Hugo Holden
Veteran Member
I have a very special VDU that uses this IC in its control system and looked at this problem before, but never convinced myself there is a way to do it, yet.
I want to replicate the IC. It was programmed at the factory. I can get blank IC's
The information to build the programmer for it is in this document, I can easily build this hardware and or modify it (if I have a sensible plan), but the problem is more complicated, to extract the original Eprom file:
I could wire it up without the Vpp voltage connected, to prevent damage to the original file/IC.
The boot loader inside this IC is designed to program the IC from a file held in an external eprom (such as an MCM2532) on the programming pcb. Clearly this internal firmware sequentially address a byte in the external eprom, programs it into the internal eprom, one by one. When that loop is finished, the internal firmware then runs a second verify loop, to compare its own internal eprom programmed bytes, one at a time with the external eprom, if they all match it throws up a verify light at the end of that loop.
The trouble is the firmware program in there has to complete a full loop of all the bytes to be checked and I don't know, if in verify mode, if that loop terminates at the moment it sees the first mismatched byte, if that was the case it might help the problem, because a rom simulator could be put in the external eprom socket and the address value remembered by an external device, to find the location where it didn't match, then the byte there could be tweaked until it matched and then incremented to the next address. Does that sound plausible ? But since the verify light only comes on if the whole file is good, that signal cannot be used to capture an address. Or the address where it stopped, might remain there on the address lines to the external eprom, I don't know.
(imagine that an IC that programs itself, it is like Daleks building themselves in factories)
The thing that I'm wondering: At any time in this program or verify process, would the data corresponding to the byte values in the internal Eprom, ever appear externally on the IC's pins, so if the process was slowed right down, with a very slow clock, the data values could be read ? But I think they probably remain internal to the IC and are "locked in", like the ultimate form of file security.
Or, is there any way anyone can think of, that the IC's external connections or function can be manipulated to view its internal eprom data or any system or method that might work ?
(There are some bytes that need to be programmed for the clock system etc, but probably I could get those right by trial and error).
I want to replicate the IC. It was programmed at the factory. I can get blank IC's
The information to build the programmer for it is in this document, I can easily build this hardware and or modify it (if I have a sensible plan), but the problem is more complicated, to extract the original Eprom file:
I could wire it up without the Vpp voltage connected, to prevent damage to the original file/IC.
The boot loader inside this IC is designed to program the IC from a file held in an external eprom (such as an MCM2532) on the programming pcb. Clearly this internal firmware sequentially address a byte in the external eprom, programs it into the internal eprom, one by one. When that loop is finished, the internal firmware then runs a second verify loop, to compare its own internal eprom programmed bytes, one at a time with the external eprom, if they all match it throws up a verify light at the end of that loop.
The trouble is the firmware program in there has to complete a full loop of all the bytes to be checked and I don't know, if in verify mode, if that loop terminates at the moment it sees the first mismatched byte, if that was the case it might help the problem, because a rom simulator could be put in the external eprom socket and the address value remembered by an external device, to find the location where it didn't match, then the byte there could be tweaked until it matched and then incremented to the next address. Does that sound plausible ? But since the verify light only comes on if the whole file is good, that signal cannot be used to capture an address. Or the address where it stopped, might remain there on the address lines to the external eprom, I don't know.
(imagine that an IC that programs itself, it is like Daleks building themselves in factories)
The thing that I'm wondering: At any time in this program or verify process, would the data corresponding to the byte values in the internal Eprom, ever appear externally on the IC's pins, so if the process was slowed right down, with a very slow clock, the data values could be read ? But I think they probably remain internal to the IC and are "locked in", like the ultimate form of file security.
Or, is there any way anyone can think of, that the IC's external connections or function can be manipulated to view its internal eprom data or any system or method that might work ?
(There are some bytes that need to be programmed for the clock system etc, but probably I could get those right by trial and error).
Last edited: