Undocumented Features of Devices and Software

Undocumented features (undocumented features), UDF — capabilities of technical devices and/or software that are not reflected in the documentation. Most often, undocumented features are deliberately built in by developers for the purposes of testing, further extension of functionality, ensuring compatibility, or for the purposes of covert control over the user. In addition, undocumented features can result from side effects (most often in transitional modes or when switching modes) that were not accounted for by the developers. Undocumented features should be distinguished from capabilities of a system that are hidden from the end consumer but are described in the official service documentation. Undocumented features are usually discovered during the process of reverse engineering, but they can also be found by accident. A special case of undocumented features is undocumented functions.

In cases where the manufacturer bears responsibility for the product's operability or undertakes to provide technical support for it, the corresponding obligations usually extend only to what is described in the accompanying documentation. This may be linked to yet another motive for not mentioning certain useful functions in the documentation. In particular, it makes it possible to remove them in subsequent versions of the product without warning users about it. This carries certain risks for users who rely on undocumented features .

Of particular interest, especially in the case of software, are undocumented features that may jeopardize the correct operation, integrity, and confidentiality — in other words, the security — of a software or information system. In this context, the term vulnerability is usually used (translation of vulnerability) (in professional computer jargon also «hole»), and some official documents introduce the concepts of «undeclared capabilities» and «unstated capabilities» (see the section «Undeclared capabilities (information security)»).

Undocumented features in various fields

In machines and mechanisms

Undocumented features in machines and mechanisms are encountered relatively rarely, since implementing a given additional function requires the use of additional components, whose purpose and operating logic are relatively easy to understand. Nevertheless, in the case of multi-link mechanisms with several degrees of freedom, an insufficiently complete implementation of the kinematics of individual machine units can lead to side effects that open up capabilities not envisioned by the developers, for example:

• In complex-zigzag sewing machines produced by the Podolsk plant, a design feature in the implementation of the cam-and-copy unit made it possible to produce a dashed stitch not envisioned by the machine's designers, when the zigzag selector switch was set to an intermediate, non-working position. This capability was accidentally discovered by one of the readers of the magazine «Rabotnitsa», about which she wrote a letter to the editorial office. After this note was published in the magazine, the study of undocumented features of sewing machines and their application became regular.
• In the rear lights of the Chevrolet Lacetti passenger car (the sedan-body variant), there are two brake-light sections each with lamps installed in them, of which only one (the upper) is connected to the car's onboard wiring; the lower brake-light section is not connected to anything, and the ends of its wire simply dangle. Thus, in the standard mode, when the brake pedal is pressed, only the upper brake-light section lights up. Simply by connecting the wires from the second (lower) section to the wires from the upper section, we get dual brake-light sections that light up when braking.
• In a number of variants of the 16K20 lathe, due to features of the feed gearbox implementation that were not described in the documentation, it became possible to cut threads with a non-standard pitch, which was widely used in the years of the USSR to make homemade locks and keys for them with a non-standard thread instead of a secret mechanism.
• Design features of the final drive of the «Zaporozhets» car allowed, during assembly of the unit, the differential case with the driven bevel gear to be flipped over, which caused a change in the direction of rotation of the axle shafts. This was widely used by builders of homemade cars who employed the ZAZ powertrain installed in the front of the vehicle. Sometimes this feature led to comical situations, when after repairing the car and engaging the forward gear it would drive backward.
• Old types of automatic transmissions have a separate planetary set for the overdrive gear («overdrive»), which is controlled independently of the main three- or four-speed set. Although the standard automatic transmission control systems engage overdrive only in combination with direct drive in the main planetary set, nothing prevents it from being used with other gears as well, which effectively doubles the total number of gears in the automatic transmission. This feature is sometimes used by car manufacturers, for example, by introducing into the transmission control an additional soft-start program (which is convenient in winter on a slippery road). The essence of this program is that the overdrive works in all gears, reducing the gear ratio and, consequently, the car's acceleration.
• The kinematic scheme of the five-speed A750 automatic transmission by Aisin is such that it can implement 7 forward gears and 3 reverse gears. However, in these additional modes the load on the clutches and brakes is too great, and car manufacturers do not use them. But car-tuning enthusiasts take advantage of this capability. Later, Aisin refined the design of this automatic transmission, implementing 6 forward gears in it.

In mechanical cameras

• The «Zenit» camera did not provide automatic long exposures. However, features in the implementation of the self-timer mechanism resulted in the fact that when the shutter was set to the «B» mode, the self-timer could produce long exposures (up to 9 seconds). Interestingly, the instruction manual gave no information whatsoever about the combination of the «B» mode and the self-timer.
• In the «FED-3» cameras, a similar combination made it possible to obtain an exposure of about 4—4.5 seconds.

In non-digital electronic equipment

• In many all-wave radio receivers (practically all receivers built on miniature tubes) produced in the USSR, switching bands in the shortwave region was carried out by using a mechanical switch that connected, in parallel with the local oscillator's tuned circuit, groups of frequency-lowering capacitors. In the intermediate positions of the switch, the additional capacitors were not connected, and the local oscillator frequency was determined only by the variable capacitor. In this case the local oscillator operated at an increased frequency. This feature made it possible to receive radio stations in the 19-, 16-, and 11-meter wavebands and to listen to «enemy voices». Reception was quite unstable but, nevertheless, allowed broadcasts to be heard. In the «Sakta» radio receiver, for this you had to press the SW1 and SW2 buttons simultaneously. In the «Rigonda» and its clones («Kantata», «Rapsodia», «Ural») this effect was achieved when switching from SW1 mode to SW2, if the SW1 button was held and smoothly released while pressing the SW2 button.
• Practically all inexpensive walkie-talkies operating at 27 MHz, in amplitude-modulation mode, could normally receive signals from walkie-talkies of the same band but operating with frequency modulation. This was due to the fact that the simplified intermediate-frequency filter, built on just a single tuned circuit, had sections of its frequency response with fairly good linearity and coped excellently with the function of a frequency discriminator not envisioned by the developers. It is also noteworthy that, because of the simplified implementation of the transmitting path of many such walkie-talkies, amplitude modulation was accompanied by a strong parasitic frequency deviation, which made it possible for the signal to be received by devices operating in frequency-modulation mode.
• Practically all pentodes and beam tetrodes can operate in triode connection (anode connected to the second grid), while exhibiting good linearity characteristics (often better than those of dedicated triodes), which is actively used by fans of tube sound. Although such a mode was not envisioned by the developers and, according to the governing technical materials (RTM) in force in the USSR, was — prohibited.
• Some old black-and-white videocassette recorders (for example, «Malakhit») can record a color image. This is possible if the chrominance signals fall within the operating frequency band of the video path. In that case they are recorded and played back not as in a color recorder, but directly, without spectrum shifting and other conversions. Also a necessary condition is the absence in the black-and-white VCR of filters that cut out the «unnecessary» chrominance signals from the composite video signal. Old devices did not have them, and filters began to be introduced only with the widespread adoption of color television broadcasting.

In digital technology

• A multitude of undocumented features was present in Soviet programmable microcalculators (see Eggogology).
• Almost all old-type intercoms contain microcontrollers with fairly limited computing resources and a relatively small amount of non-volatile memory, in which only part of the key's ROM code is stored. There is no separate cell-availability table, so the indicator that a memory cell is free and that a new key can be written into it is a state in which all bits are set to logical 1. Because of the simplified algorithm for verifying the iButton key's ROM code, a key in which the 6 bytes of the unique part of the ROM code consist entirely of ones will also be valid. Such a key will open, with equal success, doors equipped with intercoms of various types. This feature made it possible to create so-called «master keys». There can be no such keys among officially produced items, since the specified ROM code is not defined by the 1-Wire bus specification, but nevertheless it can be emulated using special chips. It was impossible to disable such an undocumented feature by standard means. The only thing that could be done was to fill the entire device memory with key ROM codes (including fictitious ones). Later, intercom manufacturers began to support this capability deliberately, providing means to disable it if necessary.

In software

For example, in Blitz BASIC there are functions such as Handle and Object (and several others), a description of which is not given in the official documentation. Their purpose and use were revealed by users .

Undocumented functions (for example, the ability to change the switch character in MS-DOS, usually to a hyphen) may be included to ensure compatibility (in this case with Unix utilities) or for future extension. However, if a software vendor changes its software development strategy in accordance with business requirements, the absence of documentation makes it easier to justify removing the function.

In new versions of software, old (possibly superseded) functions may not be mentioned in the documentation, but they must be implemented for users who have become accustomed to them.

In some cases, developers, as a joke or for convenience, call software bugs undocumented features. This term may have been popularized in some of Microsoft's responses to bug reports about its first product, Word for Windows, but it did not originate there. The oldest surviving mention on Usenet dates to March 5, 1984. Between 1969 and 1972, Sandy Mates, a systems programmer for PDP-8 software at Digital Equipment Corporation (DEC) in Maynard, Massachusetts, used the terms «bug» and «feature» in her test-result reports to distinguish undocumented behaviors of the shipped software products that were unacceptable and tolerable, respectively. This term may have survived to this day.

Undocumented features have themselves become an important feature of computer games. Developers often include in them various cheats and other special capabilities («Easter eggs») that are not explained in the packaging materials but become part of the «hype» around the game on the Internet and among gamers. Undocumented features of foreign games are often elements that have not been localized from the native language.

Closed-source APIs may also contain undocumented functions that are little known. Sometimes they are used to gain a commercial advantage over third-party software by providing the application vendor with additional information or improved performance.

Eggogology — the study of undocumented features of microcalculators.

The name first arose in the USSR and is jocular in nature. It presumably derives from the error message «EGGOG» (Error) that second-generation Soviet-made programmable microcalculators (Elektronika B3-34, MK-54, MK-56, MK-61, MK-52, MS 1104) displayed on their seven-segment indicators. The term first appeared in the magazine «Tekhnika — Molodyozhi» after a series of articles by M. Pukhov devoted to programming on microcalculators of the «Elektronika B3-34» series, and a series of nine stories about a fantastic journey from the Moon to the Earth under the general title «„Kon-Tiki“: the path to Earth». In this series, in addition to game programs, various undocumented features of microcalculators and video messages were described, many of which were obtained by manipulating the keys after the «EGGOG» error message appeared ().

Readers of the magazine responded with enormous enthusiasm to the account of the discovered undocumented features of microcalculators, began searching for new ones, and at the end of the «Kon-Tiki…» series a small section «Eggogology News» appeared. Using the undocumented techniques published in it, a multitude of new game programs was written, most of which simply could not have been created by standard means owing to the limited resources of the B3-34 family of calculators.

When the EGGOG signal appears during program computation, there are two undocumented ways to determine which operation caused the halt:

1. Pressing the ↑ key on the B3-34 (B↑ on the MK-61/52). If the indicator still shows EGGOG, then overflow has occurred, and if a number is shown — an invalid operation, of which this number is the «culprit».
2. Pressing the BP key. Possible indicator readings and the errors corresponding to them:
   • «EGGOG 00» — overflow (a «super-number» of the first «tier»)
   • «G.GGOG 00» — division by zero, computing the logarithm of zero, the power function 0⁰, an invalid operation with the K key.
   • «EG.GOG 00» — computing tan 90°.
   • «E.GGOG 00» — computing the arcsine or arccosine of a number greater than 1.
   • «EGGOG 00» (with the decimal point in the same place as in the argument) — a positive argument of the exponential function is greater than allowed
   • «−EGGOG 00» (with the decimal point in the same place as in the argument) — a negative argument of the exponential function is greater in absolute value than allowed, or extracting the square root of a negative number.

The second method does not work after the first, and vice versa. To apply both diagnostics, it is necessary to run the program twice with the same input data. In the manual-computation mode it also works, but is usually not required, since it is already clear which operation caused the error.

Undeclared capabilities (information security)

In the context of information security, the focus is on software functional capabilities whose use may disrupt its correct operation, as well as the integrity, availability, or confidentiality of information. Domestic information security standards introduce a special concept for such undocumented features — undeclared capabilities (abbr. UDC), used, in particular, in the certification of software.

For example, there is a guidance document approved by the chairman of the State Technical Commission under the President, devoted, in particular, to the classification of information-protection software by the level of control over the absence of undeclared capabilities, which defines them as follows:

2.1. Undeclared capabilities — functional capabilities of software that are not described in, or do not correspond to those described in, the documentation, whose use may result in a breach of the confidentiality, availability, or integrity of the processed information.

Functional objects deliberately introduced into software that possess such capabilities are called software backdoors. These terms are also used by GOST R 51275-2006 . Often such capabilities are defined as "deliberately introduced vulnerabilities", and with respect to cryptographic algorithms — "deliberately introduced weakness of the algorithm".

The procedure for searching for undeclared capabilities in software products is often analogous to the procedures for searching for vulnerabilities, therefore in 2019 the methodology for identifying vulnerabilities and UDCs during certification was combined by the FSTEC of Russia into a single document .

Software backdoors should be distinguished from undeclared capabilities that appeared as a result of errors in the program (sometimes called bugs) .

The Information Security Doctrine of the Russian Federation , among the threats to the «security of information and telecommunications means and systems», also names the «introduction into hardware and software products of components that implement functions not provided for in the documentation for these products».

Examples

Technical devices and software

As examples of undocumented features and commands, the following can be cited:

• as a rule, undocumented special numbers or key combinations for cell phones that open access to engineering or diagnostic menus, to obtaining additional information, or to the use of some other capabilities (for example, the mobile-phone command *#06#, which performs a switch to the IMEI-display menu, as well as, depending on the device model, various aspects of its configuration);
• the command to switch modern televisions and monitors into the engineering menu — by holding down several buttons on the remote control simultaneously, the remote's operator enters the engineering-menu space, originally inaccessible to the user, within which they then navigate using the ordinary remote commands («up», «down», «left», «right», «ok»);
• in the Windows OS, such capabilities often include working with the registry, files, and some capabilities of the Windows API;
• In the Wikipedia app on Android there is a capability (2018) to view the discussion of an article directly in the app (although if you tap "Discussion" at the bottom of an article, a browser opens). In the Wikipedia search field you need to type "Discussion:" and the title of the article.

Popular culture

• the transition from the «matrix» to «reality» in the film «The Matrix» was carried out by the main characters through picking up the handset of the telephone in the booth of a virtual pay phone in the «matrix».
• in episode 3.11 «Enter 77» of the series «Lost», the transition to a mode of core capabilities, which the show's characters did not know about, was accidentally triggered by one of the characters through winning at computer chess.

See also

• Bug
• Cheat code
• Security through obscurity
• Software backdoor
• Information security and Vulnerability [[b9357]]
• [[b8478]]
• [[b12410]]

See also

• Modern threats to information security Classification, types and methods of protection