<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div>Fascinating reading - almost like reading Stoll's Cuckoos Eggs!</div><div><br></div><div>Thank you G.<br><br><div><div><br></div><div><br></div><div>---</div><div>Supratim Sanyal, W1XMT</div><div>39.19151 N, 77.23432 W</div><div><span style="font-size: 13pt;">QCOCAL::SANYAL via </span><a href="http://www.update.uu.se/~bqt/hecnet.html" style="font-size: 13pt;">HECnet</a></div></div></div><div><br>On Apr 15, 2020, at 12:09 PM, Robert Armstrong <<a href="mailto:bob@jfcl.com">bob@jfcl.com</a>> wrote:<br><br></div><blockquote type="cite"><div><span> Thanks, Gerry!</span><br><span></span><br><span>Bob</span><br><span></span><br><span></span><br><span>-----Original Message-----</span><br><span>From: <a href="mailto:owner-hecnet@Update.UU.SE">owner-hecnet@Update.UU.SE</a> [<a href="mailto:owner-hecnet@Update.UU.SE">mailto:owner-hecnet@Update.UU.SE</a>] On Behalf</span><br><span>Of G.</span><br><span>Sent: Tuesday, April 14, 2020 11:07 PM</span><br><span>To: HECnet</span><br><span>Subject: [HECnet] I have found how to recover the TOPS-10 Fortran V11 patch</span><br><span>decryption keys</span><br><span></span><br><span>Since here too there are some TOPS-10 users, I am pleased to announce that I</span><br><span>have found a way to recover the long-missing TOPS-10 Fortran V11 patch</span><br><span>decryption keys. Find below a copy of the post I just sent to alt.sys.pdp10.</span><br><span></span><br><span>HTH, :)</span><br><span>G.</span><br><span></span><br><span>=====</span><br><span></span><br><span>Dear all,</span><br><span></span><br><span> as many of you may know, the TOPS-10 Fortran V11 tape image</span><br><span>available in the usual repositories is truncated because the original tape</span><br><span>reel from which it was sourced (BB-D480G-SB) was found to be damaged.</span><br><span></span><br><span>Luckily enough, the first four savesets (out of seven) were indeed readable,</span><br><span>therefore the V11 compiler is in fact available. Unfortunately, one of the</span><br><span>missing savesets (the seventh) contains the keys required to decode TSU tape</span><br><span>patches. Therefore, even if TSU tapes are available and completely readable,</span><br><span>their contents could not be used because they are encrypted.</span><br><span></span><br><span>Nonetheless, after much pondering and careful observing, and thanks to some</span><br><span>good guess, I was able to reconstruct the most important missing keys :)</span><br><span></span><br><span>Since both TOPS-10 and TOPS-20 Fortran compilers share the vast majority of</span><br><span>their sources, my first idea was to build the updated TOPS-10 Fortran</span><br><span>compiler from scratch with TOPS-20 sources from the latest TSU tape, but I</span><br><span>soon found it to be a too complex task because, among other things, some</span><br><span>TOPS-10-specific sources were missing. I would have had to use those from</span><br><span>some old field test tape available in the repository, but I was afraid that</span><br><span>the resulting compiler (if buildable at all) could have been a weird</span><br><span>bug-ridden hybrid. So I had to find a different route. Since I was there, I</span><br><span>also verified that TOPS-20 keys (which have always been available) do not</span><br><span>work with TOPS-10 products.</span><br><span></span><br><span>By observing the keys for other products I noticed that they are wildly</span><br><span>different in size and are usually pretty large, some are several hundred</span><br><span>blocks long, therefore I speculated that the encryption may have been just</span><br><span>some simple XOR of keys and sources. This means that XORing any cleartext</span><br><span>file with its corresponding encrypted version yields the key.</span><br><span></span><br><span>Since I could not directly recover the key for the patched compiler binaries</span><br><span>because I didn't have a suitable cleartext copy of any encrypted binary, I</span><br><span>had to follow a more circuitous route.</span><br><span></span><br><span>The solution comes from the fact that, as I said above, TOPS-10 and TOPS-20</span><br><span>Fortran compilers share the vast majority of their source files, which also</span><br><span>happen to be among the largest of the whole Fortran distribution. Also, most</span><br><span>important, the updated runtime sources come with their respective compiled</span><br><span>counterparts, i.e. REL files. Finally, runtime binary modules are contained</span><br><span>in the runtime sources saveset, whereas the resulting library is contained</span><br><span>in the binaries saveset.</span><br><span></span><br><span>So, here is a summary of the required steps.</span><br><span></span><br><span>1. First of all, on TOPS-20, restore the TOPS-20 Fortran V11 runtime key,</span><br><span>namely FORLIB.KEY, from the product distribution tape BB-4157J-BM.</span><br><span></span><br><span>2. Then, still on TOPS-20, restore the largest updated source of the Fortran</span><br><span>V11 runtime and the decryption tool, namely FOROPN.MAC and DCRYPT.EXE, from</span><br><span>TSU tape 04 (volume 1 of 2) BB-PENEA-BM.</span><br><span></span><br><span>3. Then, again on TOPS-20, use DCRYPT to obtain a plaintext version of</span><br><span>FOROPN.MAC, and call it e.g. FOROPN.T20.</span><br><span></span><br><span>4. Finally, transfer FOROPN.T20 to TOPS-10. If you do not have a working</span><br><span>DECnet network available you could use a tape image. The standard TOPS-20</span><br><span>backup program, DUMPER.EXE, could write (and read) TOPS-10 BACKUP tapes when</span><br><span>instructed to do so with the INTERCHANGE command. Note that the same</span><br><span>INTERCHANGE command in TOPS-10 BACKUP.EXE has another (unrelated) meaning.</span><br><span></span><br><span>5. Now on TOPS-10, restore the original (unpatched) TOPS-10 Fortran V11</span><br><span>runtime files from the truncated tape BB-D480G-SB. In fact they are in the</span><br><span>fourth saveset, i.e. the last readable one. Then, in the same directory,</span><br><span>restore the updated Fortran runtime files from TSU tape 04 (volume 3 of 3)</span><br><span>BB-PBDED-BB. The directory on tape is DSKB:[10,7,FTNOTS]. Several old files</span><br><span>will be overwritten with new patched and encrypted updated copies.</span><br><span></span><br><span>6. Restore tools APUTIL.EXE and DCRYPT.EXE from TSU tape 04 (volume 1 of 3)</span><br><span>BB-BT99V-BB. APUTIL and DCRYPT do basically the same thing, but APUTIL is</span><br><span>list-driven and could verify checksums, whereas DCRYPT does just one file at</span><br><span>a time and does not perform any check.</span><br><span></span><br><span>7. Then restore (or make available) the FOROPN.T20 file created on TOPS-20</span><br><span>and "misuse" DCRYPT to obtain the runtime key. Since the encryption is a</span><br><span>simple XOR and DCRYPT luckily does not distinguish among encrypted, plain,</span><br><span>and key files, just feed it with FOROPN.MAC (which is encrypted as it came</span><br><span>from the TOPS-10 TSU tape) when it asks for some encrypted file, and</span><br><span>FOROPN.T20 when it asks for a key. Call the resulting file FTNOTS.KEY.</span><br><span></span><br><span>|.r [,,tsu]dcrypt</span><br><span>| </span><br><span>| [DCRYPT version 1(3)]</span><br><span>| Dcrypt>decrypt foropn.mac foropn.t20 ftnots.key</span><br><span>| Decrypting DSK:FOROPN.MAC</span><br><span>| with DSK:FOROPN.T20</span><br><span>| calling it DSK:FTNOTS.KEY ...[OK]</span><br><span>|</span><br><span>| Dcrypt></span><br><span></span><br><span>8. Now, with our new key, we can use APUTIL to decrypt every runtime file.</span><br><span>APUTIL reads file names from a VFY file and is able to distinguish between</span><br><span>encrypted and non-encrypted files. Therefore in decrypt mode it will only</span><br><span>work on encrypted files, whereas in verify mode it will work on all files.</span><br><span>If the VFY file and the KEY file have the same name, it's all automatic.</span><br><span></span><br><span>| .r [,,tsu]aputil</span><br><span>| </span><br><span>| APUTIL>read ftnots.vfy</span><br><span>| [Reading DSKB:FTNOTS.VFY[1,2,FTNOTS]]</span><br><span>| APUTIL>decrypt</span><br><span>| [Decrypting DSKB:[1,2,FTNOTS] using key file DSKB:FTNOTS.KEY[1,2,FTNOTS]]</span><br><span>| B10FRS.CTL has been decrypted</span><br><span>| FDDT.MAC has been decrypted</span><br><span>| FORCHR.MAC has been decrypted</span><br><span>| . . .</span><br><span>| MTHDUM.REL has been decrypted</span><br><span>| MTHPRM.UNV has been decrypted</span><br><span>| FORDDT.REL has been decrypted</span><br><span>| [Decrypted 25 of 94 files, 0 errors, 0 checksum errors]</span><br><span>| APUTIL>verify</span><br><span>| [Verifying DSKB:[1,2,FTNOTS]]</span><br><span>| B10FDT.CTL has been verified</span><br><span>| B10FRS.CTL has been verified</span><br><span>| F10LIB.CCL has been verified</span><br><span>| . . .</span><br><span>| MTHTRP.MAC has been verified</span><br><span>| MTHTRP.REL has been verified</span><br><span>| FORDDT.REL has been verified</span><br><span>| [Successfully verified 94 of 94 files, 0 errors, 0 checksum errors]</span><br><span>| APUTIL></span><br><span></span><br><span>9. At this point we are ready to create our updated runtime library. Run</span><br><span>MAKLIB and feed it with F10LIB.CCL. This will create a new and updated</span><br><span>FORLIB.REL in the current directory, which will be the picklock to recover</span><br><span>the compiler binaries key. Let's rename it to something like FORLIB.NEW.</span><br><span></span><br><span>| .r maklib</span><br><span>| </span><br><span>| *@f10lib.ccl</span><br><span>| </span><br><span>| *^Z</span><br><span>| </span><br><span>| .rename forlib.new=forlib.rel</span><br><span>| Files renamed:</span><br><span>| DSKB:FORLIB.REL</span><br><span></span><br><span>10. Now, in another directory, restore the updated and encrypted compiler</span><br><span>binary files from TSU tape 04 (volume 3 of 3) BB-PBDED-BB. The directory on</span><br><span>tape is DSKB:[10,7,FTNSYS]. Copy to the same directory FORLIB.NEW from the</span><br><span>previous step and feed it to DCRYPT.EXE together with FORLIB.REL (encrypted,</span><br><span>coming from the TSU tape) to obtain FTNSYS.KEY in the same way as above.</span><br><span></span><br><span>11. Now run APUTIL to decrypt and verify the binary compiler files, that is</span><br><span>our final target.</span><br><span></span><br><span>| APUTIL>read ftnsys.vfy</span><br><span>| [Reading DSKB:FTNSYS.VFY[1,2,FTNSYS]]</span><br><span>| APUTIL>decrypt</span><br><span>| [Decrypting DSKB:[1,2,FTNSYS] using key file DSKB:FTNSYS.KEY[1,2,FTNSYS]]</span><br><span>| FORDDT.REL has been decrypted</span><br><span>| FORLIB.REL has been decrypted</span><br><span>| FORO11.EXE has been decrypted</span><br><span>| FORTB.EXE has been decrypted</span><br><span>| FORTC.EXE has been decrypted</span><br><span>| FORTD.EXE has been decrypted</span><br><span>| FORTE.EXE has been decrypted</span><br><span>| FORTF.EXE has been decrypted</span><br><span>| FORTG.EXE has been decrypted</span><br><span>| FORTRA.EXE has been decrypted</span><br><span>| [Decrypted 10 of 10 files, 0 errors, 0 checksum errors]</span><br><span>| APUTIL>verify</span><br><span>| [Verifying DSKB:[1,2,FTNSYS]]</span><br><span>| FORDDT.REL has been verified</span><br><span>| FORLIB.REL has been verified</span><br><span>| FORO11.EXE has been verified</span><br><span>| FORTB.EXE has been verified</span><br><span>| FORTC.EXE has been verified</span><br><span>| FORTD.EXE has been verified</span><br><span>| FORTE.EXE has been verified</span><br><span>| FORTF.EXE has been verified</span><br><span>| FORTG.EXE has been verified</span><br><span>| FORTRA.EXE has been verified</span><br><span>| [Successfully verified 10 of 10 files, 0 errors, 0 checksum errors]</span><br><span>| APUTIL></span><br><span></span><br><span>:)</span><br><span></span><br><span>The same trick, but with REVHST.MAC instead of FOROPN.MAC, could be used to</span><br><span>recover the compiler sources key, although it will not decrypt a couple of</span><br><span>files because they are longer than REVHST.MAC and some other unpatched files</span><br><span>will not pass the checksum verification because the originals are missing</span><br><span>(they were stored in the unreadable section of the product distribution</span><br><span>tape) and those from the field test tape I had to use are different. At the</span><br><span>moment I have no fresh data at hand, but if my notes are correct it worked</span><br><span>for 253 out of 258 files, i.e. only 5 files didn't pass the checksum test,</span><br><span>and of those only 2 are actual source files.</span><br><span></span><br><span>I hope you'll find all of this useful and amusing as much as I did, :)</span><br><span>G.</span><br><span></span><br></div></blockquote></body></html>