Date: Fri, 29 Mar 1996 11:23:42 -0800 To: turbo-list@cpac.washington.edu From: Joe LoCicero X-Software: MLF v2.0, Copyright 1995 Subject: ANNC: How to play American games on a Japanece PCE or GT Addressed to: turbo-list@cpac.washington.edu tghack-list@cpac.washington.edu Dear friends: I have a technical announcement that's so important, it deserves to be crossposted to both lists. I have discovered how to defeat the US protection scheme on Japanese PC Engine and GT units. It turns out that there is a single pin on the HuC6280 chip (one of the 3 Hudson chips on the PCE, or the 4 Hudson chips on the GT) which is "tied" to +5V on the Japanese models, and GND (ground) on the US models. The initialization code in US games checks this pin (P29), and will not start the game unless it is tied to GND. A big thanks to Dave Shadoff, who pushed on me until I figured this out. The pin-tied-low-instead-of-high concept had occured to me, since it's similar to other HW protection schemes, but it took Dave's reassessment, stubbornness and relentlessness to get me motivated enough to probe for 2 hours with a DVM and a soldering iron. ** Technical Explanation If you were around when the original postings were made to the TGList about the protection code, you might remember seeing this code snippet posted by Nimai Malle, a former Hudson employee: cold_start: if 0 ;protect code (25 bytes) sei ;Set interupt dissable csl ;(Forgot: Only used here in all me sources) lda #$FF ;Load A-reg with $FF tam0 ;Transfer A-reg to Memory map register 0 (1) lda $1000 ;Load A-reg with value stored at address $1000 (2) and #$40 ;Test bit 6 (3) beq NO_PROTECT ;Skip remaining code if bit not set lda #$90 ;Load A-reg with $90 tam2 ;Transfer A-reg to Memory map register 2 jmp $4000 ;Jump to address $4000 db ' NEC' NO_PROTECT: (etc.) Note especially the lines numbered (1), (2), and (3), above. (1) loads the accumulator, a general purpose register, with the value stored at memory location $1000. (2) determines if bit 6 is on. (3) skips the protection code if it is. This directly points towards some hardware check to see if a line is high or low. It wouldn't make sense for NEC (who probably fabricated these chips) to change their mask layout to fabricate the American chips; it's too expensive. Additionally, the markings on the US and Japanese chips are identical. So it has to be something external to the chip -- something we can change! ** Hardware Hack Description *** WARNING *** This is a hardware modification to a *highly* delicate, static-sensitive board. Do not attempt this modification unless you *know what you are doing*, and are well versed in the use of electronics equipment. I only have physical access to a PC Engine, so I can only give detailed instructions on how to make the hack on that unit. GT units should take the same modification, though; you'll just have to be more precise in your soldering job. Japanese Duos, Duo-Rs, and SuperGrafx units should be identical to the PCE hack. Carefully unscrew your PC Engine unit and separate the top half of the plastic "clamshell" from the bottom. A long ribbon cable will appear, which connects the HuCard adapter to the main motherboard. Pull the top half away from the motherboard, so the chips are exposed. Turn the PC Engine so the power switch (careful, it comes loose!) and joystick connector are AWAY from you, and the expansion port is TOWARDS you. Examine the board carefully for the HuC6280 chip. It's got the famous Hudson Bee on it, and is the lower right chip of the 3 Hudson chips on the board. Look along the right side of the chip; you'll see pin numberings: --- 40 --- 35 --- 30 --- 25 Right next to the "--- 30" marking is pin 30. The pin right below that is pin 29. If you're saying to yourself, "Geez, these pins are SMALL," then I recommend you screw your PCE/GT/Duo-R/whatever back together and send it on to a friend who can do the modification for you. The last thing you want is a dead game system! What you need to do is pry this pin *away* from the motherboard. This is best done with a soldering station with an adjustable temperature control set to 275 degrees Fahrenheit, but is possible with a 10 Watt soldering "pen." DO NOT USE A HIGHER WATTAGE SOLDERING IRON OR SOLDERING GUN! They are too crude for work with surface-mount devices like the HuC6280. While carefully heating the pad (that's the silvery metal part of the motherboard right next to the pin), pry Pin 29 away from the motherboard using a hemostat or needle-nosed pliers. A very small jeweler's screwdriver might work in a pinch. You're now ready to complete the hack. Place a small piece of electrical tape between the pin and the motherboard to prevent Pin 29 from shorting itself back to +5V. Get a 3 centimeter piece of wire-wrap wire (30 gauge) and strip each end about 5 millimeters. Using the soldering pen or soldering station, connect one end of the wire to Pin 29. You may be able to do this by wrapping the end of the wire around the pin and *CAREFULLY* applying a small amount of solder. Now, wrap the other end of the wire around the negative lead of capacitor C109, which is tied to ground. C109 is clearly marked on the PC Engine motherboard, as is its positive terminal. Be sure **NOT** to tie Pin 29 to the positive terminal!!! The capacitor itself should have a white stripe on the negative terminal's side, or some other marking. With the soldering pen / station, reheat the solder at the base of C109 so it flows around the wire, making a firm physical and electrical connection. ** Note for those with GTs/Duo-Rs/etc: Since I don't have physical access to these units, I don't know if C109 exists -- it probably does NOT. However, GND is all over a motherboard, and is rarely more than a few centimeters away from any IC pin. If you perform this modification on your unit, I'd appreciate you mailing me (jolo@ece.cmu.edu) and letting me know where you found GND near the HuC6280, so I can update this tech note in the upcoming TG Hardware FAQ. That's it! You can now replace the top of the PC Engine, screw it back together, and go nuts. Remember you'll still need a converter (WH-301, Kisado, whatever) to play US games on your Japanese system. And if you enjoyed this technical report, be sure to join us on the TG Hackers' List by sending 'subscribe' to tghack-list-request@cpac.washington.edu where more of these tips will be revealed shortly, including: o How to tap NTSC video and stereo audio out of a PCE or TG o How to incorporate a converter directly into your unit (though it's a little messy) o How to convert Nintendo controllers to work with your NEC system ...and more surprises yet to be revealed! Take care, Joe LoCicero --- - Joseph LoCicero, IV jolo@ece.cmu.edu - - Special Edition .sig commemorating The End of Internet Free Speech! :( - - Join the Blue Ribbon Campaign for Online Freedom of Speech, Press & - - Association, see http://www.eff.org/blueribbon.html for how to fight back-