I had an interesting idea: for ROMs which won't dump the 8th bit electronically, can we dump said bit via power/current analysis?

I got this idea from someone l_oliveira mentioned about on the nesdev forums, who had a rom (rare?) which had a dead data line which would output zero always, but the data was still there. The rom was probably NMOS so it drew a different amount of current depending on whether the current bytes bits were 1s or 0s, so you could sum up the number of 0 and 1 bits, multiply each by a constant and get the amount of current it would draw at said address. Using that, plus the 7 readable bits, he was able to figure out what the 8th bit should be, and recover the data.

I think that same trick may work here, but you need a fairly accurate current probe on the VCC or GND pin.

LN

"When life gives you zombies... *CHA-CHIK!* ...you make zombie-ade!"