How to dump PAL chips?

Tornadoboy

Well-known member
Joined
Dec 28, 2009
Messages
9,112
Reaction score
1,411
Location
North Attleboro, Massachusetts
Can someone point me to some info on how one goes about dumping PAL chips, even the protected ones? I know it can be done with some of them.

I know Charles McDonald has cooked up a couple devices for doing it and I may take a crack of making one at some point, but I wanted to see what other instructions/devices/theories there are out there to read up on.
 
No specifics, but the general idea is this:
If not protected, then use a programmer. They can usually read them out.

If protected, study the type of device. Assuming that the device has no internal state (registers), then basically apply every possible combination of input states, and read out the corresponding output states. (A test fixture will be needed to do this)

This will give you a truth table for the device that can either be reduced to a set of logic equations, or just fed back into the device's logic compiler.

This can be done in a completely automatic manner, unless you really want the equtions reduced as far as possible.


Now, if the device has internal state, I don't think there's a completely automatic way to do this. I'd probably start by looking at the scematic of the original use to try to identify things like clocks and write/read lines, then try to use logic analysis to guess at what inputs seem to feed state and which seem to be strictly combinatorial. After that you need some idea of what the thing is for in order to really work out the state and how it functions.

If it's for an older arcade board, I'd also have a look at the relevant mame sources - those guys have worked out a LOT about what the boards DO, which may well inform the repliction of the device.
 
Back
Top Bottom