Data Extraction project MC1468705G2.

[cjs]

@cjs you were right !

I cannot tell you how happy I am to hear that!

Well, obviously, the "cjs is right" thing, too, but I'm particularly pleased that we have been able to figure out a way (even if a bit painful) to extract that ROM image, because I'm always curious as to what's in some random ROM.

Some years ago I had made a binary to decimal logic probe that shows the decimal equivalent of the binary value, it only has a latency of 350nS...

Oh, I feel you! My probes are even worse, and I'm constantly looking at them and thinking, "surely it's been 400 ns already," and "ok, now, 500 ns and I'm still not seeing the result?"

I now need to devise a contraption to step through all possible bytes at each address with a ROM simulator, and an output to control the verify circuit and keep a record of each successful byte trial. I think I can do it with my SOL-20 and I can do some 8080 assembly language programming and use the parallel port...
The other possibility, that could suit me, is to do the whole thing in hardware (which is what I mainly do) and transfer the successful byte match into another ROM at the correct address directly, or a non-volatile RAM would be easier, I have plenty of spare FRAM from other projects,, so as to re-create the original file, likely it would only take some hours or overnight. Any suggestions welcome.

That sounds about how I would do it. I know that the modern way is to use a Pi Micro or other super-computer-MCU, but even as a software guy, honestly, it sounds easier to me (or at least more fun) to just put a tri-state buffer in front of an SRAM.

I'm really looking forward to seeing your results from this. And, as I mentioned, if you want some help with disassembly and reverse-engineering of the code, I'm happy to step up.

 

[Hugo Holden]

SRAM.

I'm really looking forward to seeing your results from this. And, as I mentioned, if you want some help with disassembly and reverse-engineering of the code, I'm happy to step up.

Thanks, as soon as I have made a system that works I will write it up and post it.

 

[Hugo Holden]

I can barely believe it myself. I have conquered my nemesis IC.

I built a circuit that contains about 13 IC's which plugs on to the Motorola programming board. And after about 27 hrs & 10 minutes after deploying it, I was able to extract the entire byte file from the IC.

I really wondered, over the last 40 years or so, if this would ever happen, finally it has. Not without a couple of very scary moments though as I will explain in the article.

I am in the process of writing up a very detailed article on this problem & how it was done. I can still barely believe it worked out.

I will post the article, as soon as it is finished, within the next week. Thank you all for the help, in making it possible.

I don't know if this video link will work, it shows the board in the process of extracting the byte file, and putting it in a Dallas DS1225 non volatile RAM, that looks a little weird, because it has an external battery added. All of my DS1225's have flat batteries these days.

Google Photos

Home for all your photos and videos, automatically organized and easy to share.

photos.google.com

 

[djg]

Nice work.

I don't know if this video link will work,

The requested URL was not found on this server. That’s all we know.

 

[Hugo Holden]

Nice work.


The requested URL was not found on this server. That’s all we know.

I have attached a still frame image.

 

[daver2]

Excellent.

It just shows, given enough brains on the job, you can crack most things...

 Dave

 

[Hugo Holden]

I have completed the basic article, it still needs some polishing.

I have provided a lot of detail with the schematics, IC pin numbers etc, to make is easier for anyone else wanting to replicate this.

I works very well, I have extracted the data from a number of the MCU's now, always a perfect result:

www.worldphaco.com/uploads/The%20MC1468705G2%20%20MCU%20ROM%20Data%20Extraction%20Project.pdf