Previous Thread
Next Thread
Print Thread
Page 53 of 152 1 2 51 52 53 54 55 151 152
Re: MESS Dumping Project ? [Re: Anna Wu] #40385 04/20/08 05:00 PM
Joined: Mar 2001
Posts: 16,575
R
R. Belmont Online Content
Very Senior Member
Online Content
Very Senior Member
R
Joined: Mar 2001
Posts: 16,575
Ahh, the AY-3-8500. Do we know if it's actually an MCU or just the discrete logic of the time boiled down to an IC?

Re: MESS Dumping Project ? [Re: R. Belmont] #40391 04/20/08 07:12 PM
Joined: Jul 2004
Posts: 517
R
ranger_lennier Offline
Senior Member
Offline
Senior Member
R
Joined: Jul 2004
Posts: 517
I believe it's just a pong-in-a-chip IC. Some later General Instruments chips for dedicated consoles were actually MCU's, though. This book gives a great overview:

ftp://ftp.eskimo.com/u/m/mzenier/GI-Games-1978.pdf

Re: MESS Dumping Project ? [Re: ranger_lennier] #40395 04/20/08 07:45 PM
Joined: Mar 2001
Posts: 16,575
R
R. Belmont Online Content
Very Senior Member
Online Content
Very Senior Member
R
Joined: Mar 2001
Posts: 16,575
Neat, that's the famous chip manual the Intellivision was "designed" from smile

Re: MESS Dumping Project ? [Re: R. Belmont] #40402 04/21/08 07:45 AM
Joined: Oct 2006
Posts: 987
S
Stiletto Offline
Senior Member
Offline
Senior Member
S
Joined: Oct 2006
Posts: 987
Man, I've had that for AGES... I basically leeched all of his datasheets after reading all of pong-story.com and going searchin'. smile

He also had posted a copy of a theory for dumping a 68705P5 to Usenet once that was interesting, but IIRC Guru debunked it. Or maybe it turned out to only apply to 68705U5's, I can't remember.

Re: MESS Dumping Project ? [Re: Stiletto] #40693 05/02/08 08:49 AM
Joined: Feb 2008
Posts: 120
G
Guru Offline
Senior Member
Offline
Senior Member
G
Joined: Feb 2008
Posts: 120
Originally Posted By Stiletto
Man, I've had that for AGES... I basically leeched all of his datasheets after reading all of pong-story.com and going searchin'. smile

He also had posted a copy of a theory for dumping a 68705P5 to Usenet once that was interesting, but IIRC Guru debunked it. Or maybe it turned out to only apply to 68705U5's, I can't remember.


You probably mean 68705P3. The U-something is a 40-pin chip.... I actually dumped one of them from a Pushman PCB. The 68705P5's are always protected. That is a main type that needs to be dumped / decapped and doing that will give us about a dozen nice Taito games.
If it was a 68705P5 I'd like to see that document :-)


This thread should be sticky'd, btw. I've purposely bumped it because there was W-A-Y too much fluff above this important thread :-D



Guru

Re: MESS Dumping Project ? [Re: Guru] #40734 05/03/08 06:50 AM
Joined: Oct 2006
Posts: 987
S
Stiletto Offline
Senior Member
Offline
Senior Member
S
Joined: Oct 2006
Posts: 987
I believe we've talked about it before, buddy. You remember this?
http://google.com/group/comp.arch.embedded/msg/4dbfbec34a616622
IIRC it was something like, someone posted generally about Motorola 68705P's and Mark accused them of implying that it worked on P5's.

He's had other posts on the P3 back in the day.
http://google.com/group/sci.electronics/browse_thread/thread/7b915a6f5fc4b089
http://google.com/group/sci.electronics/browse_thread/thread/21adf03b2a7f9020
http://google.com/group/sci.electronics/browse_thread/thread/b06226d031a6fb4c
http://google.com/group/sci.electronics/browse_thread/thread/360cd891030895ca

BTW - I'm good at regularly bringing this thread to a halt. Yay me!

- Stiletto

Re: MESS Dumping Project ? [Re: Stiletto] #40776 05/04/08 02:14 PM
Joined: Feb 2008
Posts: 120
G
Guru Offline
Senior Member
Offline
Senior Member
G
Joined: Feb 2008
Posts: 120
Originally Posted By Stiletto
I believe we've talked about it before, buddy. You remember this?
http://google.com/group/comp.arch.embedded/msg/4dbfbec34a616622
IIRC it was something like, someone posted generally about Motorola 68705P's and Mark accused them of implying that it worked on P5's.


hmmm. putting it in test mode then writing a program to read out the data (presumably having it plugged into some kind of custom board hooked to the parallel port?) and adjusting the voltage at the exact right time to fool it, and some other mumbo jumbo. It's not really a _solution_ , at least not one that can be done easily.



Guru

Re: MESS Dumping Project ? [Re: Guru] #40784 05/04/08 04:58 PM
Joined: Mar 2006
Posts: 1,043
L
Lord Nightmare Offline
Very Senior Member
Offline
Very Senior Member
L
Joined: Mar 2006
Posts: 1,043
Hmm, what he was describing on that board sounds like it would work, though its a variant brute force attack:
Basically, you set the protected chip into verify mode, which iterates comparing the external and internal memories to verify that the internal rom matches the external one. The security hole is, the verify program(on mask rom inside all 68705s) STOPS when it detects a mismatch between external and internal roms. so, what you do is this:
Have an external MCU (maybe an atmel avr) outside the 68705 which watches what the 68705 does. set the external ram (which the 68705 is comparing against) to all zeroes. Now, run the 68705 in verify mode. It will halt after the first byte read from 0x0000 (and this will be visible on its bus, probably by the address bus ceasing to increment, testing is required) if the first byte in the internal rom is NOT a zero. If this is true, the external MCU should change the first byte in the ram it is verifying against to a 01, and reset the 68705 and set it to verify mode again.
if it fails again, set it to 02. etc.
once the verify program PASSES the test it will read address 0x0001 and halt. the external mcu should repeat the increment-and-reset for byte 1. repeat for all bytes in the internal rom. this takes about 18 or more hours to finish.
But it really should work, assuming Motorola didn't change the internal rom to prevent this attack on some revisions.

LN

EDIT: one more important thing:
> Bootstrap program is always present in the address space, so you can
> program up a blank part and read it out. It's pretty strange and tight
> code that copies itself into the RAM and runs from there. But it's only
> 115 bytes.

This needs to be dumped and implemented in the 68705 cpu core.

Last edited by Lord Nightmare; 05/04/08 05:02 PM. Reason: add note

"When life gives you zombies... *CHA-CHIK!* ...you make zombie-ade!"
Re: MESS Dumping Project ? [Re: That70sguy] #40822 05/05/08 03:17 PM
Joined: Aug 2001
Posts: 91
That70sguy Online Content
Member
Online Content
Member
Joined: Aug 2001
Posts: 91
Originally Posted By That70sguy
Originally Posted By judge
For the comquest plus we could use some nice pictures of the inside, the current driver code seems to have some guesses regarding the clock speed for instance.


I will do photos as soon as posible, maybe this Friday or some time nextweek.




Sorry for the dely, but these aren't the best photos. If they don't show on this post PM me, and I will send them.


Edward Middleton Jr.
Re: MESS Dumping Project ? [Re: That70sguy] #40827 05/05/08 06:24 PM
Joined: May 2006
Posts: 111
F-3582 Offline
Senior Member
Offline
Senior Member
Joined: May 2006
Posts: 111
Tough luck trying to link to photos from your local hard disk. You might wanna upload them somewhere, I suppose wink

Page 53 of 152 1 2 51 52 53 54 55 151 152

Who's Online Now
1 registered members (Fake Shemp), 48 guests, and 2 spiders.
Key: Admin, Global Mod, Mod
ShoutChat Box
Comment Guidelines: Do post respectful and insightful comments. Don't flame, hate, spam.
Forum Statistics
Forums9
Topics8,811
Posts115,965
Members4,914
Most Online890
Jan 17th, 2020
Powered by UBB.threads™ PHP Forum Software 7.7.3