Hi,
Some AVE cartridges use a lockout-defeating chip developed by Macronix, marked MX8018-0002-A. Kevin Horton's site has pics of some boards:
http://www.tripoint.org/kevtris/mappers/ave/nina-03.html
http://www.tripoint.org/kevtris/mappers/ave/mb_91_a.html
How compatible are carts which use the MX8018-0002-A chip with late-model front-loading consoles? (If testing an AVE cart you'll have to open it up to ensure it contains the Macronix chip; some AVE carts contain different lockout-defeating circuitry.)
Operation of the Macronix chip is probably described in one of their US patents, number 5004232. You can view that on (for example) the Espacenet site: http://v3.espacenet.com/publicationDetails/biblio?adjacent=true&KC=A&date=19910402&NR=5004232A&DB=EPODOC&locale=en_EP&CC=US&FT=D
(Click the Original Document tab, then the Save Full Document link to download the patent in PDF format.)
The patent envisages the lockout-defeating circuitry being integrated in the PRG ROM chip (which makes sense because Macronix made mask ROMs), but I guess they never did that, making a separate chip instead.
Kevin thought the chip was a microcontroller, but its circuitry may be much simpler than that. Quoting from the patent: "It can be seen from FIG. 1 how simple the security circuit can be made: a pair of digital counters, a pulse generator, a clock dividing circuit, two simple gates and a capacitor."
Since the circuit doesn't use negative voltage to stun the CIC in the console, I'd be interested to hear whether it works in late-model consoles. (The patent was filed in 1989.)
If it does work in all NES consoles, implementing that circuit could reduce the cost of making things like the PowerPak cart, since the lockout-defeat logic could be integrated into the FPGA rather than needing a separate chip.
-- M
Some AVE cartridges use a lockout-defeating chip developed by Macronix, marked MX8018-0002-A. Kevin Horton's site has pics of some boards:
http://www.tripoint.org/kevtris/mappers/ave/nina-03.html
http://www.tripoint.org/kevtris/mappers/ave/mb_91_a.html
How compatible are carts which use the MX8018-0002-A chip with late-model front-loading consoles? (If testing an AVE cart you'll have to open it up to ensure it contains the Macronix chip; some AVE carts contain different lockout-defeating circuitry.)
Operation of the Macronix chip is probably described in one of their US patents, number 5004232. You can view that on (for example) the Espacenet site: http://v3.espacenet.com/publicationDetails/biblio?adjacent=true&KC=A&date=19910402&NR=5004232A&DB=EPODOC&locale=en_EP&CC=US&FT=D
(Click the Original Document tab, then the Save Full Document link to download the patent in PDF format.)
The patent envisages the lockout-defeating circuitry being integrated in the PRG ROM chip (which makes sense because Macronix made mask ROMs), but I guess they never did that, making a separate chip instead.
Kevin thought the chip was a microcontroller, but its circuitry may be much simpler than that. Quoting from the patent: "It can be seen from FIG. 1 how simple the security circuit can be made: a pair of digital counters, a pulse generator, a clock dividing circuit, two simple gates and a capacitor."
Since the circuit doesn't use negative voltage to stun the CIC in the console, I'd be interested to hear whether it works in late-model consoles. (The patent was filed in 1989.)
If it does work in all NES consoles, implementing that circuit could reduce the cost of making things like the PowerPak cart, since the lockout-defeat logic could be integrated into the FPGA rather than needing a separate chip.
-- M