Saturday, June 1, 2019

Mosaic (Space) PIC16C5X


The PCB for this game has this curious chip:





Chip markings have been shaved off leaving just "A" visible on top and "357" on the bottom.


However, it was suspected to be a PIC16C57. Looking at this table, based on package, it could also be  PIC16C55:


We stuck it in our programmer and successfully dumped it as a PIC16C57 protected/truncated binary.  Unfortunately the programmer didn't recognize a device ID for PIC16C55 vs PIC16C57, so still not sure.

It was then decapped:


Which looks more like a PIC16C55 like we saw before on High Seas Havoc:


Masked:


Which was successfully unlocked! When dumped as a PIC16C57 (2K words) we get two identical dumps, noting that half of it looked like reserved / internal PIC data. So really only one unique 512 word code section. With all of this we are pretty sure its PIC16C55.

Finally, we briefly compared it to the existing workaround in mosaic.cpp:


Now compare this to some Ghidra disassembly:


And we see the same table!

Enjoy this post? Please support us on Patreon! Note: with the Indiegogo campaign over we unfortunately don't currently have a way to accept one time donations.

4 comments:

  1. you guys rock with all the work you do. love to see what you are doing next. thank

    ReplyDelete
  2. But did you compare it to the Mothra disassembly?

    ReplyDelete
  3. Great news! And it's awesome! Thank you so much!

    ReplyDelete
  4. Amazing post with lots of informative and useful and amazing content. Well written and done!! Thanks for sharing keep posting.
    clipping path
    clipping path service

    ReplyDelete