byuu's message board

For discussion of projects related to www.byuu.org/


1, 2  Next
Feasibility question: IC inside of another IC? 
Author Message

Joined: Fri 10 Apr 2009, 15:00:08

Posts: 13668
Post Feasibility question: IC inside of another IC?
So it occurs to me that at this point, reproductions of boxes, manuals and labels are getting to a point where the average person can't tell them apart, at least without the original nearby. The only obviously hard to fake area left is the game PCB. Very clear when a MaskROM has been replaced with a NOR FlashROM adapter board, or an EEPROM.

So I was wondering, is it possible to take an ultra-tiny NOR FlashROM chip (eg the size of a MicroSD card), and "embed" it by forming a larger fake plastic "MaskROM" package around it? (obviously with the wires inside the package doing the pinout conversion.) Then you could stamp that chip with what looks like the original MaskROM writing (eg SNS-PL-0 and whatnot), and professionally reflow a cheaper game's PCB to swap out just the ROM chip. If so, how much would such a thing cost? (I don't want to do it, just curious.)

I realize that at the $100 a cart level, nobody is going to go to this level of extreme. But as games are reaching thousands of dollars, and in some rare cases tens of thousands of dollars, it seems like if this is doable, that eventually people are going to start trying it when the potential profits are high enough.

I also realize that the obvious way to detect such a thing would be through X-raying the chips, but that's well out of reach of just about everyone.

Trying to get a feel for if this is possible, and if so, at what price point it will start to become profitable for scammers.

Mon 13 Jan 2014, 13:12:07
User avatar

Joined: Fri 25 Nov 2011, 21:23:17

Posts: 175
Location: San Diego, California, USA
Post Re: Feasibility question: IC inside of another IC?
Yes that's very doable. You might as well just go over to your friendly neighborhood IC manufacturer (that's what China is like, yes?), and get them to make you an EEPROM with no markings and the right pinout, then get it stamped with the labels on the original Mask ROMs.

_________________
Twitter | Daifukkat.su
<S.Yagawa> I like the challenge of "doing the impossible" with older hardware, and pushing it as far as it can go
<T.Fuzisawa> [How does one become a game designer?] Play every game ever made. Then think of something that has never been done and make it a reality.

Mon 13 Jan 2014, 13:16:13

Joined: Fri 10 Apr 2009, 15:00:08

Posts: 13668
Post Re: Feasibility question: IC inside of another IC?
Yeah I was thinking of that as well, as being the next step. But it seemed like that'd require fabrication of an entirely new die for the pinout to be native to Nintendo's non-standard one. So it'd probably? cost more than a simple package-inside-a-package.

The final escalation above that would be actually setting up a factory to fabricate '90s-era MaskROM chips on demand. Which if you had a group of 50 games worth $10,000+, that would start to be absolutely serious money. Enough so to even run long-con scams where people build up community rapport and seller history prior to selling off the expensive fakes.

Mon 13 Jan 2014, 13:32:43

Joined: Wed 06 May 2009, 04:13:19

Posts: 4543
Post Re: Feasibility question: IC inside of another IC?
I think it becomes more economically viable to do convincing reproductions of disk-based games. If you're expending that much effort, you can probably fake copy-protected disks too. Pirated PS1 games that run on an unmodded PS1. Think of the possibilities.

_________________
This post best viewed at 800x600
;write ! ! !

Mon 13 Jan 2014, 14:16:24
User avatar

Joined: Tue 02 Nov 2010, 01:00:37

Posts: 181
Post Re: Feasibility question: IC inside of another IC?
byuu wrote:
But it seemed like that'd require fabrication of an entirely new die for the pinout to be native to Nintendo's non-standard one.


Nintendo's Mask ROMs use a standard JEDEC pinout, so that would not be so hard to find.

cYa,

Tauwasser

Mon 13 Jan 2014, 14:48:17

Joined: Tue 21 Feb 2012, 05:42:15

Posts: 2564
Post Re: Feasibility question: IC inside of another IC?
Here's another question: exactly how sure are we that there's nothing at this level of craziness already happening somewhere? Just curious. And by that I mean repro PCBs that look identical or very close to legit ones.

_________________
"It's easy to win forgiveness for being wrong; being right is what gets you into real trouble." --Bjarne Stroustrup

Mon 13 Jan 2014, 14:51:31

Joined: Fri 10 Apr 2009, 15:00:08

Posts: 13668
Post Re: Feasibility question: IC inside of another IC?
I don't think it'd be worthwhile to try and fake an entire PCB from the ground up.

The PCB itself wouldn't be too horrific to fake (you can probably be off by ~2% on color shades and such without raising eyebrows), but you have the CIC to contend with, the MAD-1 mapper, and so forth. It would seem much easier to just swap the ROMs on a $1 sports cart.

I suppose there's no way of knowing if this has been done already or not.

> Nintendo's Mask ROMs use a standard JEDEC pinout, so that would not be so hard to find.

Oh. Then why are there always rewiring adapter diagrams everywhere for repro carts? I've never seen an EEPROM or FlashROM job that wasn't on a daughterboard or a wirefest. If they were common chips, you'd think a few could be cleanly soldered into the old ROM slot, right?

Mon 13 Jan 2014, 15:26:08
User avatar

Joined: Fri 25 Nov 2011, 21:23:17

Posts: 175
Location: San Diego, California, USA
Post Re: Feasibility question: IC inside of another IC?
byuu wrote:
Yeah I was thinking of that as well, as being the next step. But it seemed like that'd require fabrication of an entirely new die for the pinout to be native to Nintendo's non-standard one. So it'd probably? cost more than a simple package-inside-a-package.

I don't think so. Designing the new die would probably be very simple (though if it actually is a JEDEC standard, then it's probably already done for them), and making some sort of adapter in a package doesn't seem much more economical.

byuu wrote:
The final escalation above that would be actually setting up a factory to fabricate '90s-era MaskROM chips on demand.

I don't know why they would do this, unless it's worth saving a few pennies to make it an OTP ROM instead of just an EEPROM/EPROM. If there's no windows and the labeling looks right, I don't think anybody would try electrically erasing an EEPROM on their board to see if it's not actually a Mask ROM (unless they were super paranoid).

I've heard stories of original arcade PCBs using "Mask ROMs" that were just EPROMs with no windows. So, it might not be too easy to find fakes if this becomes/has become a real thing.

_________________
Twitter | Daifukkat.su
<S.Yagawa> I like the challenge of "doing the impossible" with older hardware, and pushing it as far as it can go
<T.Fuzisawa> [How does one become a game designer?] Play every game ever made. Then think of something that has never been done and make it a reality.

Mon 13 Jan 2014, 15:53:11

Joined: Fri 10 Apr 2009, 15:00:08

Posts: 13668
Post Re: Feasibility question: IC inside of another IC?
> I don't know why they would do this

Long-term stuff. Pretend the fake chips became well known, game cart prices were reaching $20,000+, and a service was started that would X-ray your game ICs. Hard to say how much detail could be made out, but if the die size was way off, that'd be a really obvious giveaway.

Mon 13 Jan 2014, 15:58:36
User avatar

Joined: Fri 10 Apr 2009, 18:17:56

Posts: 3308
Location: Germany
Post Re: Feasibility question: IC inside of another IC?
byuu wrote:
I also realize that the obvious way to detect such a thing would be through X-raying the chips, but that's well out of reach of just about everyone.

I think it was this presentation where non-professionals showed their x-ray discoveries: viewtopic.php?f=26&t=4477

Not sure when exactly in the video they talked about it...

_________________
"The first time I watched [FLCL] I was like 12 or 13 and I was scared and confused." - isthisagoodusername
"I think it's more natural for human beings to be anxious. I think happiness is nothing but an illusion." - Hideaki Anno
"If you can't joke about incest in anime then what kind of world are we living in?!" - gothicmaster

Mon 13 Jan 2014, 16:36:51

Joined: Thu 05 Aug 2010, 18:46:09

Posts: 138
Post Re: Feasibility question: IC inside of another IC?
byuu wrote:
But it seemed like that'd require fabrication of an entirely new die for the pinout to be native to Nintendo's non-standard one.

Why? Simply take a run-of-the-mill die, then run the bonding wires to different pins. And to me, that sounds like a very easily thing to do if you're a fab.

Mon 13 Jan 2014, 17:03:26
User avatar

Joined: Tue 02 Nov 2010, 01:00:37

Posts: 181
Post Re: Feasibility question: IC inside of another IC?
byuu wrote:
Oh. Then why are there always rewiring adapter diagrams everywhere for repro carts? I've never seen an EEPROM or FlashROM job that wasn't on a daughterboard or a wirefest. If they were common chips, you'd think a few could be cleanly soldered into the old ROM slot, right?


That's because ROMs, EPROMS, EEPROMS and FLASH all have standard footprints that differ from each other. But they're still standard footprints, not custom Nintendo super-secret ones. However, you can see a clear progression on pinouts from ROM to EPROM and so on.

cYa,

Tauwasser

Mon 13 Jan 2014, 17:05:54

Joined: Fri 10 Apr 2009, 15:00:08

Posts: 13668
Post Re: Feasibility question: IC inside of another IC?
Regardless if they are actually standard, I've certainly heard a lot of people say the pinouts weren't standard. Just a quick Google search:

http://emu-docs.org/Super%20NES/Cartridges/sfcdev2.php

"All licensed SNES games 8-bit mask ROMs, that usually have a non-standard pinout compared to similar EPROM parts. Nintendo did the same thing with the NES, presumably to optimize the PCB layout of cartridges, or perhaps just to be difficult."

http://www.snescentral.com/article.php?id=0909

"You can replace the ROM in a SNES cart but since Nintendo uses a slightly non-standard ROM pinout you'll have to do some re-wiring to get it to work. This re-wiring is minimal for small ROMs but for a 32Mbit ROM you've got a major problem which likely will prevent installation in a standard cart shell."

I also never said they were super-secret. It's pretty easy even for me to trace pins with a multimeter. The point seemed to be more about making it ever so slightly more difficult to swap in EPROMs to copy games.

If ROM and EPROM naturally have different pinouts as you say, then that explains why they don't match up, since nobody's fabbing homebrew MaskROMs due to cost.

Mon 13 Jan 2014, 17:13:59
User avatar

Joined: Sat 01 Dec 2012, 01:50:23

Posts: 240
Location: Oregon, USA
Post Re: Feasibility question: IC inside of another IC?
Tauwasser wrote:
byuu wrote:
Oh. Then why are there always rewiring adapter diagrams everywhere for repro carts? I've never seen an EEPROM or FlashROM job that wasn't on a daughterboard or a wirefest. If they were common chips, you'd think a few could be cleanly soldered into the old ROM slot, right?


That's because ROMs, EPROMS, EEPROMS and FLASH all have standard footprints that differ from each other. But they're still standard footprints, not custom Nintendo super-secret ones. However, you can see a clear progression on pinouts from ROM to EPROM and so on.

cYa,

Tauwasser


I've looked through section 3.2 of the JESD21-C standards, and I can't find anything that matches the SNES MaskROM pinout, especially with respect to the /OE signal pin assignment (most JEDEC pinouts have the /CE and /OE signals are only separated by a single pin, but on the SNES MaskROMs, there are 8 pins between them), and also a few of the address lines are switched around (see figure 3.2.1-5 of the JEDEC docs and compare pin 1 = A19 vs SNES MaskROM pin 1 = A17). In addition to this, I can't find a JEDEC spec for a 36-DIP package ROM at all. Then you have weird stuff like this (which I've independently confirmed to be the case)... so I can say that I've looked for, but have yet to find, any official manufacturer docs that match the pinout found on the SNES MaskROMs.

That having been said, the links byuu quoted, as well as pretty much every discussion surrounding the issue in repro circles, are purely speculative on the part of their authors, and should be taken as such.

As to the original question, yes, it's entirely possible to create knockoff chips. Chinese manufacturers have been known to make knockoff microcontrollers and CPLD's, so a MaskROM would be easy, even with the pinout considerations. It wouldn't even be a matter of an "IC inside of another IC" it would just be making the IC's the same way they always were. Honestly, they'd probably choose to go with a OTP or PROM die rather than a MaskROM die, because you couldn't tell the difference without an x-ray machine... but for the sake of the hypothetical question, you could even have MaskROM dice made. It's just a matter of having access to a fab willing to make them, and having the money to order a run large enough to make it worth their while, neither of which is trivial, and that's the reason it hasn't happend, and probably won't. So yes, it's entirely possible to make a reproduction that looks exactly like the original, down to having a new run of MaskROMs and custom ASICs... but it's highly unlikely, and certainly not cost effective. Even the most valuable carts probably wouldn't be able to recoup the costs due to low quantity...

Mon 13 Jan 2014, 22:08:55
User avatar

Joined: Tue 02 Nov 2010, 01:00:37

Posts: 181
Post Re: Feasibility question: IC inside of another IC?
qwertymodo wrote:
I've looked through section 3.2 of the JESD21-C standards, and I can't find anything that matches the SNES MaskROM pinout, especially with respect to the /OE signal pin assignment (most JEDEC pinouts have the /CE and /OE signals are only separated by a single pin, but on the SNES MaskROMs, there are 8 pins between them), and also a few of the address lines are switched around (see figure 3.2.1-5 of the JEDEC docs and compare pin 1 = A19 vs SNES MaskROM pin 1 = A17). In addition to this, I can't find a JEDEC spec for a 36-DIP package ROM at all. Then you have weird stuff like this (which I've independently confirmed to be the case)... so I can say that I've looked for, but have yet to find, any official manufacturer docs that match the pinout found on the SNES MaskROMs.


Thanks for the link. I did not know that they used the same part numbers with different pinouts :| Game Boy is all JEDEC and a quick google turned up NES and SNES to be too.

qwertymodo wrote:
That having been said, the links byuu quoted, as well as pretty much every discussion surrounding the issue in repro circles, are purely speculative on the part of their authors, and should be taken as such.


I wonder if anyone ever really looked at the ROMs. Test if the VCC pins are actually internally connected and whether the adressing is correct? For instance, GB uses A15 (from GEC) as #ROM_CE all the time, just because it's convenient. One might likely mistake this for the actual A15 and label all higher-order address lines +1.

cYa,

Tauwasser

Tue 14 Jan 2014, 00:44:59
1, 2  Next

Who is online

Users browsing this forum: No registered users and 0 guests

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum