Sunday, December 11, 2016

#126, #129 are JETKEYV3 ASICs

Here's 126:




And 129:





Both are JETKEYV3 ASICs:  So, with the exception of some minor LUTs, there isn't a ROM to extract.

Friday, December 9, 2016

8751 rampage: #220, 225, 233, 238, 239

Includes:
  • 220: Golden Axe 8751: 317-0112.2C
  • 225: Super Real Darwin Data East DY.xx
  • 233: Captain Silver Data East DX.19B
  • 238: Golden Axe 8751: 317-0123A.2C
  • 239: Altered Beast 8751: 317-0078.2C

The basic idea is to erase the security fuse without erasing the EPROM content.  From previous experiments, the fuse is known to be near the top middle of the die, reasonably far from the EPROM.  So by masking the EPROM with a UV opaque material and erasing, the 8751 is de-protected and can simply be read out.















#39 ROM extracted



"M-Chip from Taito Extermination B06_14.1G"

Chip decapped successfully, but it was a bit dirty despite initial cleaning attempts (above).  Try again:


Better.  Using crossed polarizers, ROM looks like this:


Getting there, but there's still enough debris to make readout difficult.  One final more aggressive cleaning round:


And we have a good quality image prime for readout.

For reference, here's a sample closeup of conventional brightfield vs crossed polarizers imaging:



After imaging, a computer vision (CV) program analyzed the images to produce a ROM dump.  However, instead of getting 0x800 bytes as expected, we got 0x900!  After a closer look, we discovered the CV program had interpreted some address lines as data:


These were fixed and the ROM now looks reasonable.  After a bit of work to understand ordering:


We now have the original ROM file.

However, additional checking needs to be done before it's ready to use (ex: dust induced single bit error).