CIC Lockout defeat

Discuss hardware-related topics, such as development cartridges, CopyNES, PowerPak, EPROMs, or whatever.

Moderator: Moderators

Post Reply
User avatar
teaguecl
Posts: 211
Joined: Thu Oct 21, 2004 4:02 pm
Location: San Diego

CIC Lockout defeat

Post by teaguecl »

I am developing a custom cart and am re-thinking my approach to the CIC lockout chip. My initial design doesn't do anything about it (I test on a toploader), but I was planning on putting a socket on the board to hold an actualy CIC chip.
However, I recently purchased some unlicensed Tengen games (Pac Man and Ms. Pac Man) and I'm thinking about using a lockout defeat circuit like they do. The games work fine on my systems, and presumably they work well on all systems since they were sold commercially. I haven't double checked, but I'm assuming they use the -5V charge-pump circuit to trick the NES's CIC. I suppose they could use the Rabbit chip developed with the stolen code from the patent office, does anyone know?
So does anyone have any advice for how I should go? Here are the options I'm debating:

- Socket for a CIC chip. This is nice, but I'm guessing most people don't have the equipment/skills to remove a CIC chip without destroying it. Plus there are the region coded CIC's. Also, I hate the idea of ruining a 20 year old game cart. Maybe if I could find a supply of dead games, with functioning CIC's.

- Use one of the lockout defeat circuits. I heard that these were not completely reliable and/or safe, but I don't know where I heard that. Anyone know of the caveats with this approach.

- Put both the lockout defeat and the socket on the board, selectable via a jumper. Makes the board a little more complicated and large, but also versatile.
Jagasian
Posts: 421
Joined: Wed Feb 09, 2005 9:31 am

Post by Jagasian »

Supposedly lockout defeaters are unsafe when used with non-toaster systems as they dump allot of current into the system.
Great Hierophant
Posts: 780
Joined: Tue Nov 23, 2004 9:35 pm

Post by Great Hierophant »

However, I recently purchased some unlicensed Tengen games (Pac Man and Ms. Pac Man) and I'm thinking about using a lockout defeat circuit like they do. The games work fine on my systems, and presumably they work well on all systems since they were sold commercially. I haven't double checked, but I'm assuming they use the -5V charge-pump circuit to trick the NES's CIC. I suppose they could use the Rabbit chip developed with the stolen code from the patent office, does anyone know?
They do not. Instead they are a fully reversed engineered version of Nintendo's lockout chip. Tengen needed some of the documents from the patent office because they could not successfully reverse engineer the chip without them. Its everybody else that used charge pumps and the like. Nintendo was able to defeat both methods by suing Tengen in court for patent and copyright infringement and adding protection to the later top loaders to prevent the charge pump methods from working.
Supposedly lockout defeaters are unsafe when used with non-toaster systems as they dump allot of current into the system.
I have heard of that, but the only real danger is to the lockout defeating circuitry. The lockout chip pins are not connected to anything on a top loading NES or Famicom.
User avatar
Quietust
Posts: 1920
Joined: Sun Sep 19, 2004 10:59 pm
Contact:

Post by Quietust »

Great Hierophant wrote:
Supposedly lockout defeaters are unsafe when used with non-toaster systems as they dump allot of current into the system.
I have heard of that, but the only real danger is to the lockout defeating circuitry. The lockout chip pins are not connected to anything on a top loading NES or Famicom.
The problem is not high voltages on the lockout lines, but significant drain on the POWER SUPPLY, dragging the entire system voltage below 5V and potentially damaging the NES itself.
Quietust, QMT Productions
P.S. If you don't get this note, let me know and I'll write you another.
tepples
Posts: 22708
Joined: Sun Sep 19, 2004 11:12 pm
Location: NE Indiana, USA (NTSC)
Contact:

Post by tepples »

Then would it be possible to detect whether there is power or clock or something on the lockout pins and turn on the charge pump based on that?
User avatar
dXtr
Posts: 375
Joined: Tue Sep 21, 2004 12:11 am
Location: Karlshamn (Sweden)

Post by dXtr »

have you seen this thread? When I first found it I got the hopes up on that it soon would exist clones of the nes cic.. unfortantly I havn't heard anything more about it since the last post =/
http://www.cherryroms.com/viewtopic.php ... sc&start=0
Sorry for misspellings, I'm from Sweden ^^
User avatar
teaguecl
Posts: 211
Joined: Thu Oct 21, 2004 4:02 pm
Location: San Diego

Post by teaguecl »

dXtr wrote:have you seen this thread?
Funny that you should mention that, I just found that thread this morning while looking for some CIC info. It looks very promising, though it's been idle for a while. With KH on the case, and a SEM at their disposal, this is really the best chance of figuring out the CIC.
He posted the image of the NES CIC ROM from the Scanning Electron Microscope, so we should be able to extract the code. They did that for the SNES CIC, but nobody replied with a decoding of the NES one.
The problem (with both SNES and NES) is that even having the code, the "10NES" program, we still don't know what processor it runs on. It's a 4 bit micro of some type, but nobody is sure yet.
This really would be awesome, as I could put some extra logic on my FPGA to do the CIC work. Though I guess that would still leave the region coding problem, unless we could figure out the diffs between the CIC's.
Last edited by teaguecl on Tue Sep 13, 2005 4:54 pm, edited 1 time in total.
User avatar
dXtr
Posts: 375
Joined: Tue Sep 21, 2004 12:11 am
Location: Karlshamn (Sweden)

Post by dXtr »

yeah. I noticed they posted that.. unfortantly I don't get a thing of it (I wish i did) or else I would love to help
Sorry for misspellings, I'm from Sweden ^^
Great Hierophant
Posts: 780
Joined: Tue Nov 23, 2004 9:35 pm

Post by Great Hierophant »

The problem is not high voltages on the lockout lines, but significant drain on the POWER SUPPLY, dragging the entire system voltage below 5V and potentially damaging the NES itself.
This is troubling, but I have never experienced a problem with my top loader. I believe Kevtris says on the Camerica/Codemasters' games you would always set the switch to position "B" to avoid this. I have charge pump games from the major companies (AVE/C&C/CD&WT) and have never had a problem.

I assume that these cartridges cannot cause trouble on a working front loading NES because once they do their job they presumably "shut down" before they can harm the machine. Otherwise, the only safe way to use these cartridges would be disable their circuitry, which may cause the games to cease working.
Post Reply