About PLD dumping/reverse engineering

[Caius]

Hi all, !
As the tile says, I'm into reverse-engineering secured PLD in these days.
Until now I've used with success the this PAL dumper:

http://cgfm2.emuviews.com/pal/index.html

It works most of time but it supports PLD devices up to 20-pin.Now I'd want
to reverse secured combinatorial (registered ones are really hard..) 24-pin
PLDs (like PALCE20V8H) which often I encounter on my PCBs.
What would be your approach to this aim?Recreate equations by studiying PCB
connections?Or brute-forcing the device trying all possible input
combinations and logging the outputs (this is what the PAL dumper does, I
presume)?
My EPROM programmer has a vector test feature, maybe it could be useful in
conjunction with the use of a logic analyzer?
Besides, I came across this page where a guy clones some PAL using a simple
device he built but also this support PLDs up to 20-pin:

http://www.vintage-computer.com/vcforum/entry.php?315-Cloning-a-PAL-HAL-%28Part-2%29&goto=prev

Do you think it could be easily adapted in order to dump 24-pin PLDs?
I hope someone can help me.
Thanks in advance



---
Questa e-mail è priva di virus e malware perchÊ è attiva la protezione avast! Antivirus.
http://www.avast.com

 

[josephkk]

On Sun, 22 Dec 2013 00:19:29 +0100, "Caius" <briccus@yahoo.it> wrote:

Hi all, !
As the tile says, I'm into reverse-engineering secured PLD in these days.
Until now I've used with success the this PAL dumper:

http://cgfm2.emuviews.com/pal/index.html

It works most of time but it supports PLD devices up to 20-pin.Now I'd want
to reverse secured combinatorial (registered ones are really hard..) 24-pin
PLDs (like PALCE20V8H) which often I encounter on my PCBs.
What would be your approach to this aim?Recreate equations by studiying PCB
connections?Or brute-forcing the device trying all possible input
combinations and logging the outputs (this is what the PAL dumper does, I
presume)?
My EPROM programmer has a vector test feature, maybe it could be useful in
conjunction with the use of a logic analyzer?
Besides, I came across this page where a guy clones some PAL using a simple
device he built but also this support PLDs up to 20-pin:

http://www.vintage-computer.com/vcforum/entry.php?315-Cloning-a-PAL-HAL-%28Part-2%29&goto=prev

Do you think it could be easily adapted in order to dump 24-pin PLDs?
I hope someone can help me.
Thanks in advance

If it is strictly combinatorial you could be OK, just as soon as it stores
any state, and the more state it stores you are screwed. Not much 20 pin
stuff stores state, most higher pin count devices do.

---
Questa e-mail č priva di virus e malware perché č attiva la protezione avast! Antivirus.
http://www.avast.com