It is currently Thu Nov 15, 2018 4:07 am

All times are UTC - 7 hours





Post new topic Reply to topic  [ 410 posts ]  Go to page Previous  1 ... 20, 21, 22, 23, 24, 25, 26 ... 28  Next
Author Message
 Post subject:
PostPosted: Thu Jan 18, 2007 10:17 pm 
Offline
User avatar

Joined: Sat Oct 29, 2005 2:09 am
Posts: 504
Location: Indianapolis
.

_________________
/* this is a comment */


Last edited by kevtris on Sat Mar 06, 2010 12:27 pm, edited 1 time in total.

Top
 Profile  
 
 Post subject:
PostPosted: Thu Jan 18, 2007 10:50 pm 
Offline

Joined: Sun Sep 19, 2004 11:12 pm
Posts: 20767
Location: NE Indiana, USA (NTSC)
kevtris wrote:
When I say "connects to pin X of lockout chip" I mean the chip that would be on the cartridge. Not the chip in the system.

You can distinguish them by calling the chip in the console the "lock chip" and the chip in the cart the "key chip".

kevtris wrote:
/force NTSC - pulling this pin low forces the chip into NTSC only (3193 only) mode. The three PAL modes are not usable. Floating (disconnecting) this pin allows the chip to try all 4 regions.

When is this pin read?

dvdmth wrote:
The important thing here is to keep a game utilizing the "lockout functioning" output from thinking there's a lockout error when in reality there is no lockout functionality to begin with.

The CPU should know that it hasn't reset by the time the game's copyright screen disappears.


Top
 Profile  
 
 Post subject:
PostPosted: Thu Jan 18, 2007 10:57 pm 
Offline
User avatar

Joined: Sat Oct 29, 2005 2:09 am
Posts: 504
Location: Indianapolis
tepples wrote:
kevtris wrote:
When I say "connects to pin X of lockout chip" I mean the chip that would be on the cartridge. Not the chip in the system.

You can distinguish them by calling the chip in the console the "lock chip" and the chip in the cart the "key chip".

kevtris wrote:
/force NTSC - pulling this pin low forces the chip into NTSC only (3193 only) mode. The three PAL modes are not usable. Floating (disconnecting) this pin allows the chip to try all 4 regions.

When is this pin read?


It is read a little while after startup. It is designed to be tied low (to pin 8) or floated at all times, and not dorked with during operation.

_________________
/* this is a comment */


Top
 Profile  
 
 Post subject:
PostPosted: Fri Jan 19, 2007 9:24 pm 
Offline

Joined: Sun Sep 19, 2004 11:12 pm
Posts: 20767
Location: NE Indiana, USA (NTSC)
Aww man, I was wishing it could tie in with CPU-based 50/60 detection.


Top
 Profile  
 
 Post subject:
PostPosted: Sat Jan 20, 2007 1:45 am 
Offline
User avatar

Joined: Fri Nov 12, 2004 2:49 pm
Posts: 7570
Location: Chexbres, VD, Switzerland
It is a very cool thing you eventually DID it !!!
Congratulations !

_________________
Life is complex: it has both real and imaginary components.


Top
 Profile  
 
 Post subject:
PostPosted: Sun Jan 21, 2007 1:32 am 
Offline

Joined: Thu Jun 22, 2006 11:39 pm
Posts: 205
I take back my quick comments about the 3195A (pictures of the ROM can be seen at http://neviksti.com/CIC/3195A/ ). It turns out the ROM layout is quite different. It went from the 512 bytes of the 6113 (and SNES D411) to 768 bytes (the bitline decoders went from 1 of 8 to 1 of 12).

Also, there is now a clear pattern in the ROM (unlike before).

The Tengen CIC only used about 256 instructions (12bit each), yes? While the NES CIC has the ROM output 8 bits and has at least 512 of these "instructions". So something seems awefully strange here.

The Tengen chip executed one instruction every 4 clock cycles. Maybe the NES CIC does as well, but there are two 8bit loads involved in this ... maybe first 8 bits is instruction code, and last 8 bits are data. The only time all 8 bits of data should be needed are for jump statements... so maybe we can test this idea.

I finished depackaging the 3193A (from USA) chip tonight, but haven't had time to look at it in the microscope yet. I'm hoping the chip layout will match the 3195A so we can directly compare the ROM data.


What is functionally different between the 3193 and 6113? Can one act as a key/lock and the other only as a key? I'm not sure what to make of the large changes in layout between them as I was not expecting to see that (especially considering they didn't even change the layout when going from 6113 -> SNES D411).


Top
 Profile  
 
 Post subject:
PostPosted: Sun Jan 21, 2007 1:52 am 
Offline
User avatar

Joined: Sat Oct 29, 2005 2:09 am
Posts: 504
Location: Indianapolis
neviksti wrote:
I take back my quick comments about the 3195A (pictures of the ROM can be seen at http://neviksti.com/CIC/3195A/ ). It turns out the ROM layout is quite different. It went from the 512 bytes of the 6113 (and SNES D411) to 768 bytes (the bitline decoders went from 1 of 8 to 1 of 12).

Also, there is now a clear pattern in the ROM (unlike before).

The Tengen CIC only used about 256 instructions (12bit each), yes? While the NES CIC has the ROM output 8 bits and has at least 512 of these "instructions". So something seems awefully strange here.

The Tengen chip executed one instruction every 4 clock cycles. Maybe the NES CIC does as well, but there are two 8bit loads involved in this ... maybe first 8 bits is instruction code, and last 8 bits are data. The only time all 8 bits of data should be needed are for jump statements... so maybe we can test this idea.

I finished depackaging the 3193A (from USA) chip tonight, but haven't had time to look at it in the microscope yet. I'm hoping the chip layout will match the 3195A so we can directly compare the ROM data.


What is functionally different between the 3193 and 6113? Can one act as a key/lock and the other only as a key? I'm not sure what to make of the large changes in layout between them as I was not expecting to see that (especially considering they didn't even change the layout when going from 6113 -> SNES D411).


I tested this the other day.

the following combinations work:

3193L 3193K
3193L 6113K
6113L 6113K

this combination DOES NOT WORK:

6113L 3193K

L and K are lock/key resp.

This must be why even the last front loaders made in the 90's had 3193's for the locks, long after all the carts were using 6113's.

_________________
/* this is a comment */


Top
 Profile  
 
 Post subject:
PostPosted: Sun Jan 21, 2007 3:19 am 
Offline
User avatar

Joined: Fri Nov 12, 2004 2:49 pm
Posts: 7570
Location: Chexbres, VD, Switzerland
Just on a side note, when cutting pin 4, this makes the CIC behave as a key and the reset line is freed. So the 6113 most probably act like a key only version of the 3193 (saving costs ?). The combination 6113L 6113K most likely works, beacuse the 6113 acts like a defeated CIC.

Now, about the PIC12 version of the CIC, I'd like to have more prection about the /ForceNTSC pin. You mean it's an open collector input ? What will happen when it is tied high ? The same as if it is floating, the chip will go in all modes, while in Force NTSC mode, is just behave like a 6113 without asking questions ?

_________________
Life is complex: it has both real and imaginary components.


Top
 Profile  
 
 Post subject:
PostPosted: Sun Jan 21, 2007 3:36 am 
Offline
User avatar

Joined: Sun Sep 19, 2004 10:52 pm
Posts: 376
Location: UT


Last edited by loopy on Wed Aug 20, 2008 11:18 am, edited 1 time in total.

Top
 Profile  
 
 Post subject:
PostPosted: Sun Jan 21, 2007 1:56 pm 
Offline
User avatar

Joined: Sat Oct 29, 2005 2:09 am
Posts: 504
Location: Indianapolis
Bregalad wrote:
Just on a side note, when cutting pin 4, this makes the CIC behave as a key and the reset line is freed. So the 6113 most probably act like a key only version of the 3193 (saving costs ?). The combination 6113L 6113K most likely works, beacuse the 6113 acts like a defeated CIC.


Now, about the PIC12 version of the CIC, I'd like to have more prection about the /ForceNTSC pin. You mean it's an open collector input ? What will happen when it is tied high ? The same as if it is floating, the chip will go in all modes, while in Force NTSC mode, is just behave like a 6113 without asking questions ?


It is an input, but it has a pullup built into the chip so it's pulled high internally. The internal resistor is around 100K or so. I measured the pin when it's floating and it is indeed sitting at 5V, even when I loaded it with a few megs it didn't move very far indicating that the pullup is functioning.

You can tie it high if you're feeling like it, it won't hurt anything... but it's not required. I made it do the "force' when pulled low, because it is right next to pin 8, which is ground. So to operate in NTSC only mode, you connect pins 7 and 8 together.

_________________
/* this is a comment */


Top
 Profile  
 
 Post subject:
PostPosted: Wed Jan 31, 2007 5:52 pm 
Offline
User avatar

Joined: Wed Oct 06, 2004 8:00 am
Posts: 132
Location: Northern New York
kevtris wrote:
...must be why even the last front loaders made in the 90's had 3193's for the locks, long after all the carts were using 6113's.


Probably saved costs in manufacturing, without changing it too much (like licensee's cared at $9/cart)

Just a hunch...


Top
 Profile  
 
 Post subject:
PostPosted: Sun Feb 18, 2007 8:47 am 
Offline

Joined: Wed Sep 21, 2005 3:20 pm
Posts: 284
Image

A pic of some SNES CICs Tomy posted in another forum.

-Rob


Top
 Profile  
 
 Post subject:
PostPosted: Sun Feb 18, 2007 9:42 am 
Offline
User avatar

Joined: Fri Nov 12, 2004 2:49 pm
Posts: 7570
Location: Chexbres, VD, Switzerland
I doubt the '74LS110', '74LS112', '74F9110 and '74HC11' are CICs.

_________________
Life is complex: it has both real and imaginary components.


Top
 Profile  
 
 Post subject:
PostPosted: Sun Feb 18, 2007 11:11 am 
Offline
User avatar

Joined: Mon Sep 27, 2004 2:13 pm
Posts: 1668
They aren't, they just labeled them that to throw off Nintendo/competitors. Apparently Tomy has some early SFC pirate carts with 555 circuits to unlock the CIC too but hasn't shared them yet :)


Top
 Profile  
 
 Post subject:
PostPosted: Wed May 09, 2007 12:48 pm 
Offline

Joined: Wed May 09, 2007 12:45 pm
Posts: 56
Hi all.
Sorry for reviving the thread, but I'd like to know if there was any progress in CIC hacking, like trying to adapt it to SNES.


Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 410 posts ]  Go to page Previous  1 ... 20, 21, 22, 23, 24, 25, 26 ... 28  Next

All times are UTC - 7 hours


Who is online

Users browsing this forum: No registered users and 2 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB® Forum Software © phpBB Group