Ghosts in ROM

An old computer sometimes keeps completely unexpected secrets. The guys from the NYResistor site published the story of how they heroically rebuilt several digital photographs from the flash memory of the prehistoric Macintosh SE computer, which was lying on the side of the road in Brooklyn. They called the unknown people in these images “ghosts in ROM”.

Found on the side of the road, the Macintosh SE was loaded onto a bicycle trunk and brought home.


')
The computer booted, but did not contain any storage media. However, the researchers decided to take up digital archeology. They removed two ROM chips from the motherboard and dumped them using the PROMdate device.



ROM chips are similar to M27C512 PROM programmable flash memory chips, but only here they are not programmable, so there is no corresponding contact, and the ROM address space is increased to 128 KB, compared to the usual 64 KB in a programmable M27C512.

The computer runs on a 16-bit bus, and each of the two 8-bit chips contains half a word, so that together they merge into a single 256-kilobyte binary file. The dumping and merging operation was successful: the search for strings produced a readable text like “Chicago“, “PACK” and “CDEF”. If the bytes after the merge were in the wrong order, it would be something like APKC instead of PACK.

The researchers decided to try to find the same Easter egg with secret photos of the creators of Apple, although no one has yet been able to extract these digital files.

Instructions for the Easter egg states that the images are hidden starting at address 0x41D89A. The researchers were able to boot from the historical ROM in the Mini vMac emulator and confirm that there is something there. But they wanted to remove specific photos and search for other secrets that may be hiding in the ROM.

The binary ROM file was converted to ELF format and studied a fragment in the region of 0x41D89A.

  41d89a: 4eba 0018 jsr% pc @ (41d8b4 <rom + 0x1d8b4>)
   41d89e: 5847 addqw # 4,% d7
   41d8a0: 0287 0000 000c andil # 12,% d7
   41d8a6: 6100 002e bsrw 41d8d6 <rom + 0x1d8d6>
   41d8aa: 307c 00b5 moveaw # 181,% a0
   41d8ae: a03b 0120073
   41d8b0: 4efa ffec jmp% pc @ (41d89e <rom + 0x1d89e>) 

Instruction 0xa03b clearly looks suspicious, because Motorola has reserved all instructions on 0xA for the Motorola 68000 processor. Here comes the list of instructions for the Motorola 68000, from which it is clear that a03b corresponds to _Delay with an indication of the delay value in %a0 . That is, this function can be translated into C like this:

 void easter_egg(void) { func_41d8b4(); while (1) { d7 = (d7 + 4) & 0xC; func_0x41d8d6(); _Delay(181); } } 

This function refers to 0x41d8b4:

  41d8b4: 31fc ffff 0b9e movew # -1, b9e
   41d8ba: 594f subqw # 4,% sp
   41d8bc: 2f3c 6262 6d63 movel # 1650617699,% sp @ -
   41d8c2: 4267 clrw% sp @ -
   41d8c4: a9a0 0124640
   41d8c6: 201f movel% sp @ +,% d0
   41d8c8: 6700 0050 beqw 41d91a <rom + 0x1d91a>
   41d8cc: 2040 moveal% d0,% a0
   41d8ce: 21d0 0a78 movel% a0 @, a78
   41d8d2: 7e00 moveq # 0,% d7
   41d8d4: 4e75 rts
 ...
   41d91a: a9ff 0124777 

There is a link to _GetResource (0x62626d63) and the execution of the program clearly begins. After considerable work on reverse engineering, the specialists were still able to restore the structure and detect the data in the PackBits format. Applying the PackBits unpacking utility, as well as the hex2png utility, these bits were arranged in rows of 536 pixels — and people's faces appeared on the screen for the first time.

Four photos of unknown Apple employees dated in ROM are dated November 20, 1986.









NYResistor hackers are asked to report if someone found out these people from a photo 25 years ago to solve the puzzle to the end.

By the way, another fifth data area was found in ROM, but so far it has not been able to decrypt it. Perhaps this is an audio recording.