Fork 0

Clock glitching FPGA-based ROM dumper for the H8/3292 and related mask ROM parts

Tcl 59.7%
Verilog 40.3%

Find a file

ChrisPVille 963cec799c Update README.md		2020-08-29 11:39:24 -04:00
h8-dumper.srcs	Changes necessary for chips with as little as 4 address bits driven	2020-08-29 00:08:12 -04:00
.gitignore	Initial Commit	2020-08-26 22:48:22 -04:00
h8-dumper.xpr	Changes necessary for chips with as little as 4 address bits driven	2020-08-29 00:08:12 -04:00
README.md	Update README.md	2020-08-29 11:39:24 -04:00

README.md

H8 Clock Glitching Dumper

Big ol' word of warning: I wrote this in like a day. It works, but don't expect testbenches, comments, or anything else for that matter.

What?

Mask ROM H8 3297/4 series parts seem to prevent reading back the ROM via the normal process used in the PROM variants. This is likely a security feature and wasn't unexpected. That said, I want to dump the ROMs of these parts, and this is the FPGA project containing the clock glitching, memory map, etc. to make it happen.

Why?

The Nintendo 64DD is effectively crippled by making portions of every disk read-only. Through some probing it was determiend that the onboard H8 is responsible for this write protection. By dumping, modifying, and programming a replacement micro, the ability to write anywhere should be possible.