Harry Sintonen<p><a href="https://infosec.exchange/tags/Amiga" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Amiga</span></a> world first: Executing code in hardware color registers!</p><p>In 1992 <a href="https://infosec.exchange/tags/Commodore" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Commodore</span></a> Amiga AGA chipset introduced a new control bit RDRAM to BPLCON2 hardware register. The bit specification says “Causes color table address to read the color table instead of writing to it”. Even before I got my <a href="https://infosec.exchange/tags/A1200" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>A1200</span></a> in 1995 I wondered if I could perhaps store code in the color registers and outright jump to the register address to execute it. Back in the day the problem I ran into was that unfortunately the registers only store the lowest 12-bits and bit 15 of the written values – the other upper bits are all 0. Considering the 68k instruction set, this severely limits the possible instructions that can be used: for example there is no way to affect the control flow (branch or return from subroutine).</p><p>Last evening while participating to Amiga cracking Twitch stream by <span class="h-card" translate="no"><a href="https://mas.to/@h0ffman" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>h0ffman</span></a></span> I remembered this hack and the problems I ran into, and had an epiphany: I could trigger an exception to exit the code flow. I just need to find an opcode that I can present with only lower 12-bits to trigger an exception. As a solution, 16-bit word 0x0fff causes an illegal instruction vector (number 4) to be taken, from which I can then reroute the execution safely back to outside of the color registers.</p><p>The actual implementation was only 15 min hack job. The only hitch is that unfortunately the venerable UAE emulator does not play ball at all, and outright hangs when the code execution in color registers is attempted. However, I correctly guessed that this was an omission in the emulation rather than actual issue in my design. This was proven by <span class="h-card" translate="no"><a href="https://mastodontti.fi/@pyksy" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>pyksy</span></a></span> successfully executing the test program on his actual <a href="https://infosec.exchange/tags/Amiga1200" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Amiga1200</span></a> with the expected results (see the photo).</p><p>“But for the love of all that’s holy, why!?”, I hear you cry. Because <a href="https://infosec.exchange/tags/hacking" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>hacking</span></a> and <a href="https://infosec.exchange/tags/retrocomputers" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>retrocomputers</span></a> are cool, that’s why. Also it’s quite neat to get definite confirmation for a theory you first thought about nearly 30 years ago.</p><p>• Amiga Hardware Reference Manual: <a href="http://amigadev.elowar.com/read/ADCD_2.1/Hardware_Manual_guide/node0000.html" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">http://</span><span class="ellipsis">amigadev.elowar.com/read/ADCD_</span><span class="invisible">2.1/Hardware_Manual_guide/node0000.html</span></a><br>• BPLCON2: <a href="http://amiga-dev.wikidot.com/hardware:bplcon2" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">http://</span><span class="ellipsis">amiga-dev.wikidot.com/hardware</span><span class="invisible">:bplcon2</span></a><br>• Motorola M68000 Family Programmer’s Reference Manual: <a href="https://www.nxp.com/docs/en/reference-manual/M68000PRM.pdf" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">nxp.com/docs/en/reference-manu</span><span class="invisible">al/M68000PRM.pdf</span></a><br>• Hack source code: <a href="https://sintonen.fi/src/colexec/colexec.asm" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">sintonen.fi/src/colexec/colexe</span><span class="invisible">c.asm</span></a><br>• Amiga Cracking by Hoffman: <a href="https://www.youtube.com/playlist?list=PLFL-EKU6hI3oPINUeXchGYHCc_t-GnsZ5" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">youtube.com/playlist?list=PLFL</span><span class="invisible">-EKU6hI3oPINUeXchGYHCc_t-GnsZ5</span></a><br><a href="https://infosec.exchange/tags/retrocomputing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>retrocomputing</span></a> <a href="https://infosec.exchange/tags/hack" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>hack</span></a></p>