What's new

ekorz

Multi Boyz 4 Pi
Legendary
Multi Boyz
Joined
Aug 21, 2016
Messages
3,864
Reaction score
4,173
Location
Boston, MA
is there any universal gal to download? I have a board with the burnt gal! need to replace to try to fix a card
Do we know for sure what chip the gal is? I don’t think any are dumped, nor is there a universal one unless @brizzo had them decappped and solved it or something.

if you have a programmer that can handle the flash memory, and are capable of removing and replacing it, I have a rom where @Apocalypse patched out the GAL so you can remove it.
 

Apocalypse

Staff member
Legendary
Joined
Dec 6, 2017
Messages
3,620
Reaction score
6,153
Location
New-Zealand
I don’t think any are dumped, nor is there a universal one unless
I can probably dump those GALs.
I don't think it's possible to hancraft a universal one, each GAL replaces a few instructions at specific addresses.
 

mackenzie

Beginner
Joined
Mar 16, 2017
Messages
9
Reaction score
1
IF YOU CAN DUMP THE GAL that a cristal of the kings
I can probably dump those GALs.
I don't think it's possible to hancraft a universal one, each GAL replaces a few instructions at specific addresses.

uses, it will be of great value. because it doesn't exist on the internet if you could do me this favor i would be very grateful.
 

Apocalypse

Staff member
Legendary
Joined
Dec 6, 2017
Messages
3,620
Reaction score
6,153
Location
New-Zealand
IF YOU CAN DUMP THE GAL that a cristal of the kings


uses, it will be of great value. because it doesn't exist on the internet if you could do me this favor i would be very grateful.
I meant I have the tools to dump it. But I don't have access to the chip (don't own a Crystal of Kings cart).
 

brizzo

Staff member
Champion
Joined
Jun 21, 2017
Messages
838
Reaction score
2,390
Location
Canada
The chip on the cartridge pcb is a microcontroller(mcu) and there is no dumps of this chip used on Crystal of Kings. As @ekorz suggested, the solution is to re-write the tsop48 flash chip with patched rom so the mcu is no longer needed.

If you need to replace the GAL in position U27 on the motherboard, attached is the logic equation to generate a jed file used to program replacement atf16v8 or gal using WinCUPL.
 

Attachments

  • crystal-16v8-u27.txt
    1.1 KB · Views: 37

mackenzie

Beginner
Joined
Mar 16, 2017
Messages
9
Reaction score
1
The chip on the cartridge pcb is a microcontroller(mcu) and there is no dumps of this chip used on Crystal of Kings. As @ekorz suggested, the solution is to re-write the tsop48 flash chip with patched rom so the mcu is no longer needed.

If you need to replace the GAL in position U27 on the motherboard, attached is the logic equation to generate a jed file used to program replacement atf16v8 or gal using WinCUPL.

thanks!

I will try, I hope I can solve it with your help. thanks
 

DracoeL

Beginner
Joined
Jan 4, 2021
Messages
8
Reaction score
3
Location
Earth
Hello,

I just joined this forum regarding this tread :).
If you're still looking for dump gals, I can send you my games in order to do this. (The crystal of kings, top blade V, évolution soccer, dongul dongul herongi)
Just pm me if interested).

Regards,
DracO
I meant I have the tools to dump it. But I don't have access to the chip (don't own a Crystal of Kings cart).
 

Apocalypse

Staff member
Legendary
Joined
Dec 6, 2017
Messages
3,620
Reaction score
6,153
Location
New-Zealand
Hi DracoeL,
Thanks for the offer. According to @brizzo they aren't PLDs but MCUs.
Could you take hi-res pictures of your carts (PCB)?

Cheers.
 

DracoeL

Beginner
Joined
Jan 4, 2021
Messages
8
Reaction score
3
Location
Earth
I have not a high res camera but I'll do my best. I hope it will be enought.
Pictures incoming...
 

DracoeL

Beginner
Joined
Jan 4, 2021
Messages
8
Reaction score
3
Location
Earth
Find all pictures of the 4pcbs in a Wetransfert (10 days remaining), i let you select for eternity pictures wich are a bit usefull.
LINK
As honorable mentionned :
On The crystal of the kings pictures you can see a stickers located on IMG_2416 IMG_2417; i removed it but all component informations were erased.

Years that I did not plug them ...
What a good idea I had, 3 motherboards, 3 battery leaks, only one still alive ||.
IMG_2394.JPG

I hope this help, light was so bad ... sending you pcbs would have been more effective I guess X/.

Regards,
DracO
 

Apocalypse

Staff member
Legendary
Joined
Dec 6, 2017
Messages
3,620
Reaction score
6,153
Location
New-Zealand
@DracoeL thanks for the pictures.
It seems the protection device is proprietary (DIP18 with "MagicEye" stamped on it). Could also be a standard part with custom code inside.
Pinout would have to be traced first.

Regarding your faulty motherboards, from the pictures the damage doesn't look that bad, it's probably fixable.
 

brizzo

Staff member
Champion
Joined
Jun 21, 2017
Messages
838
Reaction score
2,390
Location
Canada
They are PIC chips, the ones we have dumped are in MAME and have been verified by disassembly and programming onto new devices. It uses 2-wire serial (rx/tx) via bit banging.
 

Apocalypse

Staff member
Legendary
Joined
Dec 6, 2017
Messages
3,620
Reaction score
6,153
Location
New-Zealand
@brizzo what is the dumping method? They must surely be secured. Power trick as for many other PICs?

[EDIT]
My memory really doesn't serve me well, I had notes stating it was a PIC and a premliminary pinout...
 
Last edited:

DracoeL

Beginner
Joined
Jan 4, 2021
Messages
8
Reaction score
3
Location
Earth
@Apocalypse @brizzo
Once again if needed i can send for dump thoses pcbs or try to find a local "dumper".

I got poor electronic knowledge, anyways there is 3 readable version 0134 HAF / HAG / HAH. If this can help i can plug thoses 3 on The Crystal of the Kings, in order to know if one of them is shared.

Regards
 

brizzo

Staff member
Champion
Joined
Jun 21, 2017
Messages
838
Reaction score
2,390
Location
Canada
@Apocalypse well the fun part is they didn't always use the exact same PIC part. Decapping and probing is the method; but we have only done the common games because of the risk. Fault injection (glitching vcc or clock) can be risky and only works on specific errata versions of parts. There are many design generations of PIC models that use the same part numbers. What we have been working on has been to derive the rest of the PICs using the existing dumps, running the PIC code in a simulator attached to MAME with data captured from logic analyzer. It is so close to solved but there is some underlying bug that I cannot identify. The instruction set the VRender0 uses is a nightmare to understand.

@DracoeL at this time you do not need to send any chips to anyone. They are security protected and not a simple task. We only really need to solve the security chip for dongul dongul herongi, which I have a copy of. It is nice to know you also have a copy, the game is rare to find.
 

djsheep

Multi Boyz Overlord
Legendary
Multi Boyz
Joined
May 20, 2016
Messages
4,785
Reaction score
5,929
Location
Brisbane, Australia
If you need another Dongul, I have a cart here too @brizzo
 
Top