Path: utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!uwm.edu!zaphod.mps.ohio-state.edu!ncar!tank!mimsy!mojo!stripes
From: stripes@eng.umd.edu (Joshua Osborne)
Newsgroups: comp.lsi
Subject: Re: A Truly Secure (tm) ROM access
Message-ID: <1990Jun1.100138.22992@eng.umd.edu>
Date: 1 Jun 90 10:01:38 GMT
References: <39144@mips.mips.COM> <21908@shamash.cdc.com> <39146@mips.mips.COM>
Sender: news@eng.umd.edu (The News System)
Organization: College of Engineering, Maryversity of Uniland, College Park
Lines: 20

In article <39146@mips.mips.COM> mark@mips.COM (Mark G. Johnson) writes:
>Rumor has it that Nintendo game cartridges contain ROMS that are somehow
>abnormal (encrypted?  wacko custom chip design that doesn't correspond
>to any commercial part, e.g. 48K by 11bits?), and that this is how
>they guarantee they are the only source of [highly lucrative] cartridges.

They have some sort of conversation - 4 or 60 times a sec (I forget which)
the NES asks the cartrage whats up, the cartrage replys.  If the cartrage
replys wrong the reset line (on the 6502-like thing, or the VDU I forget
which) is asserted.  This trace could be (and has been) cut, but then you
lose the ability to hit RESET from the front panel.  The "lockout" chip can
be moved from one cartrage to another (it is distinct from the ROM/RAM on
the cartrage).  They are not impossable to duplicate, but they are hard,
from 2 to 4 componys have done it.
-- 
           stripes@eng.umd.edu          "Security for Unix is like
      Josh_Osborne@Real_World,The          Mutitasking for MS-DOS"
      "The dyslexic porgramer"                  - Kevin Lockwood
"Don't try to change C into some nice, safe, portable programming language
 with all sharp edges removed, pick another language."  - John Limpert