DogP
Well-known member
Just documenting what I believe should be the difference between a Johnny Nero and a Special Forces PCB. According to the schematics there are several resistor changes... I modified a Johnny Nero board as called out for Special Forces, and attached a picture of the differences.
If you try to run Johnny Nero with the jumpers set for Special Forces, it shows video then halts with an error "Error! Proc clock DIV not set properly".
I did try running Special Forces on this, but unfortunately, while MAME seems to imply the security PIC is the same between Johnny Nero and Special Forces, I don't think that's the case. Attempting to run Special Forces with these jumpers and the Johnny Nero PIC looks to get through loading the FPGA and starting to execute code on the CPU... then halts (1 LED lit). Though I don't have a Special Forces PIC to try, so I can't 100% confirm there isn't some other difference causing it to halt.
I did clip the logic analyzer on the PIC, and it doesn't appear that the PIC itself is halting the CPU, but instead I think the FPGA does it. I still need to look more closely, but there are two reset lines from the FPGA to the CPU (CPU_RESET_N and CPU_COLD_RST_N), and I suspect one or both of those are what's stopping the CPU. They have pulldown resistors, so if the FPGA simply releases those pins instead of driving them low, maybe you could manually pull them high to keep the CPU running (or cut the traces). But the CPU also accesses the boot ROM through the FPGA, so if the FPGA isn't happy, it kinda has the CPU by the balls.
And MAME also emulates some very simple PIC stuff, but the PIC actually does a lot at startup... it looks like the FPGA bitfile is streamed out of ROM directly to the PIC, which loads it over the FPGA JTAG lines. I assume shortly after the FPGA is loaded the PIC writes something to the FPGA, which it detects is incorrect. Presumably to obfuscate what's actually causing the halt (or maybe just waiting a timeout period for the correct data to be written), they allow the CPU to start running code, then halting after a short period.
Since MAME doesn't correctly emulate the FPGA, it makes sense that it shows video at boot, since they're mapping the boot ROM directly to the CPU, rather than getting killed by the FPGA.
Anyway, if anyone has a real Special Forces PCB and can verify those resistor changes, that'd be cool. And if you have a good Johnny Nero and bad Special Forces, you could try making these changes to the Johnny Nero board and swapping the PIC (and boot ROM/HDD)... be sure to post the results if you do!
DogP
If you try to run Johnny Nero with the jumpers set for Special Forces, it shows video then halts with an error "Error! Proc clock DIV not set properly".
I did try running Special Forces on this, but unfortunately, while MAME seems to imply the security PIC is the same between Johnny Nero and Special Forces, I don't think that's the case. Attempting to run Special Forces with these jumpers and the Johnny Nero PIC looks to get through loading the FPGA and starting to execute code on the CPU... then halts (1 LED lit). Though I don't have a Special Forces PIC to try, so I can't 100% confirm there isn't some other difference causing it to halt.
I did clip the logic analyzer on the PIC, and it doesn't appear that the PIC itself is halting the CPU, but instead I think the FPGA does it. I still need to look more closely, but there are two reset lines from the FPGA to the CPU (CPU_RESET_N and CPU_COLD_RST_N), and I suspect one or both of those are what's stopping the CPU. They have pulldown resistors, so if the FPGA simply releases those pins instead of driving them low, maybe you could manually pull them high to keep the CPU running (or cut the traces). But the CPU also accesses the boot ROM through the FPGA, so if the FPGA isn't happy, it kinda has the CPU by the balls.
And MAME also emulates some very simple PIC stuff, but the PIC actually does a lot at startup... it looks like the FPGA bitfile is streamed out of ROM directly to the PIC, which loads it over the FPGA JTAG lines. I assume shortly after the FPGA is loaded the PIC writes something to the FPGA, which it detects is incorrect. Presumably to obfuscate what's actually causing the halt (or maybe just waiting a timeout period for the correct data to be written), they allow the CPU to start running code, then halting after a short period.
Since MAME doesn't correctly emulate the FPGA, it makes sense that it shows video at boot, since they're mapping the boot ROM directly to the CPU, rather than getting killed by the FPGA.
Anyway, if anyone has a real Special Forces PCB and can verify those resistor changes, that'd be cool. And if you have a good Johnny Nero and bad Special Forces, you could try making these changes to the Johnny Nero board and swapping the PIC (and boot ROM/HDD)... be sure to post the results if you do!
DogP


