Siemens SAB 80C537 Reverse Engineering

Do you have a question? Post it now! No Registration Necessary

Translate This Thread From English to

Threaded View
Is there someone or company that can handle reverse engineering of a
LOCKED 80C537 in a reasonable amount of time?


Re: Siemens SAB 80C537 Reverse Engineering
If I am not mistaken you are asking somebody to steal intellectual
property by hacking a protected program.
Please do not post here!

Schwob

snipped-for-privacy@gmail.com wrote:
Quoted text here. Click to load it


Re: Siemens SAB 80C537 Reverse Engineering

Quoted text here. Click to load it

More likely, it's a company where the original design engineer has left
and no one knows what's going on.

Dan

Re: Siemens SAB 80C537 Reverse Engineering
Quoted text here. Click to load it

You might be mistaken. My company for example, sells a device
(http://www.customware.nl/en/eastest.html ) which is also produced by someone
else
(http://www.telsec.nl/modules/shop/produkten/produkt_detail.asp?pid20%02073 &
gid=6&sgid=0). I have sold that company 100 microcontrollers with code 7 or
8 years ago. They are still selling this device, so I bought one and
compared the timing of the signals and they matched my device. But I would
love to be able to read the contents of their micro to be 100% sure that
they copied my microcontrollers, wich were inadvertedly unlocked.....
So that would be a perfectly legal case.

Meindert





Re: Siemens SAB 80C537 Reverse Engineering
The manufacturer of the board went bust and we are trying to make 1 or
2 sets for standby. Do you know it cost a bomb just to make 2 boards
compared to like 200? I wish I could make 50,000 pieces and sell them
too since there's nobody around to sue us, but that's not our
objective. Moreover, nobody would want this application-specific board
anyway.

But anyway, I do not have much knowledge of this chip. (Siemens SAB
80C537-16-N)
It is programmable and lockable?
If it is, how hard is it to reverse engineer it?


Re: Siemens SAB 80C537 Reverse Engineering
Quoted text here. Click to load it

The 80C537 uses external rom only, so there's no need to reverse engineer
this chip. There should be a PROM or EEPROM on your board that contains the
code.

Meindert



Re: Siemens SAB 80C537 Reverse Engineering
I think I see a chip with a glass window beside the 80C537. Now my
question is how hard is it to get the code out?
Would a $45 universal prommer do the job?

Meindert Sprang wrote:
Quoted text here. Click to load it


Re: Siemens SAB 80C537 Reverse Engineering

Quoted text here. Click to load it

Most likely it will but it may not be much use to you unless you use it
with a 537. Although it's basically a 8051 variant it does have some
unique hardware.


Re: Siemens SAB 80C537 Reverse Engineering
Quoted text here. Click to load it

Not. Plug it in a programmer and press READ

Quoted text here. Click to load it

Yep. EPROMS have no protection mechanism.

Meindert



Re: Siemens SAB 80C537 Reverse Engineering
Thanks for all the help guys. Being a noob in embedded stuff, I've
learnt alot from this post alone.

This also led me to another question. So how does one protect their
code?


Re: Siemens SAB 80C537 Reverse Engineering
snipped-for-privacy@gmail.com writes
Quoted text here. Click to load it

You don't. In the vast majority of embedded systems the software is of
little use without all the hardware it is attached to. What is more most
of it only works with the specific hardware it is attached to.

Added to that without the source code it is a long tedious job to work
backwards from 64K of assembler to flowcharts and an understanding of
the system.

It would have to be something VERY special to warrant that sort of
effort. Either that or you are about to pirate the whole system and mass
produce your own.

--
\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\
\/\/\/\/\ Chris Hills  Staffs  England     /\/\/\/\/
We've slightly trimmed the long signature. Click to see the full one.
Re: Siemens SAB 80C537 Reverse Engineering
Quoted text here. Click to load it

By using a microcontroller with internal ROM/FLASH for instance, which
usually has some form of protection like lock-bits that prevent readout of
the controller by a programmer.

Meindert



Re: Siemens SAB 80C537 Reverse Engineering
Quoted text here. Click to load it

Please do not top post.

There are MANY reasons why some one needs to get into a locked system.
Very often where the original programmer has left and the notes have
disappeared.

Other times one company has bought out the IP from another if the staff
at the original company are not being taken on they tend to "loose" all
the documentation before the hand over. I have known this happen several
times.

In the case of a local car company I understand the R&D team spent a
couple of days shredding and burn all paper work and reformatting the
hard disks. It was even suggested the over wrote all the backups with
the new reformatted balk data.

However there are also many times when it is hacking for illegitimate
reasons. You have to be satisfy your own moral and professional
standards in each case as to whether you will help of not.

Though as the 537 is all external memory I can't see how it can be
locked... unless they have scrambled the address and data lines.

The 537 is a rather old discontinued part that has not been for new
designs for many years so it is likely to be an old system and probably
not something leading edge worth hacking unless it is your own system.

 
--
\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\
\/\/\/\/\ Chris Hills  Staffs  England     /\/\/\/\/
We've slightly trimmed the long signature. Click to see the full one.
Re: Siemens SAB 80C537 Reverse Engineering
Quoted text here. Click to load it
question is how hard is it to get the code out?
Would a $45 universal prommer do the job?


Any Eprom Programmer will do.

Infineon even has a disassembler somwhere in their download section for the
8 bit controllers.
User Manuals for the 537 are available as well.

see www.8052.com for more info/goodies


grtnx
/jan

Quoted text here. Click to load it



Re: Siemens SAB 80C537 Reverse Engineering
responding to
http://www.electrondepot.com/embedded/siemens-sab-80c537-reverse-engineering-43397-.htm
Quoted text here. Click to load it
Dear all, I have a wind-turbine that is equipped with a Siemens 80c537 CPU based
PLC, named Sentic convoy 537. Seems that today nobody is able to interact with
this PLC.
I have recognized the eprom (AMD 27c512). I need to modify a functional
parameter (the rotor rpm set): can anyone suggest how to do that?

I have an eprom programmer and I can read the eprom content. But I need further
help to do my job....

Please, can anyone help me?

Thank you!!

Re: Siemens SAB 80C537 Reverse Engineering
On 6/8/2016 11:37 AM, gldiana wrote:

Quoted text here. Click to load it

The wind turbine is named "Sentic Convoy 537"?  Or, does the PLC that controls
it bear that name?

If the former, what is the name/model of the actual Siemens PLC incorporated
into the device?  Why can't you find documentation regarding that PLC's
"interface" (since you claim noone can "interact" with it)

Quoted text here. Click to load it

Yeah; look at the interface description for the device and see if
there's a "rotor rpm setpoint" parameter listed.  If not, are you sure
bad things won't happen if you alter this parameter?

Quoted text here. Click to load it

Contact the vendor.

Contact Siemens (for PLC documentation).

Dump the EPROM and reverse engineer its contents.

Re: Siemens SAB 80C537 Reverse Engineering
responding to
http://www.electrondepot.com/embedded/siemens-sab-80c537-reverse-engineering-43397-.htm
Quoted text here. Click to load it
The turbine brand is "Windworld". The PLC brand (manifacturer) is "Sentic",
model name is "convoy 537" ( known also as "Mark IV").
Sentic is no longer existing: the turbine was sold originally in 1992, and if
you google "sentic controller" you will find almost nothing. That is more a
controller than a PLC, in the sense that it has been tailor made for this
application only...

I know that in the eprom there's binary code, but I am not able to disassemble
it without your help.
Finally I would say that I know exactly what I am going to do modifying that
parameter..

I have also a photo of that plc: is there any way to attach it here?

Thank you in advance for any help..

Re: Siemens SAB 80C537 Reverse Engineering
On 6/9/2016 6:37 PM, Gian Luigi wrote:

Quoted text here. Click to load it

Ah.


Given the choice of a 64KB device, it is likely that at least half of it
is used (else a 32KB device could have been used at reduced cost).
That's a fair bit of code to "reverse engineer" -- esp if you have no
*definitive* idea what the interfaces are like (which signals are present
on which inputs, what the balance of the electronics do on the board,
etc.)

This is the sort of thing that falls in the "hobbyist" category -- someone
with more interest/time than money (it would cost you a fair bit to have
the design reverse engineered).

[I've known folks who hand-disassembled ~48KB binaries "out of curiosity"
but knew, up front, that it was an uneconomical task and did it for the
"personal challenge"]

Your comments suggest there's a servo/control loop operating to keep
the turbine at (or "not to exceed"?) a particular speed.  (how?)

If that's the case, then you might find it easier to *trick* the controller
into doing what you want:
- <something> tells the MCU the current rotor rpm
- the MCU actuates <somethingelse> to drive the rpm as desired
So, if the current RPM setting is "hard coded" as X and you want it
to be Y, figure out how to introduce a X/Y scale factor in the
*sensed* RPM.  In this way, when the motor RPM *is* Y, the MCU
will see it as Y * X/Y = X and think it is doing exactly what it
was designed to do!

Alternatively, introduce a Y/X factor in the actuator output...

[There are lots of assumptions in this -- any of which can make it
an inappropriate solution.  But, I don't know what your system does
or how it operates so can't identify those risks]

Quoted text here. Click to load it

No.  You could post it to a hosting site and pass a pointer (URL)
in a followup post, here.  But, hard to say much of anything even
from a photo...


Re: Siemens SAB 80C537 Reverse Engineering
responding to
http://www.electrondepot.com/embedded/siemens-sab-80c537-reverse-engineering-43397-.htm
Quoted text here. Click to load it
Don Y, thank you alot for your answer.

The controller needs to check the rotor rpm because when it reaches a set value
it has to connect the generator to the grid and start electricity production. I
add that I do have all electrical schemes and data sheets af all devices
connected with the controller, so I know pin assignment of all analog and
digital I/O.

Originally it is made with two proximity sensors that produce a pulse when two
masses located on the brake disk pass in front of them (sensors are mounted on
fixed frame, masses are installed on brake disk and rotate with it) ... So the
controller should measure the time between two pulses (when the pulses of both
sensors are "on" at same time) and calculate the rpm.

How can I "fool" the controller "translating" the sensors signal? To me seems
that the only way is to have a wheel rotating at "original" rpm, with two
similar proximity sensors,  and connect it to the controller when the rotor is
rotating at new "rpm".. And in this case I need to read the actual rotor rpm to
manage the system... Indeed the "fooling" system should give a proportional rpm
signal to controller at any time to let it keep all safety controls based on rpm
check working..

The other way round is viable only if I am able to find an editor of the eprom
but at a level far higher than assembler level... For sure I cannot deal with
machine-level instructions..

Do you have any other ideas??  

  

--


Re: Siemens SAB 80C537 Reverse Engineering
On 2016-06-10 gldiana wrote in comp.arch.embedded:
Quoted text here. Click to load it

If you are a mechanical guy, you could solve it with a second wheel. And if
you drive that wheel with gears or belt from the original, you set the
translation ratio with the gear ratio.

Quoted text here. Click to load it

The electronic version of the gears would be to insert a box in the proximity
sensor lines. This box determines the speed from the sensors and outputs a
translated version of the signals to the controller. This fools the controller
into believing the rotor rotates at a different speed, just as the mechanical
solution.

Introducing any kind of translation will change the operating parameters
of the system. This may result in less optimal regulation. Especially
in the electronic version, make sure you don't introduce (too much) delay
is the speed sensing.  

How much of a change in rpm are you looking for? Is the turbine suited to
run at the 'new' rpm?


--  
Stef    (remove caps, dashes and .invalid from e-mail address to reply by mail)

Satire does not look pretty upon a tombstone.

Site Timeline