Page 1 of 5

Proof that pin #4 mod does not work

Posted: Tue Sep 04, 2012 2:14 pm
by jims cool
alright i've said it doesn't work a couple of times.. even before the code was dumped i tested and found it not to work... so now here is why the pin #4 to ground CIC fix doesn't work and locks the system

turns out not all 3193A's are the same.. although they are labeled the same "some" don't work with the pin #4 mod and lockout

from my post below
alright i just couldnt help myself it turns out the pin #4 mod is a backdoor put in by a programmer.. maybe it was fixed maybe it was added in later i don't know

literately when it would write the reset pin i see a "nop"

Code: Select all

; KILL_KEY:
010: 21      lbli 1     ; B = x0001 
048: 30      ldi 0      ; A = 0x0 
; DIE:
064: 00      nop         ; <--- oops instruction removed! =)
072: e4      t 064      ; jmp DIE
anyway wish i had more time for this.. but i need to get back to work.. i'll check back later..
this is the original code i posted

Code: Select all

; RESET_HOST_IF_KEY:
100:	7c 83	tml 103		; call SKIP_NEXT_IF_LOCK
160:	ef		t 16f		; jmp SET_RESET
170:	31		ldi 1		; A = 0x1
178:	21		lbli 1		; B = x0001
17c:	00		nop
17e:	00		nop
13f:	00		nop
15f:	cf		t 14f		; jmp CLEAR_RESET

SET_RESET:
16f: 30		ldi 0		; A = 0x0
177: 21		lbli 1		; B = x0001
17b: 46		out			; if key port1.0 = 00 (A)      ; reset
17d: 00		nop
13e: 00		nop
11f: 00		nop
CLEAR_RESET:
14f: 46		out			; if lock port1.0 = 01 (A)      ; clear reset if lock
167: 4c		rit			; return

; SKIP_NEXT_IF_LOCK:
103: 20      lbli 0      ; B = x0000
141: 55      in          ; A = port0
120: 67      ska 3       ; skip if A.3 = 1
150: 8f      t 10f       ; jmp DONTSKIP
168: 4d      ritsk       ; return and skip next instruction

; DONTSKIP:
10f: 4c      rit         ; return
NOTE: BL sets the output port

this function is called just before it recalculates the seeds

EDIT2: as requested by tepples for anyone who doesn't understand 4-bit sharp assembly code

"ldi" loads 4-bit's (1-nibble) into the (A)ccumulator
"lbli" loads the lower nibble of the B register called BL this selects what port the "out" instuction writes (A) to

the "tml" instructions call's the code block SKIP_NEXT_IF_LOCK..
this skips the next instruction on return if pin #4 is high (1) making the "lock out" go high and your game boot up

when pin #4 is low (0) it's in key mode the code jumps to SET_RESET and writes 0 to the "lock out" pin.. this is the same as holding reset for ever

this is how the lockout pin is wired
"lockout"----(CPU/PPU)---|>o---220ohm---LED---(+)

if you float pin 4 it's possible that it could work.. but i haven't had it work reliably.. i'll test later if this only effects some regions but i can't see sharp removing this part of the CIC code because it's also part of the CPU reset signal (clears reset after 15 bit transfers between lock and key)


almost finished coding my "TENNIS" firmware for the universal JCIC.. it's in the SNES section of the forum..
here's the link to the relevant thread
PLEASE DO NOT POST IN THIS THREAD ABOUT THE ABOVE LINKED THREAD

EDIT: tepples could you sticky this this thread?

Re: Proof that pin #4 mod does not work

Posted: Tue Sep 04, 2012 3:03 pm
by tepples
Could you add a plain English description of what's going on for people unfamiliar with CIC assembly language?

Re: Proof that pin #4 mod does not work

Posted: Tue Sep 04, 2012 4:44 pm
by 3gengames
It worked for me?

Any chance we'll get some PIC or AVR NES lock files to make our own? I've been waiting for that forever. And maybe a final, end all, seed included and explanation file for this whole SNES/NES CIC mess? :) That'd be awesome, I'd dedicate so much time to understand it.

Re: Proof that pin #4 mod does not work

Posted: Tue Sep 04, 2012 5:28 pm
by jims cool
I've updated the above post to reflect tepples request
3gengames wrote:It worked for me?
what region are you in? i can test it

please edit your post and move your other question to the other thread (linked above)

Re: Proof that pin #4 mod does not work

Posted: Wed Sep 05, 2012 3:52 am
by Jeroen
Well that's odd. Since it seems to work for everyone on the planet except for you?
Most people leave the pin floating, but I recall someone saying theres an internal pull-up/pull-down.

edit: heres an example of it working for someone who did not leave it floating
http://www.raphnet.net/electronique/nes ... mod_en.php

That guy is from Canada, and I don't believe he would lie.

My region is The Netherlands btw (Pal b)

edit2: are you stil feeding the cics a clock (since you seem to be doing it on a breadboard)?
Since I recall the whole point of making the cic think its a key is so that it doesnt generate a clock, so both the cic in cart and system just kinda don't operate anymore.

edit3: cohesive thoughts today! Iirc the whole key-key thing started because it was mentioned on the cic's patent.

Re: Proof that pin #4 mod does not work

Posted: Wed Sep 05, 2012 4:19 am
by 3gengames
I have a grounded and a floating system, both work, they're NTSC. And why only want this stickied? Why not discuss how everyone else has it working? :)

Re: Proof that pin #4 mod does not work

Posted: Wed Sep 05, 2012 4:29 am
by Jeroen
Ya I don't see the point of having this stickied. The guy has hardly proven it doesn't work (for all we know his testing setup is flawed) since it seems to work for everyone else. And I don't see how this discussion is any more special than any of the other threads.

Re: Proof that pin #4 mod does not work

Posted: Wed Sep 05, 2012 5:51 am
by jims cool
i tried it on my nes and the reset was held down

i figured it was a damaged chip.. i have about six 3193a's and it doesn't work with any of them..

i've never seen it work.. i've heard all over the place that it does
it kinda worked if i tapped on the power button a few times when i tested it on a bread board

i can only test with 6113,6113b1,3193a,3197a,3195a i have a 3198 but that ones for famicom box..
that code above is real..

the only explanation i can think of would be CIC clock on some boards was made cheap
instead of a resonator two capacitors an inverter and resistor.. it just uses the 2 resisters a resonator and inverter

i'm sure you've all already studied it and know how wrong i am.. i checked out your link it's a picture.. does that help me see it work or just tell me how it's done?

most people have the "NES-CPU-11" main board with the cheap CIC clock circuit that would explain the success of the pin-4 mod.. if that's even why it works for some people

it could also be a unmarked change by sharp in the chip to make them cheaper.. anyways unless you guys are going to post the part of the code that is "proof" i'm wrong feel free to seep back into the ignorance..

EDIT: code updated above.. added skip next if lock code block
EDIT2: he thinks it's the edge connector "it's completely inconsistent but at-least it doesn't flash" http://www.youtube.com/watch?v=cfUl7yE83w0

Re: Proof that pin #4 mod does not work

Posted: Wed Sep 05, 2012 7:00 am
by 3gengames
You are the first person ever that claims it doesn't work at all, and considering there's probably thousands of people who have done this and have no problems, I'm kinda shaky to believe you. Although I believe you, it's just there's too much evidence it does work. Maybe something else is wrong with your testing? But if it did actually fail to take the floating as a key setting and considered it a lock, why wouldn't it just reset on and off like normal and not just hold reset?

Re: Proof that pin #4 mod does not work

Posted: Wed Sep 05, 2012 7:24 am
by jims cool
i just tested it on a couple chips is seems to work on some but not all of them
all the tested chips fully function but some it doesn't work on.. weird :?
it's could be that they are label the same but they aren't the same
nintendo has a handful of copyright records for them.. they aren't damaged
it could have something to do with the random stream.. maybe one of the sixteen streams somehow effects it..

i know it works with some of the CIC's.. at the start of the code it clears the reset then later if it's the key and running it resets.. can see for myself now that it can work but it doesn't work on all of them for sure

anyway i was kind "p'd about the "why does this need a stick this guy".. and so on

as for your question it holds the reset specifically to prevent the pin-4 mod
so my guess is nintendo found out people were doing that and revised the code and labeled it the same.. that would put people off so it wouldn't go main steam back in the day

now that's a cool finding!!.. awesome if you ask me :lol:

EDIT: i tried two and they didnt work.. so i figure none of them did.. in the above post :lol:

Re: Proof that pin #4 mod does not work

Posted: Wed Sep 05, 2012 7:34 am
by 3gengames
Any chance you know the serial #'s of the systems that seem to have a revised/different CIC? That'd be cool and I'd love to test it by cutting pin 4, although all my NES's are below I believe 30 Million. Any chance you can try to dump the code of the revised ones to make sure they're revised? Man, still learning things about this damn system every day. :)

Re: Proof that pin #4 mod does not work

Posted: Wed Sep 05, 2012 7:44 am
by jims cool
i have seven nintendos 6 backups we will call them :lol: .. i'll post all my serial numbers later!..
glad it's figured out now though i'm not p'd anymore so I can get back to work now.

people gotta stop bashing each other on here.. and i'm not the first one to say that..it's crazy :wink:

EDIT: updated the post above to reflect the current findings (yellow writing at the top)
EDIT2: i'm thinking the code i posted didn't do the trick.. and they changed it a little.. after i'm done my other project (universal TENNIS/JCIC) i'll look deeper into whats going on. i'm just glad it's out in the open now :)

Re: Proof that pin #4 mod does not work

Posted: Wed Sep 05, 2012 8:19 am
by Jeroen
This is really weird though. My guess is that nesses this doesn't work on are extremely rare. (on acount of pretty much everyone claiming it worked for them over the years)
Maybe the last batch made before the toploader hit?

Re: Proof that pin #4 mod does not work

Posted: Wed Sep 05, 2012 8:25 am
by jims cool
Jeroen wrote:This is really weird though. My guess is that nesses this doesn't work on are extremely rare. (on acount of pretty much everyone claiming it worked for them over the years)
Maybe the last batch made before the toploader hit?
alright i just couldnt help myself it turns out the pin #4 mod is a backdoor put in by a programmer.. maybe it was fixed maybe it was added in later i don't know

literately when it would write the reset pin i see a "nop"

Code: Select all

; KILL_KEY:
010: 21      lbli 1     ; B = x0001 
048: 30      ldi 0      ; A = 0x0 
; DIE:
064: 00      nop         ; <--- oops instruction removed! =)
072: e4      t 064      ; jmp DIE
anyway wish i had more time for this.. but i need to get back to work.. i'll check back later..

Re: Proof that pin #4 mod does not work

Posted: Wed Sep 05, 2012 10:25 am
by Jeroen
WTH that is fucking strange to say the least.