More SSS software documentation


Jack Rubin
 

I've added the documentation for several more SSS programs for 9000 200/300 computers to the Files section. Unfortunately, I do not have any of the actual software described and furthermore, the software was protected against duplication by being tied to the serial number of the specific machine where it was initialized. 

Does anyone have any of this software? If so, have you been able to break the key so that the software may be recovered and re-distributed?

Frank Key of SSS has released all his material to the public domain without reservation, so if you can find it, you can run it.

Jack


 

Jack,

 

HP 9000 200 and 3000 series computers have a configuration prom which contains the serial and some config data.

The proms from the 9826 and 9836 are easily to copy and to alter, so if someone has the software and knows the serial it should be possible to create the right prom.

 

-Rik

 

Van: VintHPcom@groups.io [mailto:VintHPcom@groups.io] Namens Jack Rubin
Verzonden: vrijdag 25 augustus 2017 19:04
Aan: VintHPcom@groups.io
Onderwerp: [VintHPcom] More SSS software documentation

 

I've added the documentation for several more SSS programs for 9000 200/300 computers to the Files section. Unfortunately, I do not have any of the actual software described and furthermore, the software was protected against duplication by being tied to the serial number of the specific machine where it was initialized. 

Does anyone have any of this software? If so, have you been able to break the key so that the software may be recovered and re-distributed?

Frank Key of SSS has released all his material to the public domain without reservation, so if you can find it, you can run it.

Jack


Ansgar
 

Hi Rik,

Is the ID PROM soldered? My 9836 is a bit hard to open (burried between too much other equipment). I assume they didn't want to make it too easy to swap PROMs :-) Guess it finally worked out to be too restrictive, so HP later changed to HIL dongles. Would be nice to disable the check in the software itself.

-Ansgar 


Paul Berger
 

Ansgar,

The ID prom will be on the CPU card and it is normally socketed and usually has a white label stuck on it.

Paul.




On 2017-08-25 6:38 PM, Ansgar wrote:
Hi Rik,

Is the ID PROM soldered? My 9836 is a bit hard to open (burried between too much other equipment). I assume they didn't want to make it too easy to swap PROMs :-) Guess it finally worked out to be too restrictive, so HP later changed to HIL dongles. Would be nice to disable the check in the software itself.

-Ansgar 


Ansgar
 

Hmmm I think HP once recommended to software vendors to hand over a code to the customer derived from the serial number in the ID PROM, which the software then requests from the customer to check whether it has been licensed or not. The advantage was that the software didn't need to be serialized.

However it seems that the SSS software for the HP 200/300 had been serialized. If this is the case, you probably need two versions serialized with different IDs to find the serial number related code quickly. Otherwise you need to find the access to the PROM via reverse engineering (guess it was mapped into the I/O page somewhere at 5F0000 or so).

Let's see whether we can take a look into the secured code somehow.

-Ansgar


Jack Rubin
 

The bigger problem may be finding the software! Does anyone have anything from them?

 

From: VintHPcom@groups.io [mailto:VintHPcom@groups.io] On Behalf Of Ansgar
Sent: Friday, August 25, 2017 5:22 PM
To: VintHPcom@groups.io
Subject: Re: [VintHPcom] More SSS software documentation

 

Hmmm I think HP once recommended to software vendors to hand over a code to the customer derived from the serial number in the ID PROM, which the software then requests from the customer to check whether it has been licensed or not. The advantage was that the software didn't need to be serialized.

However it seems that the SSS software for the HP 200/300 had been serialized. If this is the case, you probably need two versions serialized with different IDs to find the serial number related code quickly. Otherwise you need to find the access to the PROM via reverse engineering (guess it was mapped into the I/O page somewhere at 5F0000 or so).

Let's see whether we can take a look into the secured code somehow.

-Ansgar


Ansgar
 

Yes and please serialized for 2 different IDs, if possible ;-)


Ansgar
 

Seems that SSS required to customer to do the serialization on his/her own. The documentation is talking about a RESECURE program (which was provided on the original program disk) needed to be run on the original program disk, before the software could be backed up or installed to hard disk. Presumably the RESECURE program read the serial number out of the ID ROM and keyed the software with it. I just wonder what prevented the user from creating a backup copy before running the RESECURE program...


 

Security by obscurity...

I know the software to generate the code words (licence code) for the HP 16700 series Logic analyzers was on the Ignite CD.
The 16700 series are using a pa-risc processor and run the same HP-UX as the HP 9000 series 700 computers.

The software is on the CD but renamed but usable so most people with a 16700 LA have all options enabled 😉 by generating their own license codes. I haven’t checked it but I think there is a big chance this also works for the regular HP-UX versions.

To go back to the SSS software, I know about software which used the same copy protection techniques which had a counter build in.

And which made the original discs copy protected, by adding some strange sector (defect or other format) on which the copy software should end the process. But on the other hand other times other thoughts so it’s well possible they just trusted their costumers.

 

-Rik

 

Van: VintHPcom@groups.io [mailto:VintHPcom@groups.io] Namens Ansgar
Verzonden: zaterdag 26 augustus 2017 1:25
Aan: VintHPcom@groups.io
Onderwerp: Re: [VintHPcom] More SSS software documentation

 

Seems that SSS required to customer to do the serialization on his/her own. The documentation is talking about a RESECURE program (which was provided on the original program disk) needed to be run on the original program disk, before the software could be backed up or installed to hard disk. Presumably the RESECURE program read the serial number out of the ID ROM and keyed the software with it. I just wonder what prevented the user from creating a backup copy before running the RESECURE program...


Ansgar
 

Thanks to Jack dumps of the missing SSS 9845 Option ROMs are now available from the Open ROM page on my website (check this link for download).

New are the Command File / Memory Mass Storage and the 1985 revision of the Mass Memory ROMs. No idea yet where the difference is for the latter compared to the 1984 revision.

Still looking for someone volunteering to create a replacement PCB for 9845 option ROMs, though...

-Ansgar


Paul Bicknell
 

Hi Angus

 

You say Still looking for someone volunteering to create a replacement PCB for 9845 option ROMs, though

Is this the same PCB that goes into the 9826/9836 and if so what do you want on the ROM I assume DOS

Also location would be good

Paul B  South Cost   UK


From: VintHPcom@groups.io [mailto:VintHPcom@groups.io] On Behalf Of Ansgar
Sent: 28 October 2017 09:16
To: VintHPcom@groups.io
Subject: Re: [VintHPcom] More SSS software documentation

 

Thanks to Jack dumps of the missing SSS 9845 Option ROMs are now available from the Open ROM page on my website (check this link for download).

New are the Command File / Memory Mass Storage and the 1985 revision of the Mass Memory ROMs. No idea yet where the difference is for the latter compared to the 1984 revision.

Still looking for someone volunteering to create a replacement PCB for 9845 option ROMs, though...

-Ansgar

No virus found in this message.
Checked by AVG - www.avg.com
Version: 2016.0.8013 / Virus Database: 4782/15076 - Release Date: 10/28/17


Ansgar
 

Not really. The major challenge actually is to design a PCB which fits the specs of HP 9845 option ROMs in terms of maximum dimensions and spacing of the contact raster (they used something odd, no common raster I guess).

There is nothing really magic, but you need to understand the 9845 bus logic at the Option ROM interface. SSS once created a version which uses two 2764 EPROMs for their own Otrion ROM modules. Thanks to Tony we have a blueprint for this, with a PROM for address decoding:


This one uses address lines 18-21 to select on of the 8 PPU Option ROM blocks 11, 15, 21, 25, 31, 35, 41 and the Test ROM block 45 (all octal). For the LPU address lines 16 and 18-20 are used to select one of the 7  LPU Option ROM blocks 7, 13, 17, 23, 27, 33 and 37 (again all octal).

Guess it would be more handy to use EEPROMS or flash EEPROMs instead of 2764, especially larger ones which makes it possible to contain more than one Option ROM or even all Option ROMs. Also it would be nice to have a switch to enable/disable the Test ROM block (block 45) when installed in the PPU ROM drawer. With two of those PCBs (one in the left and the other in the right ROM drawer) you can in theory replace all Option ROMs at once. I guess we may also drop the PROM as address decoder, because we can use a 1:1 mapping for covering the full option ROM range. There are lots of possibilities...

-Ansgar