Reverse Engineering a Microcomputer-Based Control Unit
Total Page:16
File Type:pdf, Size:1020Kb
REVERSE ENGINEERING A MICROCOMPUTER-BASED CONTROL UNIT John R. Bork A Thesis Submitted to the Graduate College of Bowling Green State University in partial fulfillment of the requirements for the degree of MASTER OF INDUSTRIAL TECHNOLOGY August 2005 Committee: David Border, Advisor Sri Kolla Sub Ramakrishnan © 2005 John R. Bork All Rights Reserved iii ABSTRACT David Border, Advisor This study demonstrated that complex process control solutions can be reverse engineered using the Linux 2.6 kernel without employing any external interrupts or real-time enhancements like RTLinux and RTAI. Reverse engineering creates knowledge through research, observation, and disassembly of a system part in order to discern elements of its design, manufacture, and use, often with the goal of producing a substitute. For this study Intel x86 compatible computer hardware running custom programs on a Fedora Core 2 GNU/Linux operating system replaced the failure-prone microcomputer-based control unit used in over 300,000 Bally electronic pinball machines manufactured from 1977 to 1985. A pinball machine embodies a degree of complexity on par with the problems encountered in a capstone undergraduate course in electronics and is fair game for reverse engineering because its patents have expired, although copyrighted program code is still protected. A black box technique for data development analyzed the microprocessor unit in terms of a closed-loop process control model. Knowledge of real-time computing theory was leveraged to supplant legacy circuits and firmware with modern, general-purpose computer architecture. The research design was based on iterative, quantitatively validated prototypes. The first iteration was a user program in which control of the solenoids was accomplished but the switch matrix failed to correctly detect switch closures. The second iteration introduced a kernel iv module to handle low level control, while a supervisory user program managed game play, logging, and fault detection. In the third iteration an emulation of the digital displays was added to the user interface and it was subjected to public testing. Three variables were manipulated: the module process period, the system load, and the use of POSIX real-time scheduling for the supervisory process. Overall game play performance was acceptable when the workqueue process was repeated every two or three milliseconds; at four milliseconds considerable lamp flicker was evident. An economic realizability measure, 25% unit cost savings, was met by minimizing expense with free, open source software and recycled computer hardware. Project cost was reduced by casting the effort in an educational context and by distributing software development among the SourceForge community, boosting overall return on investment. v And would not a person with good reason call me a wise man, who from the time when I began to understand spoken words have never left off seeking after and learning every good thing that I could? .. Or for this, that while other men get their delicacies in the markets and pay a high price for them, I devise more pleasurable ones from the resources of my soul, with no expenditure of money? Xenophon, Socrates© Defense vi This work is dedicated to my grandfather, who put tools into my hands and encouraged me to take things apart. vii ACKNOWLEDGEMENTS My deepest gratitude goes to Sue for her patience and support through the years while I toiled with this project. I thank Dave Border and the rest of my committee for their guidance. viii TABLE OF CONTENTS Page CHAPTER I. INTRODUCTION.................................................................................... 1 Context of the Problem....................................................................................... 2 Statement of the Problem.................................................................................... 4 Objectives of the Study....................................................................................... 4 Significance of the Study.................................................................................... 5 Assumptions and Limitations............................................................................. 9 Definitions of Terms........................................................................................... 10 CHAPTER II. REVIEW OF THE LITERATURE........................................................ 14 Historical Context.............................................................................................. 16 Relevant Theory................................................................................................. 22 Ingle©s Four Stage Process...................................................................... 22 Prescreening Process................................................................... 25 Stage 1: Evaluation and Verification.......................................... 27 Stage 2: Technical Data Generation........................................... 29 Stage 3: Design Verification....................................................... 31 Stage 4: Design Implementation................................................. 32 Legal Issues............................................................................................. 32 Microcomputer Technology.................................................................... 35 ix Process Control....................................................................................... 39 Real-time Computing.............................................................................. 41 GNU/Linux............................................................................................. 48 Current Literature............................................................................................... 52 Linux 2.6 Kernel..................................................................................... 53 CHAPTER III. METHODOLOGY................................................................................ 56 Restatement of the Problem................................................................................ 58 Research Design.................................................................................................. 58 Methods............................................................................................................... 61 Evaluation and Verification..................................................................... 62 A Socratic Method................................................................................... 64 Technical Data Generation...................................................................... 70 Controlling Continuous Solenoids.............................................. 73 Controlling Momentary Solenoids.............................................. 74 Detecting Switches...................................................................... 79 Controlling Feature Lamps.......................................................... 85 Controlling Digital Displays........................................................ 89 Controlling Game Operation....................................................... 91 Design Verification................................................................................. 93 Prototype Determination............................................................. 94 x Prototype Testing........................................................................ 97 Design Implementation........................................................................... 99 Apparatus............................................................................................................ 100 Electronic Pinball Machine..................................................................... 101 Data Recorder.......................................................................................... 102 Sourceforge.net........................................................................................ 103 Statistical Techniques.......................................................................................... 104 CHAPTER IV. RESULTS.............................................................................................. 106 Process Models.................................................................................................... 107 Continuous Solenoid Control.................................................................. 107 Momentary Solenoid Control.................................................................. 108 Switch Matrix Control............................................................................. 113 Feature Lamp Control............................................................................. 117 Game Operation Control......................................................................... 121 Testbed Iterations................................................................................................ 129 First Iteration: The User Space Program................................................. 134 Second Iteration: The Kernel Module..................................................... 136 Third Iteration: The Public Interface...................................................... 139 Project Return on Investment............................................................................. 142 Overall Performance........................................................................................... 143 xi CHAPTER V. CONCLUSIONS...................................................................................