Famicom AV, PAL NES & Dendy chips decapsulation (progress!)
Moderator: Moderators
Re: Famicom AV, PAL NES & Dendy chips decapsulation (progres
Out of curiosity, what method are you using to stitch the individual images?
The various chip scans done by Visual6502 seem pretty clean, and as I understand they were mostly "stitched automatically by Christian Sattler in the UK, using Autopano-sift-C and custom code".
The various chip scans done by Visual6502 seem pretty clean, and as I understand they were mostly "stitched automatically by Christian Sattler in the UK, using Autopano-sift-C and custom code".
Quietust, QMT Productions
P.S. If you don't get this note, let me know and I'll write you another.
P.S. If you don't get this note, let me know and I'll write you another.
Re: Famicom AV, PAL NES & Dendy chips decapsulation (progres
Visual 6502 stitches are probably done in the UK to work around the University of British Columbia's US patent on SIFT, the scale-invariant feature transform.
Re: Famicom AV, PAL NES & Dendy chips decapsulation (progres
RP2C07 will be next. Very thanks to Rumata, who sent me this chip. Here is preferred decap order:
Famicom AV chips are in the end of list, because i think they are almost identical to "G"-revision already traced.
So, i missed only NES PAL CPU (RP2A07), because don't have it.
Code: Select all
1. UA6538 - dendy/hybrid PPU ("UMC") (in progress)
2. RP2C07-0 - NES PAL PPU
3. UA6527P - dendy/hybrid CPU ("UMC")
4. TA-02NP - dendy/hybrid PPU ("TA")
5. TA-03NP1 - dendy/hybrid CPU ("TA")
6. RP2C02H-0 - Famicom AV PPU rev.H
7. RP2A03H - Famicom AV CPU rev.H
So, i missed only NES PAL CPU (RP2A07), because don't have it.
Re: Famicom AV, PAL NES & Dendy chips decapsulation (progres
Thanks for the priority list.
Is there a plan to decap the unrevised 2A03 and 2C02 chips to see where the CPU/PPU changes between the recalled square-button Famicoms and the more common later revisions lie?
Is there a plan to decap the unrevised 2A03 and 2C02 chips to see where the CPU/PPU changes between the recalled square-button Famicoms and the more common later revisions lie?
Re: Famicom AV, PAL NES & Dendy chips decapsulation (progres
Siliconpr0n.org actually has a decapped (but not delayered) unrevised RP2A03, and quite a few differences have been identified, most notably the lack of looped noise (which is because the circuitry wasn't even there at all) and a bunch of disconnected mystery logic at the top-right corner of the chip (where the G revision has its giant test pattern).
Quietust, QMT Productions
P.S. If you don't get this note, let me know and I'll write you another.
P.S. If you don't get this note, let me know and I'll write you another.
Re: Famicom AV, PAL NES & Dendy chips decapsulation (progres
I wonder what that big mystery blob is... It's still connected to the data bus, even if all the rest of the connections have been broken.
Re: Famicom AV, PAL NES & Dendy chips decapsulation (progres
I attempted to trace it out (which was a bit tricky for the lower layers) and uploaded a simulator of it here - if you can figure it out, then by all means post your findings.
Quietust, QMT Productions
P.S. If you don't get this note, let me know and I'll write you another.
P.S. If you don't get this note, let me know and I'll write you another.
Re: Famicom AV, PAL NES & Dendy chips decapsulation (progres
This is a tangent...
It seems to be buggy; the data bus drivers's logic seems to be inverted from what it should be. Makes it hard to figure out what's going on... (Node 42 is "do not drive NES-internal data bus", but it's low (true/drivers enabled) whenever R/W=write or φ2=0. ... which is the wrong sense for the structure that exists.
Is there a convention for naming nodes? Especially in the cases of
- A = not B = not not C?
- D = not E and F = not E?
Anyway, I think it's an M2-based IRQ source... Node 20 appears indicates when all 24 latches have the same value. (Can't tell if 0 or 1). Nodes 75, 108, 141, 172, 209, 247, 278, 24, 76, 109, 142, 173, 210, 248, 279, 27, 77, 110, 143, 174, 211, 249, 280, and 307 appear to be ripple-carry outputs.
The 24-bit counter was intended to be both readable and writeable. Reads from $4017 seem to reload the counter. There seems to be some functionality to disable (or force?) reads from $4016 (what?).
Here's some nodenames: '/a0':317, '/a1':318, '+enable':276, 'NORenable_clk1':321, wraddr0:26, wraddr1:38, wraddr2:41, '+irq':843, '/irq_2':839, '/d0':858, '/d1':787, '/d2':672, '/d3':653, '/d4':583, '/d5':515, '/d6':452, '/d7':384, '_d0':290, '_d1':260, '_d2':224, '_d3':188, '_d4':147, '_d5':119, '_d6':85, '_d7':55, 'd0o':287, 'd1o':256, 'd2o':219, 'd3o':187, 'd4o':155, 'd5o':114, 'd6o':90, 'd7o':54, 'databus/oe':42, 'databus+oe':780, 'databus/oe_2':252, 'w/r':722, '/clk1':756, 'clk1_2':214, 'r/w_2':217, '/a0_2':239, 'a0_2':230, '/a1_2':688, 'a1_2':663, 'd0_pullup_ext':807, 'd0_pulldown_ext':300, wraddr3_2:203, wraddr2_2:202, wraddr1_2:204, wraddr0_2:205, '/wraddr3':30, '/wraddr2':39, '/wraddr1':35, '/wraddr0':32, 'wraddr0_2':852
It seems to be buggy; the data bus drivers's logic seems to be inverted from what it should be. Makes it hard to figure out what's going on... (Node 42 is "do not drive NES-internal data bus", but it's low (true/drivers enabled) whenever R/W=write or φ2=0. ... which is the wrong sense for the structure that exists.
Is there a convention for naming nodes? Especially in the cases of
- A = not B = not not C?
- D = not E and F = not E?
Anyway, I think it's an M2-based IRQ source... Node 20 appears indicates when all 24 latches have the same value. (Can't tell if 0 or 1). Nodes 75, 108, 141, 172, 209, 247, 278, 24, 76, 109, 142, 173, 210, 248, 279, 27, 77, 110, 143, 174, 211, 249, 280, and 307 appear to be ripple-carry outputs.
The 24-bit counter was intended to be both readable and writeable. Reads from $4017 seem to reload the counter. There seems to be some functionality to disable (or force?) reads from $4016 (what?).
Here's some nodenames: '/a0':317, '/a1':318, '+enable':276, 'NORenable_clk1':321, wraddr0:26, wraddr1:38, wraddr2:41, '+irq':843, '/irq_2':839, '/d0':858, '/d1':787, '/d2':672, '/d3':653, '/d4':583, '/d5':515, '/d6':452, '/d7':384, '_d0':290, '_d1':260, '_d2':224, '_d3':188, '_d4':147, '_d5':119, '_d6':85, '_d7':55, 'd0o':287, 'd1o':256, 'd2o':219, 'd3o':187, 'd4o':155, 'd5o':114, 'd6o':90, 'd7o':54, 'databus/oe':42, 'databus+oe':780, 'databus/oe_2':252, 'w/r':722, '/clk1':756, 'clk1_2':214, 'r/w_2':217, '/a0_2':239, 'a0_2':230, '/a1_2':688, 'a1_2':663, 'd0_pullup_ext':807, 'd0_pulldown_ext':300, wraddr3_2:203, wraddr2_2:202, wraddr1_2:204, wraddr0_2:205, '/wraddr3':30, '/wraddr2':39, '/wraddr1':35, '/wraddr0':32, 'wraddr0_2':852
Re: Famicom AV, PAL NES & Dendy chips decapsulation (progres
> So, i missed only NES PAL CPU (RP2A07), because don't have it.
I have a RP2A07 (and RP2C07-0) that you can get. Just PM me an address where to send it if you want (The pins are cut so I don't have much use for them anyway)
> The various chip scans done by Visual6502 seem pretty clean, and as I understand they were mostly "stitched automatically by Christian Sattler in the UK, using Autopano-sift-C and custom code".
I can forward an email to Christian if you want help with some stitching. I can't promise that he'll respond though
Btw, if anyone wants to run some tests on a square button famicom (to verify some behavior or whatever) I have one here with pcb revision 3 and revision less cpu & ppu.
I have a RP2A07 (and RP2C07-0) that you can get. Just PM me an address where to send it if you want (The pins are cut so I don't have much use for them anyway)
> The various chip scans done by Visual6502 seem pretty clean, and as I understand they were mostly "stitched automatically by Christian Sattler in the UK, using Autopano-sift-C and custom code".
I can forward an email to Christian if you want help with some stitching. I can't promise that he'll respond though
Btw, if anyone wants to run some tests on a square button famicom (to verify some behavior or whatever) I have one here with pcb revision 3 and revision less cpu & ppu.
Re: Famicom AV, PAL NES & Dendy chips decapsulation (progres
Thank you. See PM.
-
- Posts: 6
- Joined: Wed Sep 02, 2015 9:19 am
Re: Famicom AV, PAL NES & Dendy chips decapsulation (progres
Talked to them few years back, We are using similar stitching tech, but they use automated stage while I am still on manual.Quietust wrote:Out of curiosity, what method are you using to stitch the individual images?
The various chip scans done by Visual6502 seem pretty clean, and as I understand they were mostly "stitched automatically by Christian Sattler in the UK, using Autopano-sift-C and custom code".
-
- Posts: 6
- Joined: Wed Sep 02, 2015 9:19 am
Re: Famicom AV, PAL NES & Dendy chips decapsulation (progres
Hopefully this one is final.barsmonster wrote:barsmonster wrote:Redid metal:
http://s.zeptobars.ru/UMC-UA6538-2.jpg
http://s.zeptobars.ru/UMC-UA6538-2-HD50.jpg
http://s.zeptobars.ru/UMC-UA6538-2-HD.jpg
http://s.zeptobars.ru/UMC-UA6538-3.jpg
http://s.zeptobars.ru/UMC-UA6538-3-HD50.jpg
http://s.zeptobars.ru/UMC-UA6538-3-HD.jpg
Although, we might see errors only in the morning
-
- Posts: 6
- Joined: Wed Sep 02, 2015 9:19 am
Re: Famicom AV, PAL NES & Dendy chips decapsulation (progres
Finally!, But this took me way too may years...
https://zeptobars.com/en/read/UMC-UA653 ... ntendo-PPU
https://zeptobars.com/en/read/UMC-UA653 ... ntendo-PPU
Re: Famicom AV, PAL NES & Dendy chips decapsulation (progres
Anyway, original PAL NES PPU (RP2C07-0) will be next on priority list.
I want to ask community: what simply mappers need to decap high-priority,
maybe MMC3A, MMC3B and MMC3C?
I want to ask community: what simply mappers need to decap high-priority,
maybe MMC3A, MMC3B and MMC3C?
- Broke Studio
- Formerly glutock
- Posts: 181
- Joined: Sat Aug 15, 2015 3:42 pm
- Location: France
- Contact:
Re: Famicom AV, PAL NES & Dendy chips decapsulation (progres
MMC5?
My first game : Twin Dragons available at Broke Studio.