User avatar
intric8
Seattle, WA, USA

Posted Sat Aug 18, 2018 9:06 am

Video update on the current state of the project to reverse engineer the Amiga 1000 Rejuvenator

This is the second update to the Rejuvenator project. Part 1 can be found here.

In the last Rejuvenator video I demonstrated how we successfully installed it (finally!) and played a demo that required 1MB of chip to run. And it played it flawlessly. Showing our board actually works was milestone #1.

A few weeks before that same time, the company we were working with to help reverse engineer the board pulled out of the project. It was a pretty major blow. But we soon identified and began talks with another firm - one that had reverse engineered other boards and had an excellent track record in doing so. Those talks are on-going and have been very productive. It's worth noting that they are not experts in Amiga hardware. They are Apple experts. But they are extremely professional and know what they are doing.

We agreed as a team that, before trying to recreate the board, we should attempt to read the PAL (Programmable Array Logic) chips. If we can't decipher the logic in the PAL chips and write them to new chips - and have my working board recognize them properly. This will be major milestone #2.

The PALs have very specific and custom equations and logic written into them that perform specific tasks on the board. If the PALs can’t be read, we can’t write them to new chips. And if that’s the case, the project is pretty much dead in the water.

While I was experimenting with my installed and fully functioning Rejuvenator board, what I didn’t realize was a tiny particle of battery acid had floated off the leaking battery and landed quietly on top of one of the 84 pins that house the Agnus chip. When I popped my Agnus out, the pin literally fell off like an old dried up leaf giving up on it’s branch for autumn. I couldn’t believe it.

Luckily, EzdineG volunteered to fix the problem. While he was doing the repair, he hooked up one of the PALs to his own personal reader. The results were not good.

EzdineG:
I've got my hands on Eric's Rejuvenator and tried to read the PAL's with a TL866A (as GAL16v8 and GAL20V8). It appears they're all protected, as all I can see are 11111111's when read.
What we need to do next is send the board/chips to another source and have a second test performed. If that second test returns with the same results, we will be at a cross roads.

We will have to determine, first and foremost, if the project should continue. It may still be possible to reverse engineer the PAL chips, but we'd be entering much murkier waters.

Joethezombie:
I would think the best bet would be to trace the pins of each PAL and identify which signals are on which pins. Then reference the original Commodore equations and create an approximation. Then use a logic analyzer comparing the original Rejuvenator PALs with the approximation could give a very good idea of what would need fixing. Be sure your replacement chips are the same speed or faster than the existing.

Another option I have been toying with is using an Arduino Mega to send every possible combination of inputs to the chip while monitoring the outputs and create a truth table which could then be minimized to the proper equations. It's tough to realize, however. The logic can get exponentially difficult to decipher once latches, flip-flops, and output enable equations get assigned and looped back into other equations. I think the 20L8 only allows for 5 or 6 types of latches, and there are so few product terms that it just might be possible. I'm currently working on this to decode some other 20L8, I have not had any success.
mr.t.guru:
This is exactly what Charles MacDonald's PAL reader does. I have one here and used it a few times to dump PALs for use with MAME. The dump is pretty raw and has to be run through a program Charles wrote which creates the equations. Then that file has to be put into WinCUPL and the jed created. Of course at any stage the read/conversion can fail either in the hardware reader or software equation converter then you have done nothing except lost a lot of time.
So, there may be a path here but it won't be easy. Fingers crossed a second reading brings better results.

Also, I was able to convince the previous owner of Expert Services and owner of the bare circuit board (the only one known to exist as far as I know) to sell it to me. So the bare board is now mine to do with as I wish.

Regardless of the success of our efforts with the PAL chips, there is a company I can ship the board to that can recreate it. They destroy the board in the process; they actually sand it down and analyze it layer by layer to create a perfect copy. We'd then have the GERBERs necessary to remake the board in the future if/when the PALs are deciphered. I am leaning strongly in this direction and getting that ball rolling soon. So if our efforts fail, perhaps some one else will be able to hit the milestone we might miss.
Attachments
bare-board.jpg
The bare Rejuvenator board is now my own personal property. Huge thanks to Scott Bennett for selling it to me.


User avatar
joethezombie
Twin Falls, ID

Posted Sat Aug 18, 2018 11:24 am

Personal opinion here,

I don't think sanding that board down is a good idea. Destructive techniques should be used as an absolute last resort. That board looks relatively simple to tone-out, and most of the traces are pretty evident just with illumination. Certainly give that a try firstly before resorting to a complete loss of your only sample.

Another thing regarding the PALs-- I also have a Charles MacDonald reader, the problem with it and the associated software is it is incapable of identifying latches or flip-flops. You'd have to toggle all the I/O pins to check for previous state or if the current state is tri-state for each combination of inputs. I'm hoping to build on that functionality, but as stated, it gets exponentially difficult the more equations are tied to the latch, if multiple latches exist, or if a latch is tied to an output enable. These types of logic equate to a rudimentary memory in the chip, not a real time input = output equation. It also doesn't work with 24 pin PALs.

Finally, when decoding the PowerCache PAL, before I had my breakthrough moment, I had contacted a firm based in China that advertises a 100% success rate of logic extraction. They use a technique to remove the casing of the PAL around the security fuse, and rebuild the gate. This allows them to then simply read the program out. You don't get your chip back, they claim doing so would give away their trade secret. The cost quoted to me was $150 per chip.

Like I said, I ended up not needing that service, but tread very lightly. Certainly explore all other avenues. When searching for the legitimacy of their claim, I could not find a single individual that had posted to a forum or blog that had used the service. I was going to program a protected test PAL with a very complex set of instructions including a latch and equations that are never output (output enable turned off) and see if the service was legitimate. If their extraction matched my program, only then would I send my chip. A google search reveals a few companies that advertise this service, the one I was looking at was break-ic.com
Last edited by joethezombie on Sat Aug 18, 2018 2:26 pm, edited 1 time in total.

User avatar
nonarkitten

Posted Sat Aug 18, 2018 1:00 pm

There is not one flip-flop on the original Amiga 1000 daughterboard, but there were a couple of octal latches. I suspect these were for locking out the WOM and shouldn't be present on the Rejuvenator.

User avatar
nonarkitten

Posted Sat Aug 18, 2018 1:00 pm

Amiga 1000 Daughterboard Chips

Four PAL 16L8 "DOUGCAS", "DPALCAS", "DAUGEN", "DPALEN" (U6J, U6K, U6L, U6N)

5x74LS244P (U5K, U4L, U4J, U3J, U3L) (line driver -- used primary for synchronization and not useful for functionality folded into a PLD).

1x74F02N (U5M) (Quad 2-input NOR gate)
1x74LS393 (U5L) (4-stage binary counter)

2x74LS373 (U4H, U4K) (octal latch, 3-state output)

4x74F257PC (U2H, U2J, U1K, U1L) (Quad 2:1 MUX)
1x74F139PC (U1H) (Dual 2:4 MUX)

8xUPD41464 DRAM (make up the Kickstart WOM)

User avatar
intric8
Seattle, WA, USA

Posted Sat Aug 18, 2018 1:04 pm

@joe I've sent you a PM.

@nonarkitten, thanks for the info.

User avatar
joethezombie
Twin Falls, ID

Posted Sat Aug 18, 2018 1:54 pm

nonarkitten wrote:There is not one flip-flop on the original Amiga 1000 daughterboard, but there were a couple of octal latches. I suspect these were for locking out the WOM and shouldn't be present on the Rejuvenator.
Thanks nonarkitten. That's good to know! From the Update #1 thread,
joethezombie wrote:Do recognize that The Rejuvenator replaces the existing daughterboard. Most likely, the contents of the PALs are going to be very close to the original Commodore versions, which we know the equations.
We actually know all the equations from the original Commodore PALs. I suspect the Rejuvenator PALs will be very, very close to the originals. Modified slightly for larger memory access. I think someone with a logic analyzer and some time could probably recreate the equations using the originals as a reference.

User avatar
nonarkitten

Posted Sat Aug 18, 2018 5:41 pm

I'll just add I don't think these PAL chips will be really close to the original Amiga. The Rejuvenator works a lot like the 1MB hack for the Amiga 1000 -- it needs to leverage signals the original chips ignored (extra address pins) and also doesn't need others (like the WOM-locking behaviour). This is all complicated by the fact that the Fat Agnus chips folded a lot of the function of these chips in -- including address decoding and CAS/RAS generation. Furthermore, the Rejuvenator also made the original 512KB on the Amiga 1000 motherboard available as true fast -- like how is that even possible? If we can't brute-force the code out from these chips, I'm really worried for the future of this project...

User avatar
Dynamic_Computing

Posted Tue Aug 21, 2018 6:34 pm

nonarkitten wrote:There is not one flip-flop on the original Amiga 1000 daughterboard, but there were a couple of octal latches. I suspect these were for locking out the WOM and shouldn't be present on the Rejuvenator.
Sounds like you are making up words! I do that sometimes having fun with my customers when they ask me about something that technical I just did for them. "well, after I recalibrated your freem tubes, the ion flux was able to re-agritize. And presto! Your machine works again!"

User avatar
nonarkitten

Posted Tue Aug 21, 2018 9:17 pm

Dynamic_Computing wrote:
nonarkitten wrote:There is not one flip-flop on the original Amiga 1000 daughterboard, but there were a couple of octal latches. I suspect these were for locking out the WOM and shouldn't be present on the Rejuvenator.
Sounds like you are making up words! I do that sometimes having fun with my customers when they ask me about something that technical I just did for them. "well, after I recalibrated your freem tubes, the ion flux was able to re-agritize. And presto! Your machine works again!"
Ah, haha?

User avatar
joethezombie
Twin Falls, ID

Posted Wed Aug 22, 2018 8:17 am

LOL, yeah, the terms do sound rather whimsical. There's some great tutorials on YouTube by a gentleman named Ben Eater that shows flip-flops, and several different latches. He builds an entire 8-bit computer, pretty interesting stuff.

Don't let anyone tell you that if a PAL isn't the registered version, that it can be easily decoded-- they can still make use of these methods. You can soon realize just how difficult this logic can be to decode, because using these techniques the PAL becomes a memory device, where the current state depends on the previous state. Not just a simple input combination = output combination.





Return to “Hardware”