Page 1 of 1

Charge Pump Lockout Defeating Methods - Are they Unsafe?

Posted: Wed Jun 01, 2016 7:40 pm
by Great Hierophant
Unlicensed cartridge makers used several methods to defeat the lockout chips found in the NES front loading console. Tengen cloned the lockout chip, but companies like AVE, Color Dreams and Codemasters used charge pumps to send (usually) negative voltages to crash the lockout chip so it would not continually reset the console. Depending on the revision of the front loader, these charge pumps would succeed or fail. I believe there were revisions 04 to 11 released to the general public and revision 11 has resistors on the two lines (35 and 70) to prevent the negative voltages from having an effect on the lockout chip.

However, Nintendo eliminated the lockout chip in the top loader and it never was included in the 60-pin Famicoms or any clones, 60-pin or 72-pin. In these consoles, the charge pump circuitry is still connected to the positive voltages and ground planes, the software still toggles the circuitry, but the spikes have nowhere to go, except for the top loader. I am not sure what the lockout chip pins connect to, if anything, on the top loader. kevtris stated that the Camerica circuit, which has an A/B switch, will cause issues on a top loader if flipped to the A position :
The infamous switch on the back of the cart simply connects the negative supply to the cart edge. Toploaders will NOT be happy if it is turned on! This will cause the circuit to draw tons of current, which will most likely fry it if the console is left on too long. On my console, it causes the screen to go black with grey wavy lines, and the audio produces a loud buzz.
Would any of the other circuits (which cannot be turned off like Camerica's) have this problem?

Is this problem a non-issue in a 60-pin console, where pins 35 & 70 are not connected?

Is the continued use of these circuits likely to damage the lockout chip over time?

Re: Charge Pump Lockout Defeating Methods - Are they Unsafe?

Posted: Fri Jun 03, 2016 1:15 am
by FrankenGraphics
Is the continued use of these circuits likely to damage the lockout chip over time?
Possibly yes, you may shorten the life cycle of the lockout chip. It's hard to tell how robust it is, but components do get weared from excessives, switching, and, if that's the case, heat. One thing we do know is that it wasn't designed for this purpose.

Re: Charge Pump Lockout Defeating Methods - Are they Unsafe?

Posted: Sat Aug 13, 2016 4:56 am
by sepi
Worst case i have seen was controldeck with defective regulator. After prolonged use, even the genuine gamecarts started to crash. Probably logic voltage (+5V) had risen up significantly, and not only damaged the controldeck, but the games too.

Re: Charge Pump Lockout Defeating Methods - Are they Unsafe?

Posted: Sat Aug 13, 2016 8:30 pm
by Memblers
Crazy. Similarly, I saw a guy on NintendoAge who bought some SNES games from a store that didn't work, opened them up and all of the chips were exploded. Could have been a similar kind of thing.

sepi, haven't seen you around for a while, man. :)

Re: Charge Pump Lockout Defeating Methods - Are they Unsafe?

Posted: Sun Aug 14, 2016 3:45 am
by sepi
Voltage required to explode the core out the IC is suprisingly low. (I have done this few times accidentally!) I would stay away from piratecarts, or at least render the lockout defeat inactive. Negative voltages, or transients are a bad thing. I doubt that piratecart designers paid very little attention if their product was safe to use or not.

I think rabbits are the second best way to destroy your NES controldeck.

@Memblers I have been visiting this board regurarly, i just have not been posting anything, until now!

Re: Charge Pump Lockout Defeating Methods - Are they Unsafe?

Posted: Sun Aug 14, 2016 5:35 am
by tepples
sepi wrote:I would stay away from piratecarts, or at least render the lockout defeat inactive. Negative voltages, or transients are a bad thing. I doubt that piratecart designers paid very little attention if their product was safe to use or not.
Just pirate carts, or also non-Tengen unlicensed carts as well? The Color Dreams boot code tries gentler methods to freeze the lock before bringing out the big guns several resets later.
I think rabbits are the second best way to destroy your NES controldeck.
Yet Tengen's Rabbit chip is the only commercial-era lockout defeat that doesn't send negative voltage into the lock.

Re: Charge Pump Lockout Defeating Methods - Are they Unsafe?

Posted: Sun Aug 14, 2016 4:23 pm
by Great Hierophant
I understand that Rev. 11, the last revision of the NES front loader, is pretty resilient when it comes to lockout defeating methods of the charge pump/negative voltage variety. AVE published a method in some of its later game manuals (Deathbots, Wally Bear) to defeat it. Has anyone ever tested to see how resistant it is to unlicensed games>