---- START NEW MESSAGE --- Received: from cherry.ease.lsoft.com [209.119.0.109] by dpmail10.doteasy.com with ESMTP (SMTPD32-8.05) id AA4F127A022C; Thu, 29 Jan 2004 14:33:51 -0800 Received: from PEAR.EASE.LSOFT.COM (209.119.0.19) by cherry.ease.lsoft.com (LSMTP for Digital Unix v1.1b) with SMTP id <8.00CC36F7@cherry.ease.lsoft.com>; Thu, 29 Jan 2004 17:33:34 -0500 Received: from MITVMA.MIT.EDU by MITVMA.MIT.EDU (LISTSERV-TCP/IP release 1.8e) with spool id 3490 for PICLIST@MITVMA.MIT.EDU; Thu, 29 Jan 2004 17:33:22 -0500 Received: from MITVMA (NJE origin SMTP@MITVMA) by MITVMA.MIT.EDU (LMail V1.2d/1.8d) with BSMTP id 5853; Thu, 29 Jan 2004 17:32:56 -0500 Received: from ns1.cypress.com [157.95.67.4] by mitvma.mit.edu (IBM VM SMTP Level 430) via TCP with ESMTP ; Thu, 29 Jan 2004 17:32:56 EST X-Comment: mitvma.mit.edu: Mail was sent by ns1.cypress.com Received: from corpmail.cypress.com (corpmail [157.95.1.2]) by ns1.cypress.com (8.12.10/8.12.10) with ESMTP id i0TMHQMZ023729 for ; Thu, 29 Jan 2004 14:17:26 -0800 (PST) Received: from kenmore.ipdsd.cypress.com (kenmore.ipdsd.cypress.com [157.95.129.67]) by corpmail.cypress.com (8.12.10/8.12.10) with ESMTP id i0TMLvXo029595 for ; Thu, 29 Jan 2004 14:22:02 -0800 (PST) Received: from aiw ([157.95.129.128]) by kenmore.ipdsd.cypress.com (8.11.6+Sun/8.11.6) with ESMTP id i0TMOkg10289 for ; Thu, 29 Jan 2004 14:24:46 -0800 (PST) MIME-Version: 1.0 Priority: normal X-mailer: Pegasus Mail for Windows (v4.12a) Content-type: text/plain; charset=US-ASCII Content-transfer-encoding: 7BIT Content-description: Mail message body Message-ID: <40191904.1003.AF2E4A@localhost> Date: Thu, 29 Jan 2004 14:30:28 -0800 Reply-To: pic microcontroller discussion list Sender: pic microcontroller discussion list From: Andrew Warren Organization: Cypress Semiconductor Subject: Re: [PIC:] Disassemblers To: PICLIST@MITVMA.MIT.EDU In-Reply-To: <2193429B07D9914D97216EBBAA6AB8BD1A0527@whitlam.corp.gli.com.au> Precedence: list X-RCPT-TO: Status: U X-UIDL: 371856356 Liam O'Hagan wrote: > The binary that the manufacturer has on their server, which they > thought was assembled from the source code they have, doesn't > match... > > At some stage in the 12 or so years since the code was written, > someone has modified the binary, and nobody has noticed. That > binary has been written to every subsequent device produced by that > manufacturer. Liam: If the program was written in a high-level language like C, the difference between the original and the modified source might be much smaller than it appears from your side-by-side comparisons of assembly-language disassemblies. It would make sense for the changes to be small; after all, the chance of the modification being discovered -- through the introduction of a bug, or through a noticeable change in the "normal" behavior of the modified code as compared to the original -- would increase as more of the original code was changed. Does the manufacturer have both the original source code AND a copy of the particular version of the compiler that was used 12 years ago to create the original binary? Does the manufacturer have, or have access to, all versions of the compiler available prior to your suspect's leaving the manufacturer's employ? It's worth doing some experimentation, I think, to see whether the large differences between the two binaries are just the result of compiling the program with two different compiler versions (or two different sets of compilation switches or compiler libraries). You may find that when you get the original source compiled with exactly the right compiler and compiler settings, the output binary will just snap into alignment with the modified binary you took from the machine on your desk... With the exception of a few lines that clearly show how the machines are being cheated. Good luck... -Andy === Andrew Warren -- aiw@cypress.com === Principal Design Engineer === Cypress Semiconductor Corporation === === Opinions expressed above do not === necessarily represent those of === Cypress Semiconductor Corporation -- http://www.piclist.com hint: The PICList is archived three different ways. See http://www.piclist.com/#archives for details. .