What's new

RealMFnG

Legendary
Joined
Mar 27, 2016
Messages
5,014
Reaction score
4,522
Location
NorCal
Whispers of a separate thread to explore the viability of using Killing Blade for PGM conversions were brought up in the main (very long) PGM conversion thread. Let's do it now.

@twistedsymphony mentions that the conversions need to obtained, then the GAL's dumped to make it work. I am willing to invest in that. But here is what I need:
  1. Which conversion to get?
    • Is it a crap shoot in terms of what donor was used for the eventual conversion?
  2. If so, should be worth while to ask for a specific donor cart to be used from sheep_nova, and will he and maybe Lydz agree to it?
    • Don't think should cut too much into their revenues as there shall be plenty that would buy ready made carts
    • This is for DIY guys that like to tinker and have the tools to do so
  3. The Killing Blade PCB versions are the ones that need to be explored?
  4. Who can dump the GAL's?
    • I'll have it shipped right to that person
Also, paging @xodaraP as he has the most knowledge on the subject.
 
Nice!

The GALs we need dumped are those used in the conversions where KB has been used as a donor

You can tell by the layout which conversions use KB as a donor. I haven't been able to determine yet if any of the Chinese conversions have used both boards, the only one that appeared that definitely used KB was KB prog board with custom CHAR board

For dumping of the protected GAL, you would need to speak to these people, there are likely others but this is who I could think of straight away

Apocalypse
Hammy
Hatsune Mike
brizzo
Darksoft maybe?
 
Hatsune Mike lives in my area and I am acquainted with him. I'll reach out to him for the dumping when the time comes. Also, 300wins might have these already. I'll ask him next week if I can peek into his conversions to see if Killing Blade was used as the donor. In case they weren't, which conversion to get? Or is it a roll of the dice that the conversion you get used Killing Blade as the donor?

Shall we ask sheep_nova for a special order using Killing Blade?
 
Roll of the dice. I think someone asked if they could have KB and they were the ones who put up the photo of the KB PROG board and custom CHAR board running Espgaluda

It had what looked like a factory PAL on it, no wire jumpers
 
AFAIK Killing Blade is the only donor with a non-translucent case. chances are if the cart uses an opaque red case it's likely a Killing Blade donor, where a translucent case is likely one of the other donors.

of course it's possible that cases were swapped at some point but that'd likely be the easiest way to tell if you don't have the ability to see the cart pcb.
 
For those interested in helping get the Killing Blade PAL/GALs reversed this is what you should look for:

1. This will be a conversion to Espgaluda or Ketsui
2. This will LIKELY have a non-transparent case
3. This will have a Program PCB number of: IGS PCB NO-0179-2 (it may have a different - number at the end but -2 is the only one we've seen)
4. the program PCB looks like this:
index.php
'

you may also find a version of this with the 3 8-bit ROM slots on the bottom populated and the 16-bit socket on the lft not-populated.

a dead give away is the far left PAL socket and the ARM socket being empty. We need the other 2 PALs on this PCB dumped.
 
I also want to make clear that this honestly isn't a huge deal.

we've already got all of the conversions figured out and have had them figured out for a LONG TIME now.

a summary of the important info is here: Any PGM Conversion info out there?

Cracking these killing blade conversions simply gives us ANOTHER donor option so that people could save $20 on the donor cart.
 
Quick summary of the story so far:

There are two general styles of official cartridge:
- encrypted M68k program ROM, no external ARM ROM
- unencrypted M68k program ROM, encrypted external ARM ROM
Both types contain separate ROMs for the background graphics (tiles)

Knights of Valour Super Heroes is the first type, and can be used as donor for DDP3, KOV2 is the second type and can be used as donor for
Espgaluda and Ketsui. Killing Blade is the second type as well.

Each cartridge has 2-3 PAL, a shared SRAM buffer between motherboard and ASIC, a latch register to communicate between motherboard and
ASIC, and an ASIC containing an ARM CPU, a small ROM and decryption hardware.

The PALs:
- subtract the base address for tile or program ROM to map them from the motherboard memory map into the EPROM
- generate chip select signals for SRAM, latch register, ASIC, ROMs
- convert some motherboard signals for the ASIC and other components

The Killing Blade board:
- extra "obfuscation" with PAL U8
- unknown interaction with remaining PAL
- conversions bypass PAL U8 and remove the ASIC, no other physical changes are visible
- so far no attempt to copy this conversion boot into the game
- reverse engineered PAL don't boot the original game

Ideas:
- burn an unencrypted DDP3 into a program ROM and bypass U8. This should boot with the original unmodified PAL.
Does it work?
-> The secret sauce is only in the PAL
Does it not work?
-> Some other mystery change is required

The Ketsui ROM from the Mame set has the game in the second half, Espgaluda has the game in the first half. This is normally worked around in conversion by tying the highest address line high in Ketsui conversions.
Idea:
- use Ketsui Trap from the PGM Program archive, which has the game in both halves.

Schematic (only the bit around the PAL):
View attachment pcb-179-2.pdf

One interesting bit is that the connections of the upper address lines from J1 to J2 don't seem to be used.

On Demon Front they go through RN1-RN4:
http://www.gc8tech.com/uncategorized/pgm-demon-front-pcb/

but I can't see anything equivalent on the KB board:
http://www.gc8tech.com/uncategorized/pgm-the-killing-blade-pcbs/
 
Last edited:
So I checked the conversions that 300wins has; none used Killing Blade as a donor. And since it is a dice roll what donors you'll end up with when buying a conversion, no point purchasing one.

That leaves the only option to ask the community to check their PGM conversion(s) of ESPGaluda and/or Ketsui to see if Killing Blade was used as a donor. Open up your conversion and check if the PCB number on it is one of the following:
  • IGS PCB NO-0179 (PRG)
  • IGS PCB NO-0179-2 (PRG)
  • IGS PCB NO-0178 (GFX)
If so, the ask is simple, allow your conversion to be sent to another A-P.com member to be dumped. I'll fund the cost of shipping off to a member that can dump it; insuring it for loss (replacing it for a new conversion if lost or damaged in any way), then pay for shipping back to you.
 
Last edited:
Ideas:
- burn an unencrypted DDP3 into a program ROM and bypass U8. This should boot with the original unmodified PAL.
Does it work?
Has this been tried yet? Surprising if it has not. Can someone point me to the unencrypted DDP3 program ROM's? I can give it a whirl if it has not.
 
I have both an ESPGaluda and Ketsui using IGS PCB NO-0179-2, and I'm willing to ship them to someone. If brizzo is willing and able, I'd prefer to ship to him (just because we're both in Canada so nothing would have to go through customs), but I'll ship to anyone.
 
I have both an ESPGaluda and Ketsui using IGS PCB NO-0179-2, and I'm willing to ship them to someone. If brizzo is willing and able, I'd prefer to ship to him (just because we're both in Canada so nothing would have to go through customs), but I'll ship to anyone.
@brizzo can you dump GAL's?
 
Protected GALs - these can't just be dumped using a standard programmer

I believe brizzo would have the equipment though
 
Well, I've got one of Sheep Nova's carts on the way as well... I'll have a look if I can convert it. I'll probably do the program ROM only, and then convert it back to the original game.

What you can do with those type of GAL is generate all possible inputs and sample the outputs to generate one single truth table, then use an algorithm to simply it into a set of expressions.

(What doesn't work is if the internal registers are used, or if an output is tri-stated. Though by looking at the connections on the PCB it should be possible to guess those cases...)
 
@brizzo can you dump GAL's?
Yes, I have a few different tricks depending on the type of device.

What you can do with those type of GAL is generate all possible inputs and sample the outputs to generate one single truth table, then use an algorithm to simply it into a set of expressions.

(What doesn't work is if the internal registers are used, or if an output is tri-stated. Though by looking at the connections on the PCB it should be possible to guess those cases...)
Correct, read more about it here: http://techno-junk.org/readpal.php

I also sell adapters with a ZIF socket for this method.
 
I also sell adapters with a ZIF socket for this method.
do your adapters do the 22V10 in addition to the 16V8? or is it 16V8 only?

I've been wanting to build my own tool for reversing both of these but if one already exists then I'd rather not reinvent the wheel.
 
Cool! @slickam and @brizzo, if you guys can get together via PM and work out the arrangements for shipping, that would be awesome. Let me know the cost of shipping back and forth. Thanks!
 
do your adapters do the 22V10 in addition to the 16V8? or is it 16V8 only?

I've been wanting to build my own tool for reversing both of these but if one already exists then I'd rather not reinvent the wheel.
The 27c020 method only applies to combinatorial configured 20 pin devices; so that excludes 22v10. The site I linked to above belongs to Charles MacDonald, and he had designed a device for solving 22 pin chips and some registered devices but has since retired the design.

Automation sounds nice for solving these devices, but often with some poking around to understand the function of the device it is possible to solve a the equation with a logic analyzer.
 
Back
Top