Crack SimpleAvr's clock easter egg

[bluehash 1,581]

So SimpleAvr has released the .elf of his new clock code, but not the actual source.

He says he would only release it if someone finds the easter egg in his binary file. So disassemble away.

 

Posting this so that this gets more exposure:

SimpleAvr's Post : http://www.simpleavr.com/msp430-projects/3p4w-clock

43oh Post: http://www.43oh.com/2010/08/an-msp430-based-clock/

[simpleavr 399]

the easter egg was just a fun way to occupied excessive flash spaces, we all like challenges, don't we?

 

i've updated the page to introduce different approaches one can use to locate the egg. anyway the code will be released later regardless. the code base was from my older (but not published) avr 3PNW clock. i had so much difficulty to code in the tiny2313's 2K code space back then. and now when i tried it on the MSP430 16bit, I got room for temperature adc reads and still more room to put in a sizable easter egg.

 

very impressive little MCU it is, the 430G2231. can't wait to play w/ the 20 pin version.

[hvontres 22]

Hi,

I have been trying to crack the egg, but I have not had much luck yet. I attached a callgraph generated by msp430static to help others find the egg

[bluehash 1,581]

Oh Sweet. This is what he sent me via email, if its helpful:

 

...regarding the easter egg, it is just a fun way to use the left-over flash space (also a good timer usage example).

you can use mspdebug to load the firmware (w/o launchpad) and step run the code (the hard way).

or

you can use msp430-objdump w/ the elf file to do something (big hint here).

[simpleavr 399]

there ain't much subroutines in the code, this was not intended to obfuscate the code and hide the egg, it's just more efficient in the 2k program space in do everything in a big main()

 

the seg2port() translates digits to port output values for display, which has nothing to do w/ the egg.

 

another hint for those who are persistence. the egg function require the use of timera comparor in output pin toggle mode.

 

i.e. look for

 

CCTL0 = OUTMOD_4 (in assembly, machine code)

 

may be you could already guess what the egg function does (and how to activate / connect it).

[simpleavr 399]

for those who are still interested in this project.

 

i got a source code request from an instructable member. and i had updated my project page w/ source code. the source code has the easter egg stripped out though, in case there is still people who want to investigate the hidden egg.

 

http://www.simpleavr.com/msp430-projects/3p4w-clock

 

the code is kind of not tidy / structured, as most optimization strategy i used does not allow for that.

 

any comments / critics are welcomed.

[bluehash 1,581]

Thanks for letting us know! I'll update the blog post with this.

[jbremnant 17]

Here, maybe I can contribute something on this thread to initiate some discussions regarding the easter egg.

I compiled the stripped code and compared the symbol dump of the resulting .elf against the .elf that contains the easter egg.

The 2 functions jump out right off the bat: tune, tune_map.

 

$ msp430-objdump -t 3p4w-clock.elf > 1.txt
$ msp430-objdump -t 3p4w-clock_easter.elf > 2.txt
$ diff -y 1.txt 2.txt
...
2c2
< 3p4w-clock_ester.elf:     file format elf32-msp430
---
> 3p4w-clock.elf:     file format elf32-msp430
70,78c70,76
< 0000ff9e l     O .text        0000000c factor.1382
< 0000ff50 l     O .text        0000004e digit2ports
< 0000ff4a l     O .text        00000006 menu_attrs.1475
< 0000feec l     O .text        00000018 menu_desc
< 0000ff04 l     O .text        0000002a tune
< 0000ff2e l     O .text        00000014 tune_map
< 0000020c l     O .bss 00000001 pos.1537
< 0000ff42 l     O .text        00000004 digit_map2.1539
< 0000ff46 l     O .text        00000004 digit_map1.1538
---
> 0000feb4 l     O .text        0000000c factor.1382
> 0000fe66 l     O .text        0000004e digit2ports
> 0000fe60 l     O .text        00000006 menu_attrs.1432
> 0000fe40 l     O .text        00000018 menu_desc
> 0000020c l     O .bss 00000001 pos.1487
> 0000fe58 l     O .text        00000004 digit_map2.1489
> 0000fe5c l     O .text        00000004 digit_map1.1488
80c78
< 0000fee4 g     F .text        00000008 ADC10_ISR
---
> 0000fe38 g     F .text        00000008 ADC10_ISR
...

 

Here's the assembly code for those two functions. Perhaps someone more knowledgeable with assembly can decipher this.

These functions, tune, tune_map start at offsets 0x0000ff04 and 0x0000ff2e, respectively.

 

$ msp430-objdump -D 3p4w-clock_easter.elf | less

0000ff04 :
   ff04:       52 56 52 56     add.b   22098(r6),r2    ;0x5652(r6)
   ff08:       52 96 5a 62     cmp.b   25178(r6),r2    ;0x625a(r6)
   ff0c:       9d 02           .word   0x029d; ????    
   ff0e:       92 82 9e 95     sub     &0x959e,&0x8202 
   ff12:       02 82 
   ff14:       72 96           cmp.b   @r6+,   r2      
   ff16:       61 02           .word   0x0261; ????    
   ff18:       82 52 56 52     add     r2,     &0x5256 
   ff1c:       56 52 96 5a     add.b   &0x5a96,r6      
   ff20:       62 9d           cmp.b   @r13,   r2      
   ff22:       02 92           cmp     r2,     r2      
   ff24:       82 9e 95 02     cmp     r14,    &0x0295 
   ff28:       82 62 96 9d     addc    r2,     &0x9d96 
   ff2c:       01 00           .word   0x0001; ????    

0000ff2e :
   ff2e:       0f f1           and     r1,     r15     
   ff30:       22 23           jnz     $-442           ;abs 0xfd76
   ff32:       22 33           jn      $-442           ;abs 0xfd78
   ff34:       33 34           jge     $+104           ;abs 0xff9c
   ff36:       44 45           mov.b   r5,     r4      
   ff38:       55 56 66 77     add.b   30566(r6),r5    ;0x7766(r6)
   ff3c:       88 99 9a bb     cmp     r9,     -17510(r8);0xbb9a(r8)
   ff40:       cd ee 40 00     xor.b   r14,    64(r13) ;0x0040(r13)

 

An opportunity to learn the instruction set for msp430!

I'll look forward to hearing some insights from folks on this forum.

[simpleavr 399]

sorry for the very delayed reply. been busy and had missed a week or so checking the forums and your new posts escape my radar screen (got flooded by others, i think, i usually just check "recent posts"). guess i didn't subscribe to this particular post.

 

you are correct, the secret egg is an in-built pwm like tune player. it's my little way to make use of the left over program space and have fun (hopefully also for others). it is activated by re-positioning the buzzer from P1.4,P1.3 to P1.1,P1.3. it will be automatically detected and starts playing 'Fur Elise'.

 

in hindsight i should have name "tune" as "easter_egg" and "tune_map" as "easter_egg_map".

 

thanks jbremnant and all other friends for taking the time to study my project.

 

@jbremnamt if you had built the project, u got to make a video and "uncover" it.

 

if not, i will do the honor and create an egg breaking video + update my project page (may be in a week or so).

 

again, apologies for missing this important post.

[jbremnant 17]

@simpleavr I haven't built the project since I didn't have the led segment display. However, It would be trivial to upload the code and stick the piezo to the right pins to see what it does.

 

No worries about missing this post, I've also been busy with work and kids.

[simpleavr 399]

i've put up the original source on my project page, if anyone is interested.

 

http://www.simpleavr.com/msp430-projects/3p4w-clock

 

also a short video showing how to enable the "egg" tune player.

 

 

you will also see added parts (PCF8563 RTC, diode and capacitor for backup) on the video. i am quite happy w/ this addition, before the breadboard was too bland (too few parts). i am making new firmware to use the RTC properly (calender, alarm, etc), will post it when done.

thanks.

[GeekDoc 226]

i am making new firmware to use the RTC properly (calender, alarm, etc), will post it when done.

Sounds like a PotM entry!

[simpleavr 399]

i am making new firmware to use the RTC properly (calender, alarm, etc), will post it when done.

Sounds like a PotM entry!

 

yeah, as long as you continue to supply launchpads to the contests.

 

december entry, 3p4w clock + 4p4w rtc = 7p8w clock

[jbremnant 17]

@simpleavr

Nice! I checked out the video for the clock.

And thanks for the mention on your blog. Much appreciated.

Do you mind me linking your blog from mine?

 

@GeekDoc/bluehash

I wouldn't mind donating 1 launchpad for the next project for the month.

[bluehash 1,581]

@GeekDoc/bluehash

I wouldn't mind donating 1 launchpad for the next project for the month.

That will be sweet! If your sure to go ahead, PM me.