T-REX / Dragon Development

DaveWilliamson

Registered
Messages
22
Hi,

Does anybody know if there is a website/blog/forum/anything! that gives status updates on the predasaurus or predator software?

Additionally, does anybody know where you can get hold of software development information for these CAM's?

I am assuming that there should be no reason that the source code shouldn't be openly available? If there is, please help me to understand why!

Cheers

Dave
 

driver

Senior Member
Messages
139
Hi,

Does anybody know if there is a website/blog/forum/anything! that gives status updates on the predasaurus or predator software?

Additionally, does anybody know where you can get hold of software development information for these CAM's?

I am assuming that there should be no reason that the source code shouldn't be openly available? If there is, please help me to understand why!

Cheers

Dave

hi m8.you can use a HEX editor to look at the software.

you would need a masters degree in programing to develop software.
assuming you are so able to do this you would also need the alogaarithm for the maths involved for each service.
each bin has a loader section that writes to the second of the integrated circuits in the cam.which contains a format for the loader to write to.

it is not likely that any one person could resolve all the skills required for development.it would mean a team effort .:)
 

DaveWilliamson

Registered
Messages
22
Hi,thanks for the feeback

<quote>You would need a masters degree in programing to develop software.</quote>

Whilst I don't hold ANY degree level qualifications, I certainly can develop at this level, my skills go back to reprogramming the Hitachi SH-Micon chip for engine management on the Sierra Cosworth, so I have a little experience with embedded processors ;-)

I appreciate that I can use a Hex editor to look through the machine language, but without reference to bootstrap code, processor architecture, memory allocation, etc. It becomes a VERY long winded & laborious task to reverse compile the code and understand how to then reprogramme it yourself.

I assume (as has been the way for 'at-least' the last 20 years), their will be a compiler/assembler (of some description) so you can turn 'readable' code into machine language.

Even if this is a fairly basic assembler, someone will have the 'program' to do this, as well as documentation of processor instructions & embedded functions, memory/port maps, interrupt tables, etc....

As for the math/algorithm, this must already be included either hardcoded into the CAM, or as part of the software. If the former, there will be calls to use it ~ if the later, then getting these is only a matter of reverse compiling the current code ~ Which is easy if you have the device information.

To my understanding, the functionality of these things is pretty simplistic (I appreciate the code may be VERY complex), in that your receiver gets an data stream and if it is encoded, passes information through the cam that uses an algorithm to decode it. The decoding, in essence, is based on a private key to decrypt the data which was encrypted with the corresponding public key at the broadcasters end (I assume!).

In addition to this, they either have a number of private keys which they can select from, or a way to update values/keys OTA ~ This is actually the part that interests me (i.e. How to do AU or brute force decrypting using the CAM).

I'm ABSOLUTELY SURE I would find there are a lot of things I haven't even considered in the complexity of doing this, but have always believed that the best way to learn, is to look at how it's already been done, then adapt it with my own ideas.

What I was hoping for, was that somebody could point me at the current source & tools for development, partially out of interest in how these things work, partially out of consideration for what-else these things could be used for, and partially that I may be able to enhance/improve it ~ for educational purposes only :)

I can't see why anybody would want to see this software as proprietary, as any additional work that improves the device would make it more valuable (take Linux as an example!)

Anybody else have an idea where I can get my hands on this 'stuff'
 

empb

SU Team: It's All Good (Fausto v1.45/Newcamd/vplug
Staff member
Administrator
Messages
10,304
Theres some info in both the Dragon & T-Rex threads e.g. Predator/Predasarus file structure:

e.g. See Here

But even thou 369 & 229 look like the last ever releases from the Dragon Team, we still haven't had full public domain disclosure....knowledge of the language and a HEX editor (as already mentioned) should help win more info....
 

DaveWilliamson

Registered
Messages
22
Well that's a start, thanks for that.

At least that tells us that the firmware starts at 4C00, and there's roughly 200k for code.

In real terms, if the firmware is really 200k~ish, this is fairly HUGE for hand crafted assembler, and on that basis I assume it is actually created in a high level language such as C, so is inflated by unused libraries, and unneeded error monitoring and control. This would increase the reverse engineering effort considerably as you spend a lot of time understanding code that does little or nothing! (Oh for the days of hand crafted assembler!)

Do we know what the processor is? I assume it's something off-the-shelf rather than bespoke? If so, to write a reverse-compiler is not too complex (at least to turn into assembly language).

After that (or as part of it if your want to be really clever) the next thing would be to understand the port/memory mapping, and any bespoke, hard-coded, functions built into the device (if they exist!)

I assume the 'RSA secure processor' will be pretty much a standalone device to quickly process decryption, so info on that would be desired/required, although you may be able work out what it does from the calls made ~ A quick google doesn't offer any specific info.

From there, you should have a real understanding of what the thing is actually doing, and should be able re-programme the device to do 'other' things.

This may be a futile experiment, as what it currently does maybe all it's capable of, but could be an interesting experiment!

Is there any way to contact the Dragon team, or is it just they will/may read these sort of posts, and contact you?

There must be some form of communication available.
 
Top