Has anyone ever identified the chips on a Super Punch-Out security board?

MaximRecoil

Well-known member
Joined
Oct 11, 2003
Messages
3,105
Reaction score
86
Location
Maine
Has anyone ever identified the chips on a Super Punch-Out security board?

For quite a few years the security has been defeated. Both Jrok and 2600 have made PCBs which replicate the function of the original security board, but they use a different design. In the notes for MAME 0.129u4, it says:

Nicola Salmoria and Bob Seidel added basic support of RP5C01 to remove (most) protection kludges in Super Punchout.

qKGee5K.jpg


Since it's known how to defeat the security, both in MAME and on real hardware, is it known what those sanded chips are? If not, is there any way to find out such as with an oscilloscope or logic probe?

The RP5C01 mentioned in the MAME notes is an 18-pin DIP, and there is only one such chip on the SPO security board (location U6).

I'm pretty sure the CPU is just a normal 4 mHz Z80A, the same as the main CPU on a Punch-Out board. If so, and if U6 is an RP5C01, that leaves 5 chips to identify: two 14-pin DIPs, two 16-pin DIPs, and one 8-pin DIP.

I would like to know what the chips are because a lot of similar looking chips (TTL logic chips) have failed over the years on my SPO board, and if any of the chips on the security board ever fail I'll be up a creek without a paddle, because those security boards are so hard to come by.
 
Last edited:
The RP5C01 mentioned in the MAME notes is an 18-pin DIP, and there is only one such chip on the SPO security board (location U6).

I just noticed that the U6 chip on the SPO security board has a slot in one of its two circular areas, which makes it resemble the head of a screw, and Ricoh RP5C01 chips have that same thing:

qBgedAB.jpg


343toSJ.jpg


And so does the Epson version:

RP5C01-95855.jpg
 
U4 is likely a RP5H01 PROM... I'd guess the rest are standard TTL chips. Obviously the boards are hard to come by (I've never even seen one in person), but it'd probably be really easy to identify them with a logic analyzer.

DogP
 
U4 is likely a RP5H01 PROM...

That makes sense, but if that's the case, then it sucks, because to replace one you'd have to be able to program it. This guy made a reader and programmer for it - http://www.syf.nl/ - but it's restricted for use with certain PC-10 and SuperSystem chips.

I'd guess the rest are standard TTL chips. Obviously the boards are hard to come by (I've never even seen one in person), but it'd probably be really easy to identify them with a logic analyzer.

Not many people have one of those (no one I know anyway). I only have a cheap logic probe.
 
That makes sense, but if that's the case, then it sucks, because to replace one you'd have to be able to program it.
The MAME source says:
// Super Punch-Out!! comes with an extra security PCB that plugs into the Z80 socket
// CHS1-01-EXP, has Z80 CPU, RP5C01, RP5H01

// The RP5C01 features don't seem to be used at all except for very basic protection
// e.g. relying on the masking done by the internal registers.
// The RP5H01 one-time PROM (OTP) is confirmed to be unprogrammed.
So it sounds like you could just replace the RP5H01 chip with a blank and you'd be fine.

Not many people have one of those (no one I know anyway). I only have a cheap logic probe.
I'm looking at 4 of them sitting next to me right now. ;)

A logic probe wouldn't do it... you could probably figure them out with a multiple channel oscilloscope, but a logic analyzer would likely get you the answer in minutes. Taking some educated guesses and using a logic comparator would probably do it too. And if you wanted to pull the chips, you could drop them in a TTL chip tester and it'd identify them if that's what they are.

If you really want to know, and want to send me a board for a couple days, I could tell you what they are. I assume 2600 knows what they are though, since he reverse engineered the board.

DogP
 
The MAME source says:

So it sounds like you could just replace the RP5H01 chip with a blank and you'd be fine.

Well that's interesting. I wonder why it's there at all. What does a blank RP5H01 actually do? Does it have any logic functions? And if it's blank, what's actually providing the security function? Is it just a big bluff on Nintendo's part?

I'm looking at 4 of them sitting next to me right now. ;)

A logic probe wouldn't do it... you could probably figure them out with a multiple channel oscilloscope, but a logic analyzer would likely get you the answer in minutes. Taking some educated guesses and using a logic comparator would probably do it too. And if you wanted to pull the chips, you could drop them in a TTL chip tester and it'd identify them if that's what they are.

If you really want to know, and want to send me a board for a couple days, I could tell you what they are. I assume 2600 knows what they are though, since he reverse engineered the board.

I didn't know he reverse engineered the board; I didn't even know he had an actual board. I thought he did something similar to what Jrok did. I tested his board for him in my SPO boardset (the prototype I assume) way back when. I played it to about 500,000 points and it worked perfectly.

There's a relatively cheap Chinese IC tester on eBay (link) that has a function described as:

Device search, the unknown model chip inserted in IC seat can automatically identify the part number (Automatic identification without input) (other directories are auto-mode)

Thanks for the offer, but I wouldn't dare let this thing out of my sight. It is too hard/expensive to replace and this is my all-time favorite video game; I've been playing it since I was a kid in the late '80s. It isn't that I don't trust you, it's that I've had things lost or damaged in the mail before. And insurance is useless if I can't find another one to replace it.
 
Well that's interesting. I wonder why it's there at all. What does a blank RP5H01 actually do? Does it have any logic functions? And if it's blank, what's actually providing the security function? Is it just a big bluff on Nintendo's part?
I don't know how SPO uses it specifically, but it does output the upper bit of its internal counter, which I guess could be used as a basic form of protection (or even for game logic).

I didn't know he reverse engineered the board; I didn't even know he had an actual board. I thought he did something similar to what Jrok did. I tested his board for him in my SPO boardset (the prototype I assume) way back when. I played it to about 500,000 points and it worked perfectly.
I talked to him about it a long time ago, but I'm pretty sure he had an original board... he mentioned that MAME had some incorrect emulation, and that he sent them corrected info. I assume he got the correct info by reverse engineering the board, though I guess it's possible he got it some other way. I'm pretty sure JROK used the info in MAME at the time to make his hack, which from my understanding wasn't 100% accurate (I did a ROM hack based on that same info as well).

There's a relatively cheap Chinese IC tester on eBay
Yep... if you want to pull the chips, you could use one of those (there are cheaper ones as well). I'd confirm that the chip power and ground pins are on the usual corners before putting it in one of those testers though. Some people have claimed that they're not perfect (saying good chips were bad, mis-identifying parts, etc), though I've never tried one.

DogP
 
I'm pretty sure JROK used the info in MAME at the time to make his hack, which from my understanding wasn't 100% accurate (I did a ROM hack based on that same info as well).

It's 100% accurate, at least my board is, every access to it returned the same values as the SPO board PeRF [ :( ] loaned me. As you did, you can find all the accesses in the original code plus I had it sit on the analyzer and capture any bus accesses to it.

There may be protection modes that my code doesn't support, but if the SPO game code never uses them supporting them is a pointless endeavor.

- James
 
Last edited:
It's 100% accurate, at least my board is, every access to it returned the same values as the SPO board PeRF [ :( ] loaned me. As you did, you can find all the accesses in the original code plus I had it sit on the analyzer and capture any bus accesses to it.

There may be protection modes that my code doesn't support, but if the SPO game code never uses them supporting them is a pointless endeavor.

- James
Ah... interesting! Yeah, I just hardcoded the fixed values that the old MAME source used to return directly into the code. But I thought someone said that as the game progressed, those values actually ended up changing, causing a slightly more random behavior or something (the same reason that people claimed it played differently in MAME). I'm lucky to beat Vodka Drunkenski, so I certainly couldn't tell any differences.

DogP
 
Ah... interesting! Yeah, I just hardcoded the fixed values that the old MAME source used to return directly into the code. But I thought someone said that as the game progressed, those values actually ended up changing, causing a slightly more random behavior or something (the same reason that people claimed it played differently in MAME). I'm lucky to beat Vodka Drunkenski, so I certainly couldn't tell any differences.

DogP

MAME definitely plays differently than the real hardware, but I don't know exactly why. In MAME I usually lose to the 3rd Dragon Chan (which is the final incarnation of him, i.e., 4th, 5th, 10th, etc., Dragon Chan are all the same) because I can hardly ever successfully duck his kicks. On the real hardware I can duck his kicks even if I were half asleep. I never lose to him on the real hardware; when I lose it is always to 3rd-and-higher Super Macho Man.

My theory is that some sort of lag is to blame. It definitely isn't display lag, because I use a CRT PC monitor with MAME. I suppose it could be input lag, though I don't notice any (though it's possible to have input lag that's too small to notice but big enough to affect your results in the game). There is definitely audio delay in MAME, i.e., the sound effect for a punch happens slightly after the punch lands rather than being perfectly sync'd like on the real hardware. That could be the problem too, because I might rely on the audio somewhat as a cue to know when to duck. It's hard to say exactly how I know when to duck; it's just something that's ingrained. Obviously there's a visual component to it, but he also says something like, "Hyah!" when he kicks, and if that's coming late, that could be what's screwing up my timing.

There is also an incorrect sound effect in MAME. As Dragon Chan completes his kick, it should make a "whoosh" sound, but it makes a completely different sound. I pointed this out on the MAME forum 8 years ago, and included a video from the real hardware demonstrating what the sound should be, and they added it to the MAMEtesters site along with a link to the video (http://mametesters.org/view.php?id=959), but it's never been fixed.

And I noticed something else in the latest version of MAME which applies to both Punch-Out and Super Punch-Out: the volume for the sound channel which goes to the right speaker (the one controlled by the VLM5030 processor; it has the announcer's voice and some other sound effects) is low compared to the 2A03 channel (music, most sound effects). I don't know when that happened, because I don't check out new versions of MAME all that often. In older versions of MAME, the sound always came out of both speakers regardless of which channel it was. That was incorrect, but the volume was good. Now they have separated the two channels so they each come out of one speaker (though they got it backwards, i.e., the announcer's voice is coming out of the left speaker whereas it comes out of the right speaker on the real arcade machine), and the volume is too low on the announcer's channel.
 
A logic probe wouldn't do it... you could probably figure them out with a multiple channel oscilloscope, but a logic analyzer would likely get you the answer in minutes.

Yeah I threw one on my LA before I sent it back to a customer and figured out what the rest were. They were indeed all TTL. Now where did I put that schematic.... ;)
 
Yeah I threw one on my LA before I sent it back to a customer and figured out what the rest were. They were indeed all TTL. Now where did I put that schematic.... ;)
Great to hear! I hope you didn't seriously lose the schematic though. ;)

DogP
 
Found it. According to my notes....

U1 = 74ls74
U2 = 74ls365
U3 = 74ls02
U7 = 74ls138

None of this has been verified though.
 
Does anyone know why they used a wire to connect one of the Z80A legs to that pad? That pad is marked "Z80A", so that wire isn't an afterthought. Why didn't they just design a trace into the PCB for that connection?
 
They wanted to intercept the /wr signal I believe. It feeds into u3 now.
 
Last edited:
They wanted to intercept the /wr signal I believe. It feeds into u3 now.

I just realized that pin 22 on the Z80A (the one that the jumper wire is soldered to) is cut/lifted, which sucks, because that complicates things if you want to swap CPUs for troubleshooting purposes.

That big square pad that the other end of the jumper wire is soldered to connects to both U3 and U6. Following the same pin numbering scheme as they printed for the Z80A, it is connected to pin 11 of U3 and pin 10 of U6. It also connects to one leg of the 5.1K resistor at R1. It isn't connected to anything else.

The strange thing is, the pin 22 pad for the Z80A is connected to pin 1 of U3, but given that the Z80A's pin 22 is cut/lifted, that connection to pin 1 of U3 is entirely unused. I don't understand why they did that. If they changed their mind after the PCB had been designed, why didn't they just remove the trace going to pin 1 of U3, and put in a trace that goes to the same places that the jumper wire they decided to use leads to? They had to redesign it anyway by putting in that big square pad, so why not do it right?
 
Last edited:
Back
Top Bottom