News:

PROTON pic BASIC Compilers for PIC, PIC24, dsPIC33

Main Menu

Dongle decode

Started by See_Mos, Sep 09, 2024, 10:23 AM

Previous topic - Next topic

See_Mos

Bit of a long shot!  Any ideas please?

I have been asked if I can replicate a 25 pin printer port hardware dongle from 2007 because the original equipment manufacturer is no longer around.  There are several computers in the setup and each dongle determines what part of the system is available to each individual PC.  This is the master dongle which gives full access.

The attached is a snip of the captured data.  So far the captures are the same each time the PC is booted so that is one problem solved.  Orange and red are information from the PC and blue is the returned data.  The whole dongle activity is 11.5 seconds and the smallest data bit period is 10uS.

The problem is that the data from the PC does not appear to follow any particular coding method that I know. 

See_Mos

#1
This is the full capture if anyone is interested enough to install KingstVIS available here http://www.qdkingst.com/en/download

At the top right clicking on the three bars opens the 'load' option.

Dongle activity starts at about 15 seconds when Channel 15 goes high.  Zoom in or out using the mouse wheel anywhere over the data screen.

kcsl

Assuming that sequence is being generated by the application software, and you're saying the challenge/response sequence to/from the dongle is identical, then that's a terrible implementation.
First thing I'd do is advance the PC date by a few years to see if the sequence is the same.

Anyway, if it's decided that the sequence never changes, then it should be a simple-ish matter of using a PIC to generate the correct response.
Count the number of positive going red pulses, and generate an equivalent blue pulse.

There's no room for optimism in software or hardware engineering.

Stephen Moss

Quote from: See_Mos on Sep 09, 2024, 10:23 AMThe problem is that the data from the PC does not appear to follow any particular coding method that I know.
Maybe you have already considered this or there seeing a large amount of the data would dismiss the following, but...

Although it is a little odd with the dead periods gaps (could be a wake up sequence) at the beginning and the occasional long pulse (may be down to sampling frequency) could the Red signal be a clock rather than data as it mostly has that look about it?

If so then I would think that as you stated the Orange would then appear the be data to the dongle.

The initial two blue single pulses could be an Ack signal from the dongle back to the PC as unless I have miscounted there does appear to be 9 Red pulses between them which would make sense if the Red is indeed a clock (8 for data + 1 for the Ack). Thus, considering that may be the case thereby giving you a delimiting point to discern each byte of Orange data perhaps looking at that as hexadecimal values instead of as a waveform it may then resolve into know control codes.

See_Mos

QuoteAssuming that sequence is being generated by the application software, and you're saying the challenge/response sequence to/from the dongle is identical, then that's a terrible implementation.
First thing I'd do is advance the PC date by a few years to see if the sequence is the same.

The dongle is not for software protection more to stop unauthorised users accessing the wrong part of the system.  The whole system is networked and each part of the system has its own dongle so that for example a camera operator does not have access to the crane operator stuff, only the PC with the master dongle has full access, so the simple implementation and date are not a problem. The dongle check is only done once at start-up.

QuoteAnyway, if it's decided that the sequence never changes, then it should be a simple-ish matter of using a PIC to generate the correct response.
Count the number of positive going red pulses, and generate an equivalent blue pulse.

That was my first though. I could not see any logical breakdown but I think I will try. There are about 59,000 negative going edges on the red channel so roughly 7500 bytes which should be doable but that's a big array of bytes.

@Stephen, the ACK sequence does seem to appear several times though I did spot one or two where the red and orange pulses are not the same.  I will try to break it down further.

I need to find out if the installation for the software is available as the setup provided by the end user is running under Windows XP and the only way to reboot the software is to shut it down via task manager then rebooting the PC which takes minutes to complete.

See_Mos

This is what happens without the dongle.  Capture starts after the NOT Select Printer line goes high.

The request ACK happens 12 times then there id activity on other lines of data from the PC that are not active if the dongle is present.