Decap #145: Croupier (PIC16C74)

The Croupier IC markings have been removed:

Unlike some other obfuscated/remarked chips we did not have identification leads from the arcade community. So we decapped it to gather more information:

Clearly made by microchip:

Cross referencing 97074 with public copyright records yields "97074 PIC16C74 CMOS PIC." Great!

Next, we acquired samples to practice on. One of them was decapped with pure WFNA which, unlike the real chip, badly corroded the leadframe but was easily fixed with silver epoxy:

Note bond pads were not damaged, only leadframe. Anyway, the second sample used WFNA/H2SO4 mix and so didn't suffer from this:

We attempted to program and UV erase the PIC with a mask:

but were unable to clear the security fuse. Oh no!

Fortunately, we are not the first person to encounter this and so tried to erase at an angle:

This had mixed results, but trying sharp angles angles (sharper than above) and long exposure times generally worked. We played a little with different sides of the chip. In all tests main EPROM was untouched.


Not perfect, but should be good enough for the real chip. Masking:

And tried a few angles until the security fuse got cleared. Yipee!

Enjoy this post? Please support us on Patreon! Note: with the Indiegogo campaign over we unfortunately don't currently have a way to accept one time donations.

Decap #139 replacement: Mortal Kombat 4 U76

A bit back we processed PIC16C57 samples and discovered#139 (Invasion U76) was partially defective as received. We knew this before decap since PIC16C57 allows reading a 4 bit XOR of the 12 bit flash worlds even when protected. Unfortunately, only 2/4 word bits changed in the protected readout and only 3/12 word bits changed in the unprotected version.

Like Invasion, Mortal Kombat 4 is built on the Midway Zeus platform. With this in mind, a team member donated U76 from Mortal Kombat 4 to process as a replacement. Label off:

And here's it with the main EPROM masked against UV light:

Which allows safely erasing security fuses like in previous posts.

Stay tuned for our post on identifying and extracting #145 (Croupier)!

Enjoy this post? Please support us on Patreon! Note: with the Indiegogo campaign over we unfortunately don't currently have a way to accept one time donations.