Chapter Seven -- Writing Hardware Algorithm
Developers may define their own algorithms and securely store them inside Rockey4ND. The dongle may then be used to calculate a result, and the result used by the application. Since the Rockey4ND’s User Algorithm Zone (UAZ) is unreadable, even by the manufacturer, this type of software protection is potentially very powerful. Developers may use either the Rockey4ND editor or the RY_WRITE_ARITHMETIC function to write algorithms to the dongle. 1.Rockey4ND User Defined Algorithm Introduction 1.1) Instruction Format All instructions must be of the form: reg1 = reg2 op reg3/value reg1, reg2 and reg3 are registers, value is a figure, op is an operator. For example: A = A + B Rockey4ND supports the following operations:
+ | Addition
- | Subtraction
< | Cyclic left shift
* | Multiplication
^ | XOR
& | And
| | Or
? | Compare
value, it only is a decimal figure between 0 and 63. Note: “?” operator is for comparison, for example, C = A ? B, the results are listed below:
C | A?B | B?A
A<B | 0 | FFFF
A=B | FFFF | FFFF
A>B | FFFF | 0
It will write either “0xFFFF” or “0” to parameter C according to the table above. First let us have a look at the algorithm example we will write to Rockey4ND: A= A+B, B = B + E, C = A * F, D = B + C, H = H ^ H A, B, C… are registers in Rockey4ND. There are a total of eight 16-bit registers in Rockey4ND and they are designed: A, B, C, D, E, F, G and H. 1.2)Internal Algorithms & Application Interface FEITIAN offers 3 calculation functions to call the user-defined algorithms: RY_CALCULATE1, RY_CALCULATE2, RY_CALCULATE3 These three functions are structurally similar. Data is passed and received by way of the memory addresses p1, p2, p3, and p4. When passing data to registers: Register A = p1 Register B = p2 Register C = p3 Register D = p4 Register variables vary according to the calculation type: Register E Register F Register G Register H When receiving data from registers: p1 = Register A p2 = Register B p3 = Register C p4 = Register D Register A, B, C and D are user interface variables, register E, F, G and H are internal variables. 1.3)Differences between the Three Functions p1, p2, p3 and p4 correspond to registers A, B, C and D in all three calculation functions. These registers are used nearly identically by the three calculation functions. The differences between the functions can be seen by reviewing the results written to registers E, F, G and H. When a developer’s Rockey4ND internal program is called, registers A, B, C and D will be populated with data from p1, p2, p3 and p4. The content of registers E, F, G and H will be initialized according to the calculation function in use. See below:
Variable | RY_CALCULATE1
A | P1
B | P2
C | P3
D | P4
E | HiWord of hardware ID
F | LoWord of hardware ID
G | Value stored in module *lp2
H | Random number
Variable | RY_CALCULATE2
A | P1
B | P2
C | P3
D | P4
E | Seed Result 1
F | Seed Result 2
G | Seed Result 3
H | Seed Result 4
Variable | RY_CALCULATE3
A | P1
B | P2
C | P3
D | P4
E | Value in module *lp2
F | Value in module (*lp2 + 1)
G | Value in module (*lp2 + 2)
H | Value in module (*lp2 + 3)
1.4)API Interface of the User’s Applications Below is the definition and description of the three calculation functions.
Function | RY_CALCULATE1 (Calculation 1)
Objective | Perform specified calculation
Input parameters | function = RY_CALCULATE1 *handle = Rockey4ND’s handle *lp1 = Start point of calculation *lp2 = Module number *p1 = Input value 1 *p2 = Input value 2 *p3 = Input value 3 *p4 = Input value 4
Return value | A return value = “0” indicates that the function worked correctly. Any other return value indicates an error. When success, *p1 = Return value 1 *p2 = Return value 2 *p3 = Return value 3 *p4 = Return value 4
Note | If the internal algorithm is A = B + C, then the call result is *p1 = *p2 + *p3. For example: The internal algorithm is A = A + G, if *p1 = 0, then when returning you may guess the content of module *p1 = *lp2. Though you cannot read the content of modules directly, you may determine the content by algorithm. If possible, you had better check the content with an algorithm, not only compare in the program.
Function | RY_CALCULATE2 (Calculation 2)
Objective | Perform specified calculation
Input parameter | function = RY_CALCULATE2 *handle = Rockey4ND's handle *lp1 = Start point of calculation *lp2 = Seed Code *p1 = Input value 1 *p2 = Input value 2 *p3 = Input value 3 *p4 = Input value 4
Return value | A return value = “0” indicates that the function worked correctly. Any other return value indicates an error. When success, *p1 = Return value 1 *p2 = Return value 2 *p3 = Return value 3 *p4 = Return value 4
Note | When performing calculation 2, the initial values of register E, F, G and H are the return values of seed code *lp2, to make it simple, Rockey4ND calls function RY_SEED with seed code *lp2, and writes the return values to register E, F, G and H for next operation.
Function | RY_CALCULATE3 (Calculation 3)
Objective | Perform specified calculation
Input parameter | function = RY_CALCULATE3 *handle = Rockey4ND's handle *lp1 = Start point of calculation *lp2 = Module number *p1 = Input value 1 *p2 = Input value 2 *p3 = Input value 3 *p4 = Input value 4
Return value | A return value = “0” indicates that the function worked correctly. Any other return value indicates an error. When success, *p1 = Return value 1 *p2 = Return value 2 *p3 = Return value 3 *p4 = Return value 4
Note | When performing calculation 3, the initial values of register E, F, G and H are the content of module *lp2 and *lp2+1/2/3, for example: When calls calculation 3 with *lp2 = 0, the initial values of register E, F, G and H are: E = Content of module 0 F = Content of module 1 G = Content of module 2 F = Content of module 3 Note: The address will return to “0” when the module address call exceeds 15. For example: Calculation 3 with *lp2 = 14, the initial values of register E, F, G and H are: E = Content of module 14 F = Content of module 15 G = Content of module 0 H = Content of module 1
2.Writing User Defined Algorithms into Rockey4ND 2.1)Writing Algorithm Developers may use the RY_WRITE_ARITHMETIC to write algorithms to the Rockey4ND User Algorithm Zone (UAZ). The Rockey4ND editor is another option for writing algorithms to the UAZ.
Function | RY_WRITE_ARITHMETIC (Write algorithm)
Objective | Write user defined algorithm to Rockey4ND
Input parameter | function = RY_WRITE_ARITHMETIC *handle = Rockey4ND’s handle *p1 = Start point of calculation *buffer = Instruction string
Return | A return value = “0” indicates that the function worked correctly. Any other return value indicates an error.
For example: strcpy(buffer, "A=A+E, A=A+F, A=A+G, A=A+H"); p1 = 3; retcode = Rockey(RY_WRITE_ARITHMETIC, handle, &lp1, &lp2, &p1, &p2, &p3, &p4, buffer); The “buffer” is the place for you to temporarily store the algorithm. One instruction is separated from another by a ",". Rockey4ND will automatically assign the first instruction in the algorithm, “Start” and the last instruction, “End”. Taking this program as an example: Address 3 in Algorithm Zone: A=A+E Address 4 in Algorithm Zone: A=A+F Address 5 in Algorithm Zone: A=A+G Address 6 in Algorithm Zone: A=A+H Then 3 is the starting point of the algorithm in the User Algorithm Zone (UAZ). 6 is the end point. ROCKEY4ND will return to the user application after performing the instruction in address 6. The users must call the program in the dongles from the starting point of the algorithm. Otherwise the results are 4 random numbers. 2.2)Instruction Conventions There are some conventions when developers write algorithm instructions:
A = A + B | Valid instruction
D = D ^ D | Valid instruction
A = B | Invalid instruction, "A = B | B" would be correct.
A = 0 | Invalid instruction, "A = A ^ A" would be correct
C = 3 * B | Invalid instruction, "C = B * 3" would be correct
D = 3 + 4 | Invalid instruction, there can not be two constants
A = A / B | Invalid instruction, Rockey4ND does not support division operator
H = E*200 | Invalid instruction, constant must be less than 64
A = A*63 | If it is the first or last instruction it is an invalid instruction(Using constants are not allowed),otherwise valid.
3.Note Rockey4ND has as many as 128 instructions. Developers do not need to consider the start and end attributes of an algorithm. Rockey4ND will automatically assign a Start/End attribute to the instructions. In practice this means that if the developer writes a two-instruction algorithm to the User Algorithm Zone (UAZ), and then a three instruction algorithm, the result will not be a single five instruction algorithm. Algorithms that begin with “Null” or “E” will produce unpredictable results. 4.Tips 4.1) Make randomized calls to the Rockey4ND API - Randomly scatter calls to the Rockey4ND API from within your application. Calls made to the API from time-to-time will make it very difficult to mimic the behavior of the protection method or hack the application. 4.2) Use dynamic information with the seed code function -The use of dynamic information with the seed code function, such as system date, makes the protection method stronger because the results can change with the input and calculation. 4.3) Do not repeatedly use the same protection method in your application -If you use the same protection method several times in your application it will be easier for the cracker to find the rule and crack your application. Protection methods that are complex and rely on a number of different checks and calculations are the most difficult to crack. 4.4) Encrypt the character string and data – In “Step 18” of “Chapter Six -- API Application Examples", we showed an encryption method using information stored inside the dongle. Encrypting a character string in the manner described is a strong method because a failure to properly decrypt the string can cause the application to terminate or take other actions in accordance with the licensing agreement. 4.5) Use API encryption and Envelope encryption together – The strongest protection method will have the developer first using a complex and dynamic implementation of the Rockey4ND API, and then protecting this new file with the Rockey4ND Envelope. Please keep the end user environment in mind when you design the software protection solution. You should flexibly adopt the methods suggested here within the limitations and objectives of your environment and licensing policy.
Copyright (C) 2007-2009 Feitian Technologies Co.,Ltd. All rights reserved. Last Updated: Agu 5, 2009