From @@@@@@@@@@@@@@@@ Thu Sep 21 11:13:43 2000 +1300 Status: X-Status: X-Keywords: Received: (from majordomo@localhost) by gem.win.co.nz (8.9.3/8.9.3) id LAA11667 for notator-list; Thu, 21 Sep 2000 11:13:43 +1200 Received: from tos (tos.gem.win.co.nz [210.55.214.18]) by gem.win.co.nz (8.9.3/8.9.3) with SMTP id LAA11664 for <@@@@@@@@@@@@@@@@@@@@@>; Thu, 21 Sep 2000 11:13:39 +1200 Received: from localhost by tos with smtp (Smail3.1.29.5 #1) id m13bt7Y-0002hDC; Thu, 21 Sep 100 11:17 NZST Date: Thu, 21 Sep 2000 11:17:45 +1200 From: Mario Becroft <@@@@@@@@@@@@@@@@> To: @@@@@@@@@@@@@@@@@@@@@ Subject: Re: [NSL] Re: [Notator] What's in Unitor? In-Reply-To: <@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@> Message-ID: <@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: @@@@@@@@@@@@@@@@@@@@@@@@@@@ Precedence: bulk Reply-To: @@@@@@@@@@@@@@@@@@@@@ X-header: -------------------------------------------------------- X-header: Unsubscribe : @@@@@@@@@@@@@@@@@@@@@@@@@@@@@ X-header: Notator WWW : http://www.crosswinds.net/~notator/ X-header: List problems: @@@@@@@@@@@@@@@@@@@@@@@@@@@ X-header: -------------------------------------------------------- [Notator/Creator SL mailing list] On Wed, 20 Sep 2000, Bill Varley wrote: > Your suspicions are correct, the EP330PC chip is a security circuit. > To 'peak; inside would probably require removing the chip ( without damage ) > and placing it in a socket which would pass through the contacts to the > original board ( so Notator could boot ) and also parallel the signals to > another device ( computer? ) which will "record" the transistions on the > pins during Notators boot-up, and beyond. If this allowed us to grab the > data-in and data-out of the chip, we would have the 'key' to unlocking > Notator... uhm...I think. It is not a PROM. Our Unitor cartridge has a EP600 in it which is a 16-macrocell PLD. EP330 looks rather like an earlier Altera PLD, but I can't find a reference to the EP330 exactly. Perhaps Hallvard could check that this really is the correct number. There is no need to remove the chip to look what is going in and out of it; you can attach a logic analyser to the chip without removing it, or attach a logic analyser to the bus elsewhere. I have done this, but unfortunately it does not easily yield useful information. It is known that it is impossible to determine the operation of an unknown device of arbitrary complexity simply by specifying input data and observing the output. However in this case we know that the PLD has only 16 bits of state information, we also know that some pins of the PLD have special functions such as clocks, we know the limitations as to the logic functions which can be formed in the PLD, and we have some ideas about the function of the device. It would be possible to reverse-engineer, but it would not be easy. Unfortunately I do not have complete information on those early PLDs, but there is a chance that one of them does not have a security feature. In that case we could read back the fuse map from a device. If you cannot reverse-engineer the PLD, then you may yet be able to duplicate the rest of the device and make a board that can be used with an existing Notator dongle. However even this may be difficult since, it looks to me as if the Unitor also has a MCU (the big 40-pin chip) which probably has code security. I have not looked at this in any detail, but assuming it is an MCU, you will either have to read out the code (difficult if it has security) or reverse-engineer the function of the MCU. It would probably be easier to reverse-engineer the interface to the Unitor and design a compatible unit from scratch. -- Mario Becroft # Tariland, New Zealand Atari User Group @@@@@@@@@@@@@@@@ # Atari Hardware Developments http://gem.win.co.nz/ # >>> NEW MIDI-3 <<< __________________________________________________________ / Unsubscribe from the list? send the words: \ \ UNSUBSCRIBE NOTATOR to: @@@@@@@@@@@@@@@@@@@@@@@ / ----------------------------------------------------------