Nintendo 64 Lockout Chips

Hi!

I'm currently doing some investigations on the N64 Cic Chips. When opening Pokémon Stadium, I found a NUS-CIC-7103A.
Does someone know what the appended A stands for, if there are other numbers ending with A and how these differ compared to there A-less pedants?

I did some reversing on the 7101 and would be happy to exchange information. If someone is interested, please let me know.

 

Keep us informed on your work, sounds interesting.

 

As Marshallh suggested, these chips contain a Sharp SM5 4-bit microprocessor. I found some debug modes that may have been used for testing. Using these made me able to execute external code and see the results. I also read the ROM containing the machine code and a separate small section containing something like a key.

Now I could try to emulate the whole chip using an FPGA and thus make devices like 64drive or everdrive64 able to run without those chips.

 

Great to hear your progress! Keep up the work, it'll be nice to not have to use CICs.

 

Surely you don't need an FPGA to emulate it, why not reverse what it's actually doing (especially if you have read it out) and do it on a PIC?

 

Your absolutely right, a microcontroller would be powerful enough to emulate the protocol.
The reason for using an FPGA is that most development cartridges have one built-in.

I'd prefer to just handle the protocol over synthesising the whole microprocessor core anyway. Porting to your preferred architecture shouldn't be a problem.

 

Can you tell us about the debug modes, and how to use them? This would save us a ton of effort.

From our research, the A represents a die shrink.

 

Thanks for the clarification about the A letter.
Maybe I'll decap one to verify that information.
I wrote you a PM regarding the debug modes.

 

I'd also like to be informed about debug modes via PM.

 

As there was some interest I'll write an how to when I've got some time left. Here is an overview of what I've found:

There are 3 additional modes of operation that can be selected by tying Pin 6 or 7 to Vss. Two of these bypass the ROM and accept machine code directly from Port 5 (Pin 2 - 5). An execution cycle takes two clock cycles and the upper and lower instruction nibble can be latched in on the rising edges. In those modes Port 2 (Pin 12 - 15) is directly connected to the Areg or the program counter / stack pointer.