Read PALs registered

darkside210

Member
Joined
Sep 15, 2009
Messages
41
Reaction score
1
Location
Cataluña, Spain
Hi, please, is there any way to be able to read registered PALs to be able to record them in a GAL ?, I have heard that there is a PCB called DuPAL that can do brute force, black box ...
if this PCB is used for this is there someone who knows where to buy it and how it works?, I try to read some PAL and my software gives me only many FFs in hexadecimal and other times it reads me results that are not right with different checksun every time, it seems that it may be in register mode, thanks, greetings.
Link pcb DuPAL: https://github.com/DuPAL-PAL-DUmper/DuPAL_Board
 
it seems that it may be in register mode
Which chip is it? For example, PAL16L8 is combinatorial only, but PAL16R8 is registered.

If it's registered, I don't think DuPAL will do what you want... that looks like a typical simple combinatorial dumper, where it toggles every combination of inputs and reads the outputs. Similar to: http://dreamjam.co.uk/emuviews/readpal.php , or just about any other simple PAL dumper out there. A combinatorial only PAL can be programmed to implement a latch by feeding an output back to the input... which can prevent the simple dumper from working as well.

Assuming the PAL is read protected, I'm not aware of any way to generically read the device. I've reverse engineered some registered PALs, but I make some guesses based on what the circuit does/is connected to, hook up a logic analyzer to see it in action, map out what it's doing and hopefully all the states it has, then write the CUPL or ABEL to put it into a GAL and see if it works.

DogP
 
Last edited:
Thanks for reply guys !, is a PAL16L8BCN of the Final Fight original Capcom cps1, I use a TL866II plus reader, a 27C020 adapter and Charles MacDonald's PAL Analyzer to decrypt it, the read contains many FFs (95%) and different checksun in each read.
I am doing tests, I am a newbie in this, I have managed to read another PAL from the same pcb and it reads it without problems.
I know that Final Fight is available in Mame, but I do tests to learn it and I don't know if the PAL that I can't read is in registered mode.
the pal that I can't read is rounded in the photo
 

Attachments

  • AA1B5725-B47C-425F-8457-BFCB79A0297A.jpeg
    AA1B5725-B47C-425F-8457-BFCB79A0297A.jpeg
    951.2 KB · Views: 19
If it's a PAL16L8, then it's certainly not "registered mode". But as I previously mentioned, there could be a latch implemented in the combinatorial logic.

DogP
 
If it's a PAL16L8, then it's certainly not "registered mode". But as I previously mentioned, there could be a latch implemented in the combinatorial logic.

DogP
I have used the PA analyzer program and it reads everything FF to me, do you know why this could be?
 
Everything is FF, or just mostly FF? FF means all output bits are 1... it's common to use active low control signals selected by a specific input, so for example most inputs will output 1, but a specific input will output a 0. If everything is FF, then your adapter is probably wired wrong, the chip is bad, etc.

DogP
 
Everything is FF, or just mostly FF? FF means all output bits are 1... it's common to use active low control signals selected by a specific input, so for example most inputs will output 1, but a specific input will output a 0. If everything is FF, then your adapter is probably wired wrong, the chip is bad, etc.

DogP
It is 98% FF, when I open the file in Wincupl it tells me that it is wrong, the good thing is that PAL works on the game pcb.
when verifying it the programa gives me differences
 
Last edited:
http://wiki.pldarchive.co.uk/pals/CPS1-S224B.jed This would be the file you want, off the PLD Archive linked above.
http://wiki.pldarchive.co.uk/index.php?title=Final_Fight_(CPS1) You can see here under the B Board section that it was bruteforced, so not just easily read out and saved to a JED.
Oh !, thanks !!, "bruteforced" and "unlocked" not is the same?, what differences are there?, only to unlocked is the PA Analyzer of Charles MacDonald useful and for forcebrute it is something more complex and laborious?, Am I right? You are very kind.
 
Last edited:
The main page has this to say about it:
  • Unlocked - The device was not secured and fusemap was read out in a programmer. These are usually untested but assumed working.
  • Bruteforced - The device was recreated by bruteforcing where all possible input states are asserted and all output states are logged.
 
The main page has this to say about it:
  • Unlocked - The device was not secured and fusemap was read out in a programmer. These are usually untested but assumed working.
  • Bruteforced - The device was recreated by bruteforcing where all possible input states are asserted and all output states are logged.
So I understand that Charles MacDonald's PA Analyzer program uses forcebrute to unlocking secured PALs (Only conbinational and not registered)? , thanks & greetings.
 
Back
Top Bottom