Article View: comp.lsi
Article #246Re: A Truly Secure (tm) ROM access
From: Hedley Rainnie
Date: Thu, 31 May 1990 18:44
Date: Thu, 31 May 1990 18:44
32 lines
2146 bytes
2146 bytes
>
> Mark Johnson mark@mips.com writes
>
> Rumor has it that Nintendo game cartridges contain ROMS that are somehow
> abnormal (encrypted? wacko custom chip design that doesn't correspond
> to any commercial part, e.g. 48K by 11bits?), and that this is how
> they guarantee they are the only source of [highly lucrative] cartridges.
> --
The Nintendo is actually protected by a patented micro controller an
identical one on both the cartridge and base unit. The two chips operate
at ~4Mhz and use a serial link to communicate with each other. The mother
board chip is master and the cartridge chip is wired with the master/slave
pin as slave, on power up a random 4 bit code is transmitted to the slave.
This chooses a permutation of an algorithm that will begin some clock cycles
later. Data does is passed back and forth at a slower rate than the 4Mhz clock
and each chip monitors the data coming in to it. If for some reason there is
an error in the data, the mother board chip detects this and will after some
cycles yank down on reset to the 6502. The net result of this can be seen on
a Nintendo with no cartridge, it repeatedly resets. The algorithm is chosen
so no two sequences are the same over time (at least a long time). The IC
itself is a 4bit microcontroller with its ROM protected by P-implant in P-Well.
Happy probing!
Hedley
{decwrl|sun}!imagen!iitinc!hedley | Integrated Information Tech.
hedley@imagen.com | Santa Clara, CA. (408)-727-1885 x49
--
{decwrl|sun}!imagen!iitinc!hedley | Integrated Information Tech.
hedley@imagen.com | Santa Clara, CA. (408)-727-1885 x49
Technical Details
Message-ID:
<143@iitinc.UUCP>Path:
arc1-ca.pugleaf.net!utzoo!yunexus!ists!helios.physics.utoronto.ca!news-server.csri.toronto.edu!cs.utexas.edu!usc!apple!portal!atari!imagen!iitinc!hedleyReferences:
<39144@mips.mips.COM> <21908@shamash.cdc.com> <39146@mips.mips.COM>Show Full Headers
Complete Article Headers
Path: arc1-ca.pugleaf.net!utzoo!yunexus!ists!helios.physics.utoronto.ca!news-server.csri.toronto.edu!cs.utexas.edu!usc!apple!portal!atari!imagen!iitinc!hedley From: hedley@iitinc (Hedley Rainnie) Newsgroups: comp.lsi Subject: Re: A Truly Secure (tm) ROM access Summary: Nintendo Message-ID: <143@iitinc.UUCP> Date: 31 May 90 18:44:59 GMT Article-I.D.: iitinc.143 References: <39144@mips.mips.COM> <21908@shamash.cdc.com> <39146@mips.mips.COM> Organization: Integrated Information Tech., Santa Clara, CA Lines: 32