The document discusses reverse engineering and reversing crypto circuits. It provides examples of using a microscope at 500x magnification to analyze chip logic and using automated analysis to identify logic gates and trace wire connections. It also discusses reversing a recursive list-reverse function by defining a mutable list reverse function (mlist-reverse!) that mutably reverses a list without increasing memory usage based on list length. The instructor notes there are still unclaimed exams and storage fees will be charged starting Monday.

1. Class 25:
Reversing
Reverse
cs1120 Fall 2011
David Evans
21 October 2011

2. Reverse Engineering
What you Want Design a Solution
Forward (Normal) Engineering
Understand how it works Some Artifact
Challenge Response Key stream
RNG +
f(∙)
+ + 48-bit LFSR Note: when the artifact
ID you start with is
Mutual authentication
protocol
48-bit stream cipher natural, this is called
Reverse Engineering “science”!
2

3. Reversing Crypto Circuits
500x Magnification Microscope
Pictures from Karsten Nohl (UVa CpE PhD 2009)
3

4. 4 NAND: Y = !(A & B & C & D)
Chip Logic Layer
4

5. (Mostly) Automated Analysis
Identify Logic Gates Trace Wires Connecting Them
5

6. Challenge Response Key stream
RNG +
f(∙)
+ + 48-bit LFSR
ID
Mutual authentication 48-bit stream cipher
protocol

7. 7

8. Plan
Review: list-reverse
(Forward and Reversing) mlist-reverse!
Forward and Reverse Lists (Doubly-Linked Lists)
I still have unclaimed Exams! I will start
charging exam storage fees Monday.
Note: if you want to reverse engineering my storage fees
protocol, you could try waiting later (but I don’t recommend it!)
8

9. Reversing
9

10. Analyzing list-reverse
(define (list-reverse p)
(if (null? p) null
(list-append (list-reverse (cdr p)) (list (car p)))))
10

11. Reversing
(define (list-reverse p)
(if (null? p) null
(list-append (list-reverse (cdr p)) (list (car p)))))
Running time is in (N2)
where N is number of elements in p.
Number of new cons cells:
for the list-appends: N-1 + N-2 + … + 1 = N2/ 2
+ for the (list (car p)): N
memory use is in (N2)
11

12. mlist-reverse!
Define a mlist-reverse! that reverses the elements of a
mutable list. The output should be a mutable list with
the elements in the reverse order. The number of cons
cells it creates should not scale with the length of the
list. (The input list can be mutated arbitrarily!)
12

13. Revers!ing a List
m1:
1 2 3
revm1:

14. 14

15. Close…but not quite
(define (mlist-reverse! p)
(if (null? (mcdr p)) (define (mlist-reverse! p)
(if (null? (mcdr p))
p
p
((lambda (rest) (let ((rest (mlist-reverse! (mcdr p))))
(begin (set-mcdr! p null)
(set-mcdr! p null) (mlist-append! rest p)
(mlist-append! rest p) rest)))
rest))
> m1
(mlist-reverse! (mcdr p))))) {1 2 3 4}
> (mlist-reverse! m1)
{4 3 2 1}
> m1
{1}
15

16. Charge
Next week:
Finish mlist-reverse!
Programming with Objects, Python
I still have unclaimed Exams! I will start
charging exam storage fees Monday. You
can come to my office now to get yours.
16