called Tortoise which is basically a wrapper of Mallard to run programs/games. We can write 73 Flash applications; we can't easily give 84+/SE users a third-party OS without extra programs, and I think that's critical.

Despite having released Free83P, screwing around with the certificate isn't the smartest idea in the world, which I've proven by bricking 4 84+/SEs in the process of developing it. If we have to rely on messing with the certificate to get what we want, I'd rather be doing it on the less-used 73 than the 83+ series.
Back to top
DigiTan
Unregistered HyperCam 2


Super Elite (Last Title)


Joined: 10 Nov 2003
Posts: 4468

Posted: 31 Jul 2009 03:58:05 pm    Post subject:

So in the beginning...what kind of information did you need to put together to get this started?
Back to top
Graphmastur


Advanced Member


Joined: 25 Mar 2009
Posts: 360

Posted: 31 Jul 2009 04:02:05 pm    Post subject:

FloppusMaximus wrote:
The first two phases of factoring -- polynomial selection and sieving -- can be done in a distributed manner; it does require moving a few gigabytes of data from one place to another. The final processing needs to be done on a single PC or a tightly networked cluster.

Hey, how much memory do you have?
FloppusMaximus wrote:
You can sign OSes using RabbitSign; the exact process will depend on what assembler you're using, but basically you just need to generate a multi-page Intel Hex file. If you're using TASM, a process similar to what I used for PongOS will do the trick. ZMASM and tpasm can both generate multi-page hex directly. Brandon also has an OS signing tool; I don't know the details of how it works.

Say I used TASM. What is the process? This is very interesting. And, I agree with brandonw. Considering he had 4 calculators to brick, and he bricked all of them, and required a hack to do with overflowing the stack, and executing your own code from another calculator, which I don't have, I think the 0A key should be next. Also, I will look at the wikipedia article on RSA, but where do you find these keys?
Back to top
FloppusMaximus


Advanced Member


Joined: 22 Aug 2008
Posts: 472

Posted: 31 Jul 2009 04:25:49 pm    Post subject:

Graphmastur: I've got 4 GB of RAM. You don't need to load the whole sieving database into memory -- the database contains a fair number of duplicated relations, and the filtering phase throws away "singletons" (if an ideal is only used by one relation, that relation can't contribute to the final result.) As I said above, the complete database was 51 million relations, but only about 10 million were used in the final factorization.

For writing PongOS, I basically assembled the two pages separately. In the code for page 1C, I used the TASM .export directive to generate an include file containing the useful addresses; I then #included that export file in page 0. Finally, I wrote a program called "multihex" to stitch the hex files together, and a program called "packxxu" to convert it into an 8xu file. When using RabbitSign, you could skip the packxxu step. (But you'd need to add an OS header in some other way.)

DigiTan: I'm not sure what you mean. The public keys can be found in the calculator certificate; the details of the signing algorithm weren't too hard to find. (I seem to remember that Brandon Sterner did the hard work there.) As for the factoring software, it's all out there on the Web - you just have to be crazy enough to look for it. :)

Also, if you have two OSes signed with the same key, you can calculate the public key based on their signatures. That's how I found the 89/92+ keys. Smile Unfortunately, I've had no luck so far doing the same for the Nspire.

Brandon: I see your point. 0A it is, and one of the app keys after that.

Edit: On a tangentially related note, it might be possible to use the 04 key for the 84+ after all. You might be able to send an OS header that claimed to be signed with key 0A, then later on, strategically overwrite page 1A to change the key ID to 04. I'll have to play around with this to see if it's possible.


Last edited by Guest on 31 Jul 2009 04:32:33 pm; edited 1 time in total
Back to top
Michael


Newbie


Joined: 21 Dec 2007
Posts: 39

Posted: 31 Jul 2009 05:27:17 pm    Post subject:

I have to repeat it again. This is so cool and exciting!
Back to top
IAmACalculator
In a state of quasi-hiatus


Know-It-All


Joined: 21 Oct 2005
Posts: 1571

Posted: 31 Jul 2009 08:23:52 pm    Post subject:

Looks like you've gotten yourself sucked in again. Razz

Someone needs to move this to Community News.
Back to top
FloppusMaximus


Advanced Member


Joined: 22 Aug 2008
Posts: 472

Posted: 31 Jul 2009 09:49:02 pm    Post subject:

FloppusMaximus wrote:
On a tangentially related note, it might be possible to use the 04 key for the 84+ after all. You might be able to send an OS header that claimed to be signed with key 0A, then later on, strategically overwrite page 1A to change the key ID to 04. I'll have to play around with this to see if it's possible.

It turns out that what I was describing here doesn't work. In fact, the boot code ignores data packets written to 1A:4000; those packets aren't written to Flash at all. There's a way around this (I'll leave it as an exercise for the reader) but I can't think of any method that would work using ordinary TI-Connect/TIGL/TiLP.

(redacted)

Edit: Now crunching away on polynomials for the 0A key. I'll post the best one I find after a few days. If anyone is interested in helping with the sieving phase (the more the merrier!) then I suggest you take the time to acquaint yourself with Jeff Gilchrist's guide (which Michael linked to a few posts ago.)


Last edited by Guest on 26 Aug 2009 07:52:48 pm; edited 1 time in total
Back to top
Graphmastur


Advanced Member


Joined: 25 Mar 2009
Posts: 360

Posted: 31 Jul 2009 11:06:12 pm    Post subject:

I read it, but how ling do you think it will take on a dual core intel mac?
Back to top
brandonw


Advanced Member


Joined: 12 Jan 2007
Posts: 455

Posted: 31 Jul 2009 11:21:21 pm    Post subject:

Since the man who knows the most about this process is working on the 0A key, I suggest if you want to play around with this but aren't entirely confident on it, work on another key like 0102. There are plenty to go around.

Last edited by Guest on 31 Jul 2009 11:21:36 pm; edited 1 time in total
Back to top
FloppusMaximus


Advanced Member


Joined: 22 Aug 2008
Posts: 472

Posted: 31 Jul 2009 11:45:21 pm    Post subject:

Graphmastur: If you want to give it a try, go for it! I suggest that you try a smaller number first to give you an idea of how the various tools work together. The rule of thumb for GNFS is that it will take about 10 times as long for every 21 digits, so a 155-digit number will take 10 times as long as a 134-digit number, which will take 10 times as long as a 113-digit number.

I don't know the exact specifications of your machine, so it would be hard for me to give a good estimate. Most of the time will be spent sieving, of course; that part is pretty much bounded by your CPU speed. If it's a Core 2, I'd expect it to behave similarly to my Athlon 64; you can do the math. (Incidentally, for 64-bit machines, I highly recommend the "experimental" GGNFS siever; it's significantly faster than the 32-bit siever and quite a lot faster than the "generic" siever that is built by default on 64-bit machines.)
Back to top
fullmetalcoder


Member


Joined: 01 Aug 2009
Posts: 139

Posted: 01 Aug 2009 09:13:39 am    Post subject:

FloppusMaximus wrote:
Also, for anyone who wants to play around with this key, here it is in the standard TI key file format; just save it as "04.key" and you can use it with RabbitSign.

Code:
408FE528B340EB1C88B505B2354BAADF47F3616D92CB532E7E5A2A0DFF1C4E4283CEEA2B2F7AD5F2
8B7E4BE4F3F4C99CABA0D98A8E5F2BE15E2AAC7CED0940EF82
21CB4662A9084F5076B117892EBA3FB0DF9EB24988A62A83890B5A0B4E18BD07720B
20CDFF9610024DB1B7AD46D691E0E538BB00A1D840F5CCAF8EC0FED20C3A9D700B


Hmm... Doesn't seem to work.

I am trying to build CSX with this key (tasm, multihex, packxxu, rabbitsign). Every step works fine but the resulting 8xu still fails at the validation stage on my 84+ (regardless which combination of regular cert/free83p and 04key/05key I use...).
Back to top
IAmACalculator
In a state of quasi-hiatus


Know-It-All


Joined: 21 Oct 2005
Posts: 1571

Posted: 01 Aug 2009 10:18:16 am    Post subject:

I'm no expert, but I'd guess that using the 04 key will make no difference, as the 84+ series uses the 0A key, which hasn't been broken yet. I don't know why free83p/05key doesn't work, though. You'll have to ask Brandon on that one, but he usually doesn't visit UTI very often.
Back to top
fullmetalcoder


Member


Joined: 01 Aug 2009
Posts: 139

Posted: 01 Aug 2009 10:29:48 am    Post subject:

brandonw wrote:
Considering the 84+/SE boot code bug with key 0004 (it worked for me on my 84+SE because it has Free83P, with the 0004 key embedded in the certificate), the next most important key would be 000A, to make this discovery as significant as it should be.

I might have misunderstood this but I think he said he managed to install a 04-signed OS into a 84+SE thanks to the change of certificate made by free83p. anyway it is indeed puzzling that even the 05-signed version fail to validate. Could it be that using packxxu and then rabbitsign leads to having two signatures (packxxu adds a dummy one and I don't know if rabbitsign removes it) which would screw up the validation? Unfortunately I cannot use Brandon's OS2tools because they are written in vb.net and I use linux and I am not proficient enough in vb (never used it actually) to port his code to C. I guess the best option is to merge packxxu and rabbitsign so I may give it a try.
Back to top
Graphmastur


Advanced Member


Joined: 25 Mar 2009
Posts: 360

Posted: 01 Aug 2009 10:45:33 am    Post subject:

If I get a chance later, I will look at his vb code, but I am working under unix, so no promises.
Back to top
Display posts from previous:   
Register to Join the Conversation
Have your own thoughts to add to this or any other topic? Want to ask a question, offer a suggestion, share your own programs and projects, upload a file to the file archives, get help with calculator and computer programming, or simply chat with like-minded coders and tech and calculator enthusiasts via the site-wide AJAX SAX widget? Registration for a free Cemetech account only takes a minute.

» Go to Registration page
    » Goto page Previous  1, 2, 3, ... 17, 18, 19  Next
» View previous topic :: View next topic  
Page 2 of 19 » All times are GMT - 5 Hours

 

Advertisement