🚀 go-pugleaf

RetroBBS NetNews Server

Inspired by RockSolid Light RIP Retro Guy

Article View: comp.lsi
Article #246

Re: A Truly Secure (tm) ROM access

#246
From: Hedley Rainnie
Date: Thu, 31 May 1990 18:44
32 lines
2146 bytes
> 
>  Mark Johnson	mark@mips.com  writes
>
> Rumor has it that Nintendo game cartridges contain ROMS that are somehow
> abnormal (encrypted?  wacko custom chip design that doesn't correspond
> to any commercial part, e.g. 48K by 11bits?), and that this is how
> they guarantee they are the only source of [highly lucrative] cartridges.
> -- 

The Nintendo is actually protected by a patented micro controller an 
identical one on both the cartridge and base unit. The two chips operate
at ~4Mhz and use a serial link to communicate with each other. The mother
board chip is master and the cartridge chip is wired with the master/slave
pin as slave, on power up a random 4 bit code is transmitted to the slave.
This chooses a permutation of an algorithm that will begin some clock cycles
later. Data does is passed back and forth at a slower rate than the 4Mhz clock
and each chip monitors the data coming in to it. If for some reason there is
an error in the data, the mother board chip detects this and will after some
cycles yank down on reset to the 6502. The net result of this can be seen on
a Nintendo with no cartridge, it repeatedly resets. The algorithm is chosen
so no two sequences are the same over time (at least a long time). The IC
itself is a 4bit microcontroller with its ROM protected by P-implant in P-Well.

Happy probing!

Hedley

{decwrl|sun}!imagen!iitinc!hedley  | Integrated Information Tech.
hedley@imagen.com		   | Santa Clara, CA. (408)-727-1885 x49
-- 
{decwrl|sun}!imagen!iitinc!hedley  | Integrated Information Tech.
hedley@imagen.com		   | Santa Clara, CA. (408)-727-1885 x49
Technical Details
Message-ID: <143@iitinc.UUCP>
Path: arc1-ca.pugleaf.net!utzoo!yunexus!ists!helios.physics.utoronto.ca!news-server.csri.toronto.edu!cs.utexas.edu!usc!apple!portal!atari!imagen!iitinc!hedley
References: <39144@mips.mips.COM> <21908@shamash.cdc.com> <39146@mips.mips.COM>

Show Full Headers
Complete Article Headers
Path: arc1-ca.pugleaf.net!utzoo!yunexus!ists!helios.physics.utoronto.ca!news-server.csri.toronto.edu!cs.utexas.edu!usc!apple!portal!atari!imagen!iitinc!hedley
From: hedley@iitinc (Hedley Rainnie)
Newsgroups: comp.lsi
Subject: Re: A Truly Secure (tm) ROM access
Summary: Nintendo
Message-ID: <143@iitinc.UUCP>
Date: 31 May 90 18:44:59 GMT
Article-I.D.: iitinc.143
References: <39144@mips.mips.COM> <21908@shamash.cdc.com> <39146@mips.mips.COM>
Organization: Integrated Information Tech., Santa Clara, CA
Lines: 32