What's new
By:
Filters

Brezzasoft Crystal System conversions

mackenzie said:
is there any universal gal to download? I have a board with the burnt gal! need to replace to try to fix a card
Click to expand...
Do we know for sure what chip the gal is? I don’t think any are dumped, nor is there a universal one unless @brizzo had them decappped and solved it or something.

if you have a programmer that can handle the flash memory, and are capable of removing and replacing it, I have a rom where @Apocalypse patched out the GAL so you can remove it.
 
ekorz said:
I don’t think any are dumped, nor is there a universal one unless
Click to expand...
I can probably dump those GALs.
I don't think it's possible to hancraft a universal one, each GAL replaces a few instructions at specific addresses.
 
IF YOU CAN DUMP THE GAL that a cristal of the kings
Apocalypse said:
I can probably dump those GALs.
I don't think it's possible to hancraft a universal one, each GAL replaces a few instructions at specific addresses.
Click to expand...

uses, it will be of great value. because it doesn't exist on the internet if you could do me this favor i would be very grateful.
 
mackenzie said:
IF YOU CAN DUMP THE GAL that a cristal of the kings


uses, it will be of great value. because it doesn't exist on the internet if you could do me this favor i would be very grateful.
Click to expand...
I meant I have the tools to dump it. But I don't have access to the chip (don't own a Crystal of Kings cart).
 
The chip on the cartridge pcb is a microcontroller(mcu) and there is no dumps of this chip used on Crystal of Kings. As @ekorz suggested, the solution is to re-write the tsop48 flash chip with patched rom so the mcu is no longer needed.

If you need to replace the GAL in position U27 on the motherboard, attached is the logic equation to generate a jed file used to program replacement atf16v8 or gal using WinCUPL.
 

Attachments

  • crystal-16v8-u27.txt
    1.1 KB · Views: 154
brizzo said:
The chip on the cartridge pcb is a microcontroller(mcu) and there is no dumps of this chip used on Crystal of Kings. As @ekorz suggested, the solution is to re-write the tsop48 flash chip with patched rom so the mcu is no longer needed.

If you need to replace the GAL in position U27 on the motherboard, attached is the logic equation to generate a jed file used to program replacement atf16v8 or gal using WinCUPL.
Click to expand...

thanks!

I will try, I hope I can solve it with your help. thanks
 
Hello,

I just joined this forum regarding this tread :).
If you're still looking for dump gals, I can send you my games in order to do this. (The crystal of kings, top blade V, évolution soccer, dongul dongul herongi)
Just pm me if interested).

Regards,
DracO
Apocalypse said:
I meant I have the tools to dump it. But I don't have access to the chip (don't own a Crystal of Kings cart).
Click to expand...
 
Hi DracoeL,
Thanks for the offer. According to @brizzo they aren't PLDs but MCUs.
Could you take hi-res pictures of your carts (PCB)?

Cheers.
 
I have not a high res camera but I'll do my best. I hope it will be enought.
Pictures incoming...
 
Find all pictures of the 4pcbs in a Wetransfert (10 days remaining), i let you select for eternity pictures wich are a bit usefull.
LINK
As honorable mentionned :
On The crystal of the kings pictures you can see a stickers located on IMG_2416 IMG_2417; i removed it but all component informations were erased.

Years that I did not plug them ...
What a good idea I had, 3 motherboards, 3 battery leaks, only one still alive ||.
IMG_2394.JPG

I hope this help, light was so bad ... sending you pcbs would have been more effective I guess X/.

Regards,
DracO
 
@DracoeL thanks for the pictures.
It seems the protection device is proprietary (DIP18 with "MagicEye" stamped on it). Could also be a standard part with custom code inside.
Pinout would have to be traced first.

Regarding your faulty motherboards, from the pictures the damage doesn't look that bad, it's probably fixable.
 
They are PIC chips, the ones we have dumped are in MAME and have been verified by disassembly and programming onto new devices. It uses 2-wire serial (rx/tx) via bit banging.
 
@brizzo what is the dumping method? They must surely be secured. Power trick as for many other PICs?

[EDIT]
My memory really doesn't serve me well, I had notes stating it was a PIC and a premliminary pinout...
 
Last edited by a moderator:
@Apocalypse @brizzo
Once again if needed i can send for dump thoses pcbs or try to find a local "dumper".

I got poor electronic knowledge, anyways there is 3 readable version 0134 HAF / HAG / HAH. If this can help i can plug thoses 3 on The Crystal of the Kings, in order to know if one of them is shared.

Regards
 
@Apocalypse well the fun part is they didn't always use the exact same PIC part. Decapping and probing is the method; but we have only done the common games because of the risk. Fault injection (glitching vcc or clock) can be risky and only works on specific errata versions of parts. There are many design generations of PIC models that use the same part numbers. What we have been working on has been to derive the rest of the PICs using the existing dumps, running the PIC code in a simulator attached to MAME with data captured from logic analyzer. It is so close to solved but there is some underlying bug that I cannot identify. The instruction set the VRender0 uses is a nightmare to understand.

@DracoeL at this time you do not need to send any chips to anyone. They are security protected and not a simple task. We only really need to solve the security chip for dongul dongul herongi, which I have a copy of. It is nice to know you also have a copy, the game is rare to find.
 
If you need another Dongul, I have a cart here too @brizzo
 
You must log in or register to reply here.
Back
Top