Main Restorations Software Audio/Jukebox/MP3 Everything Else Buy/Sell/Trade
Project Announcements Monitor/Video GroovyMAME Merit/JVL Touchscreen Meet Up Retail Vendors
Driving & Racing Woodworking Software Support Forums Consoles Project Arcade Reviews
Automated Projects Artwork Frontend Support Forums Pinball Forum Discussion Old Boards
Raspberry Pi & Dev Board controls.dat Linux Miscellaneous Arcade Wiki Discussion Old Archives
Lightguns Arcade1Up --- Bug Reports --- Site News

Unread posts | New Replies | Recent posts | Rules | Chatroom | Wiki | File Repository | RSS | Submit news

  

Author Topic: silent scope 2 - fatal judgement nvram image  (Read 12549 times)

0 Members and 1 Guest are viewing this topic.

lilshawn

  • Trade Count: (+3)
  • Full Member
  • ***
  • Offline Offline
  • Posts: 6277
  • Last login:Yesterday at 08:04:38 pm
  • I break stuff...then fix it...sometimes
silent scope 2 - fatal judgement nvram image
« on: February 19, 2013, 11:10:12 am »
I Have a silent scope 2 fatal judgment game that errors out on boot. I've found its because the battery on the timekeeper NVRam is dead. The fix seems easy enough, buy a new chip and reprogram the data to it. Mame doesn't look like it has a dump of this game. Does Anybody have a dump or know if any of the same hardware series games would be the same info or is it specific to that exact game. I'm not interested in spending 300 bucks to have someone at the vendor fix it.
« Last Edit: May 12, 2013, 12:19:43 pm by lilshawn »

lilshawn

  • Trade Count: (+3)
  • Full Member
  • ***
  • Offline Offline
  • Posts: 6277
  • Last login:Yesterday at 08:04:38 pm
  • I break stuff...then fix it...sometimes
Re: silent scope 2 - fatal judgement nvram image
« Reply #1 on: February 21, 2013, 02:38:14 pm »
I dug and dug and dug and dug (like dig dug) and finally found this on a li'l server from the netherlands.

best i could translate is that there is 4 dumps here, you make sure the board revision matches and it should work.

off to ebay for a new timekeeper ram chip.

retrorepair

  • Trade Count: (0)
  • Full Member
  • ***
  • Offline Offline
  • Posts: 242
  • Last login:November 04, 2018, 12:58:03 pm
Re: silent scope 2 - fatal judgement nvram image (FIXED?)
« Reply #2 on: April 27, 2013, 11:18:56 am »
Does anyone have the JA version? Seems like the only one that's missing from that archive :(
My arcade racing setup:
My Youtube Channel: http://www.youtube.com/user/RetroRepair
My Twitter: http://twitter.com/retrorepair

Francis2013

  • Trade Count: (0)
  • Full Member
  • ***
  • Offline Offline
  • Posts: 14
  • Last login:February 04, 2014, 09:03:44 am
  • I want to build my own arcade controls!
Re: silent scope 2 - fatal judgement nvram image
« Reply #3 on: August 01, 2013, 09:03:17 am »
Thanks for your research LilShawn

Is there anybody who fix this error 11P with those files yet?


lilshawn

  • Trade Count: (+3)
  • Full Member
  • ***
  • Offline Offline
  • Posts: 6277
  • Last login:Yesterday at 08:04:38 pm
  • I break stuff...then fix it...sometimes
Re: silent scope 2 - fatal judgement nvram image
« Reply #4 on: August 01, 2013, 10:05:50 am »
I wasn't able to find anybody willing to do just a chip and send it to me. I guess it could be considered a legal issue since the info contains copyrighted information. The repair places I did find wanted me to send the whole computer and it would cost us a fortune to do that. (in addition to the cost of fixing the machine)

I figured why spend over $600 to fix a machine that needs a $1.30 part to repair.

Francis2013

  • Trade Count: (0)
  • Full Member
  • ***
  • Offline Offline
  • Posts: 14
  • Last login:February 04, 2014, 09:03:44 am
  • I want to build my own arcade controls!
Re: silent scope 2 - fatal judgement nvram image
« Reply #5 on: August 01, 2013, 10:28:28 am »
Ok I think I find someone I will try it and let you know when the RTC come back
« Last Edit: August 01, 2013, 03:08:35 pm by Francis2013 »

SavannahLion

  • Wiki Contributor
  • Trade Count: (+1)
  • Full Member
  • ***
  • Offline Offline
  • Posts: 5986
  • Last login:December 19, 2015, 02:28:15 am
Re: silent scope 2 - fatal judgement nvram image
« Reply #6 on: August 31, 2013, 05:14:50 pm »
I dug and dug and dug and dug (like dig dug) and finally found this on a li'l server from the netherlands.

best i could translate is that there is 4 dumps here, you make sure the board revision matches and it should work.

off to ebay for a new timekeeper ram chip.

what's the part number. Maybe find a replacement or suitable substitute at DigiKey, Mouser or Farnell?

lilshawn

  • Trade Count: (+3)
  • Full Member
  • ***
  • Offline Offline
  • Posts: 6277
  • Last login:Yesterday at 08:04:38 pm
  • I break stuff...then fix it...sometimes
Re: silent scope 2 - fatal judgement nvram image
« Reply #7 on: August 31, 2013, 11:30:24 pm »
I dug and dug and dug and dug (like dig dug) and finally found this on a li'l server from the netherlands.

best i could translate is that there is 4 dumps here, you make sure the board revision matches and it should work.

off to ebay for a new timekeeper ram chip.

what's the part number. Maybe find a replacement or suitable substitute at DigiKey, Mouser or Farnell?

M48T58Y-70PC It's a legit number and you can still find them. problem is you need to program the data back into the chip in order for the game to boot. this is the main issue, it doesn't program like a normal flash ram chip.

ed12

  • Trade Count: (-1)
  • Full Member
  • ***
  • Offline Offline
  • Posts: 3972
  • Last login:March 31, 2018, 03:44:39 pm
  • it is what it is..."Nobody Said It Was Easy"....
Re: silent scope 2 - fatal judgement nvram image
« Reply #8 on: August 31, 2013, 11:51:28 pm »
nor will it dump like a good chip
once the bat goes south your ram goes with it
to read write them i use a qsx-4..sweet little thing
but the chip its self is like a dallas bat back up pkg
once the bat goe's south so dose the key u need
olny way around the problem is to reg on to  dallas web site and go to there forms
and snag a master key
form there u are about 75% of the way there

ed
Shipping something from the U.S. to Canada for repair/exchange?  Please use USPS to avoid (additional?/excessive?) shipping charges.  PM me if you have any questions.

MonMotha

  • Trade Count: (+2)
  • Full Member
  • ***
  • Offline Offline
  • Posts: 2378
  • Last login:February 19, 2018, 05:45:54 pm
Re: silent scope 2 - fatal judgement nvram image
« Reply #9 on: September 01, 2013, 02:13:52 am »
Master key from Dallas?  It's not like these things are crypto devices.  The part in question is also from ST - not even made by Dallas/Maxim.  FWIW, I have a few of them laying around if someone needs one (though IIRC Mouser stocks them).  Konami used them on EVERYTHING in the late 90s, though most devices will self-initialize.

The Hornet system may have kept an activation key or similar in its NVRAM, but you're not going to get it from Dallas (why would they care?).  If so, that may explain why people are unwilling to trade images of it - not only is it potentially copyrighted, but if it controls access to the game, then the DMCA's anti-circumvention terms could come into play.

I unfortunately don't have a particularly handy way to program one, but if it's REALLY important and you don't mind how long it takes (seriously, these things sometimes take years to bubble up on my priority list), I could rig up a little MCU to read/write one.  All I'd need then is an image which I'll assume you took from a running system or similar.

SavannahLion

  • Wiki Contributor
  • Trade Count: (+1)
  • Full Member
  • ***
  • Offline Offline
  • Posts: 5986
  • Last login:December 19, 2015, 02:28:15 am
Re: silent scope 2 - fatal judgement nvram image
« Reply #10 on: September 01, 2013, 03:34:58 am »
I'm really just expanding on what MonMotha has said. There's really not too much standing in your way from what I can see.

I haven't really dug too deep into this but according to STM M48T58Y datasheet:
Quote
The M48T58/Y is a non-volatile pin and function equivalent to any JEDEC standard
8b Kb x 8 SRAM.

My first thought is to look at the AVR and XMEM to read/write this IC, but there is a little trickery involved with XMEM and I'm not currently inclined to examine the AVR and STM datasheets to see if it can be worked out.

But that doesn't mean one can't use an AVR or any other microcontroller to write what you want. I hate to say this, but this is probably a good instance where using the Arduino will probably come in handy. It stands to reason that somewhere in that atrocious library of theirs, they must have a standard SRAM library that bitbangs a parallel interface or manages the XMEM interface with an appropriate shield. (You don't need a shield. A breadboard, jumpers and the necessary support components is all that's needed) The M48T58 appears to be small enough that you can program it straight into a good selection of AVRs and do a one-off payload.

Just a thought.  :dunno
« Last Edit: September 01, 2013, 03:45:30 am by SavannahLion »

lilshawn

  • Trade Count: (+3)
  • Full Member
  • ***
  • Offline Offline
  • Posts: 6277
  • Last login:Yesterday at 08:04:38 pm
  • I break stuff...then fix it...sometimes
Re: silent scope 2 - fatal judgement nvram image
« Reply #11 on: September 01, 2013, 10:28:47 am »
  Konami used them on EVERYTHING in the late 90s, though most devices will self-initialize.

yes most of the konami systems had a chip with the NVRAM data written to it...if your timekeeper battery was dead, it simply takes a little longer to boot because they had to reload the data from slower ROM.

Konami CONVENIENTLY left this chip unpopulated on the Silent Scope series boards.  :angry:

I have an EEPROM burner (top2000) that can write data to sram for testing purposes but the data writing for a standard 8k sram chip (which is basically what this nvram chip is) fails after a few bytes and corrupts after a few reads.

ed12

  • Trade Count: (-1)
  • Full Member
  • ***
  • Offline Offline
  • Posts: 3972
  • Last login:March 31, 2018, 03:44:39 pm
  • it is what it is..."Nobody Said It Was Easy"....
Re: silent scope 2 - fatal judgement nvram image
« Reply #12 on: September 01, 2013, 02:12:01 pm »
MonMotha
i do not as a rule correct
but u are wrong
the dallas key is cryocrypted before loading to the chip
without there os u cannot dump the ic2 chip chain
which u must ask for and be a member of there forms in good standing to recieve
same with the xlink crap
so having a home built dumper may work ?
but with out the hash,the chk-sum will never be right
so in short loading a blank is a 50/50 1 off
with the current dump u are working with
hence the reason for the batt back up-on chip
to save the nv-ram contents
so please i have dealt with this style system for well over 20 odd years
from video games straight through to pos systems >point of sale<
up to and into the crypto for batt loader cards
u must watch the last part of the chk-sum
the easy way was to convert
bin to hex or bin to img
then back again to hex
u then get the proper hexcsum


ed
« Last Edit: September 01, 2013, 02:33:31 pm by ed12 »
Shipping something from the U.S. to Canada for repair/exchange?  Please use USPS to avoid (additional?/excessive?) shipping charges.  PM me if you have any questions.

SavannahLion

  • Wiki Contributor
  • Trade Count: (+1)
  • Full Member
  • ***
  • Offline Offline
  • Posts: 5986
  • Last login:December 19, 2015, 02:28:15 am
Re: silent scope 2 - fatal judgement nvram image
« Reply #13 on: September 01, 2013, 02:23:20 pm »
  Konami used them on EVERYTHING in the late 90s, though most devices will self-initialize.

I have an EEPROM burner (top2000) that can write data to sram for testing purposes but the data writing for a standard 8k sram chip (which is basically what this nvram chip is) fails after a few bytes and corrupts after a few reads.

interesting, despite ST datasheet claims. Maybe something is amiss and it's trying to R/W to the timkeeper bytes. Just a guess, I don't have the datasheet handy atm.

MonMotha

  • Trade Count: (+2)
  • Full Member
  • ***
  • Offline Offline
  • Posts: 2378
  • Last login:February 19, 2018, 05:45:54 pm
Re: silent scope 2 - fatal judgement nvram image
« Reply #14 on: September 03, 2013, 12:31:58 am »
MonMotha
i do not as a rule correct
but u are wrong
the dallas key is cryocrypted before loading to the chip
without there os u cannot dump the ic2 chip chain
which u must ask for and be a member of there forms in good standing to recieve
same with the xlink crap
so having a home built dumper may work ?
but with out the hash,the chk-sum will never be right
so in short loading a blank is a 50/50 1 off
with the current dump u are working with
hence the reason for the batt back up-on chip
to save the nv-ram contents
so please i have dealt with this style system for well over 20 odd years
from video games straight through to pos systems >point of sale<
up to and into the crypto for batt loader cards
u must watch the last part of the chk-sum
the easy way was to convert
bin to hex or bin to img
then back again to hex
u then get the proper hexcsum


ed

I'm sorry, but what does Dallas (aka Maxim) semiconductor have to do with this?  It's an ST part.  Are you saying it's a clone of a Dallas part? Dallas did make a ton of this sort of thing, so that's possible, I guess.  Are you trying to say that this part has a ton of functionality that's just totally undocumented in the public datasheet?  That's possible, I guess...one ARM9 CPU I used a few years ago apparently had a GPS receiver built into it that wasn't even mentioned in the datasheet, but that was apparently because it didn't really work.

Dallas does also have a large lineup of crypto memories.  IIRC, they all have a 1-wire interface, but maybe some are I2C.  They're available as little chips or in the larger "iButton" format.  These are chips that do MD5 using a pre-programmed secret.  They have a unique ID (factory set) number on them, but IIRC it's up to the buyer to set the MD5 secret on all of them.  They are quite commonly used for copy protection systems and for things like printer consumable tracking/restriction.  Some of them, especially older ones in iButton formfactor, are battery backed RAM internally, not EEPROM/Flash.  These parts are well documented, publicly.  You don't need their "OS" or anything, though you do need a 1-wire master (and they have an FPGA HDL implementation) and a driver of some sort to talk to it.  They provide all the info you need to create those yourself, though if somebody has already loaded an MD5 key onto the part, you're sunk (there's a good chance that Dallas doesn't even have it).

Xilinx has a kinda-sorta related mechanism for bitstream protection where you can load a crypto key into some battery-backed SRAM on the FPGA, and it will use that key to decrypt the bitstream it loads off an external ROM (people commonly use the Xilinx "Platform Flash" for this, but you can use other industry-standard flash parts) on-the-fly during powerup/program.

Atmel also has a series of "cryptomemories" though I'm not aware of any of them that are battery backed.  Atmel doesn't release full datasheets on these parts, though the datasheets they do release are clear that they're incomplete and do not document all aspects of the part.  The teardowns I've seen show them to be of somewhat questionable security.  They tend to focus more on data confidentiality than integrity, which is a harder problem to solve.  These DO have a factory-installed key of some sort, though the user can also assign a key.  I'm not sure what operations are related to which keys.

Then of course there's all sorts of little embedded CPUs intended for use in smart cards and other smart "tokens".  These are usually very difficult to work with as they include several countermeasures to prevent data extraction and copying - that's the whole point of them.

Now, assuming the part under discussion here (ST M48T58/Y) really is just what's documented in the public datasheet from ST...

There's surely a checksum or similar in use in the data that's on the part, but it would be application specific and application implemented.  It may be cryptographic in nature - e.g. using a known secret (HMAC style), but Dallas would have nothing to do with distribution of such a secret, and the entirety of the data on the chip is exposed, bare.

The ST M48T58/Y is not one of these Dallas crypto parts, nor is it an FPGA, nor does it have an embedded CPU or any documented data extraction countermeasures...  It's a bog-standard parallel bus interface battery-backed NV SRAM+RTC.  Same thing my old Sparcstation had, and similar to what all my old PCs had before they got integrated into the southbridge/SuperIO.  I'm sure you've encountered a system like you speak of - they definitely exist and are downright common in copy protection systems - but this doesn't appear to be one of them.  It's just a data dump with a clock.

Now, it goes without saying that you need a dump of one from BEFORE the battery died, and if the data is keyed (by the software) to a serial number or similar on the system, then it won't work on another system, but none of that has to do with Dallas (!?).
« Last Edit: September 03, 2013, 12:36:43 am by MonMotha »

SavannahLion

  • Wiki Contributor
  • Trade Count: (+1)
  • Full Member
  • ***
  • Offline Offline
  • Posts: 5986
  • Last login:December 19, 2015, 02:28:15 am
Re: silent scope 2 - fatal judgement nvram image
« Reply #15 on: September 03, 2013, 01:19:02 am »
Konami CONVENIENTLY left this chip unpopulated on the Silent Scope series boards.  :angry:

This may sound a bit crazy because I can't find any schematic for that board.

I theory, do you think that if you can populate that ROM IC with NVRAM image that it would do the trick?

Obviously it depends on the board, software and some other important details, but who is to say that the original programmers did include that functionality but the specific ROM was left out as a cost saving measure? :dunno

lilshawn

  • Trade Count: (+3)
  • Full Member
  • ***
  • Offline Offline
  • Posts: 6277
  • Last login:Yesterday at 08:04:38 pm
  • I break stuff...then fix it...sometimes
Re: silent scope 2 - fatal judgement nvram image
« Reply #16 on: September 03, 2013, 09:50:03 am »
I'm sure Dallas semi makes a part that is compatible... dallas tends to document their parts a little better than most. That's probably why ed mentioned them.

here is the rundown...

the nvram contains a string of code a few bytes long that contains the version and region codes of the software. this string also has a checksum to ensure the data doesn't get corrupted.

when you boot the board, the game software starts to load and then calls the info from the nvram... it compares the region code and version with the software contained in the game ROM. if it matches...it runs. If it doesn't - error 11 is displayed. (it assumes the rom is not matching either the version or region.)

so when the battery dies, the software doesn't run because the data is all 00's. in order to get it running again, you must program the nvram with the original data it had with the correct region/version/checksum, so when it calls for the info, it checks out okay and boots the game.

the problem is, even though the nvram seems to be a standard 8Kx8, it doesn't program like one. (at least my eeprom programmer doesn't)

MonMotha

  • Trade Count: (+2)
  • Full Member
  • ***
  • Offline Offline
  • Posts: 2378
  • Last login:February 19, 2018, 05:45:54 pm
Re: silent scope 2 - fatal judgement nvram image
« Reply #17 on: September 03, 2013, 01:27:26 pm »
Also, crazy.  Looks like Dallas isn't giving out full datasheets to their 1-wire crypto parts without an NDA anymore.  No idea why, because they used to and were actually secure (i.e. they did not rely on "security through obscurity").  Even the older SHA-1 parts now need an NDA for the full datasheet.

No mater, it's not really relevant to this discussion: the part in question does no crypto.  There's nothing preventing you from obtaining a usable "dump" so long as you do it before the battery dies.  The game software might still tie the data to the system serial number, though.

lilshawn

  • Trade Count: (+3)
  • Full Member
  • ***
  • Offline Offline
  • Posts: 6277
  • Last login:Yesterday at 08:04:38 pm
  • I break stuff...then fix it...sometimes
Re: silent scope 2 - fatal judgement nvram image
« Reply #18 on: September 03, 2013, 07:05:30 pm »
it's more security from people burning rom sets from ss2 and upgrading their ss1 (and other same system) machines with new roms or buying japanese machines and burning roms for USA so they run legit.

for really really, literally for real, the only data it checks is the very first 8 bytes for the version, region, and the checksum bytes.

Code: [Select]
47 4B 39 33 31 00 00 00 19 99 45 41 41 00 AF A6
translates to:

GK931....™EAA.¯¦

931 is the version (830 for SS1 or 931 for SS2)

EAA is the region (UAA for USA EAA for europe etc)

the last 2 bytes are the checksum (AF A6)

even the 2 bytes (19 99) are used as the copyright date in the game.

if the nvram contained only these first 8 bytes, it would probably work.

i had another thread going about all this here:

http://forum.arcadecontrols.com/index.php/topic,130917.msg1340996.html#msg1340996

somehow i ended up with 2 threads  :dunno

RJ45

  • Trade Count: (0)
  • Jr. Member
  • **
  • Offline Offline
  • Posts: 3
  • Last login:June 22, 2016, 06:33:03 am
Re: silent scope 2 - fatal judgement nvram image
« Reply #19 on: September 18, 2013, 05:01:20 am »
THANK YOU, Lilshawn!
Thanks to the posting of your zip-file with the contents of the timekeepers I was able to finally get my SilentScope 2 931EA working!
Just programmed the file into the the ST M48T58Y and the game works again.
Do you still need a programmed timekeeper, I can send you one. That would be the least I could do to thank you.

If appreciated, I can post a detailed description of how I did it.

lilshawn

  • Trade Count: (+3)
  • Full Member
  • ***
  • Offline Offline
  • Posts: 6277
  • Last login:Yesterday at 08:04:38 pm
  • I break stuff...then fix it...sometimes
Re: silent scope 2 - fatal judgement nvram image
« Reply #20 on: September 18, 2013, 11:39:55 am »
Cool man, if you wouldn't mind posting your method of programming. (equipment, software, or programmer used) That would be awesome.

There seems to be something slightly off about how I'm programming it that's holding me up. If it's really not going to work with my equipment, I may just have to take you up on your offer of a chip.  :cheers:

RJ45

  • Trade Count: (0)
  • Jr. Member
  • **
  • Offline Offline
  • Posts: 3
  • Last login:June 22, 2016, 06:33:03 am
Re: silent scope 2 - fatal judgement nvram image
« Reply #21 on: September 19, 2013, 05:55:04 pm »
OK, here is how I did it:
1. I replaced the original Timekeeper (M48T58Y-70PC1) with a 28pins socket for easy access.
2. Programmed the new Timkeeper (also M48T58Y-70PC1) with the SS2_931EA.DAT file out of the ZIPfile posted earlier in this thread. I used the for me only available programmer, wich was a Dataman 48-UXP. As you can see on their homepage (http://www.dataman.com/m48t58y.html?package=1593) this programmer does not support the M48T58Y-70PC1, but when I choose a Dallas 1225Y as device it was possible to do it anyway. The verify error is normal, because of the time-data wich changes every second, dont mention it.
3. Insert new programmed Timekeeper in socket, put little board back on and the game functions!

4. DON'T adjust the clock, which comes up after you clear the bookkeeping. If you do save something else then the time which is already shown  the game get's locked and asks for a password! In that case you have to re-program the Timekeeper. (or know the password of course)
« Last Edit: September 19, 2013, 06:37:15 pm by RJ45 »

RJ45

  • Trade Count: (0)
  • Jr. Member
  • **
  • Offline Offline
  • Posts: 3
  • Last login:June 22, 2016, 06:33:03 am
« Last Edit: August 22, 2015, 05:44:47 pm by RJ45 »

Francis2013

  • Trade Count: (0)
  • Full Member
  • ***
  • Offline Offline
  • Posts: 14
  • Last login:February 04, 2014, 09:03:44 am
  • I want to build my own arcade controls!
Re: silent scope 2 - fatal judgement nvram image
« Reply #23 on: September 23, 2013, 11:28:41 am »
Thanks for the information!

I have send several timekeeper for programming, and only one came back correct
I suspect that the Timekeeper I ordered, where no good.
can you give me the name of a good provider for those!

ed12

  • Trade Count: (-1)
  • Full Member
  • ***
  • Offline Offline
  • Posts: 3972
  • Last login:March 31, 2018, 03:44:39 pm
  • it is what it is..."Nobody Said It Was Easy"....
Re: silent scope 2 - fatal judgement nvram image
« Reply #24 on: September 23, 2013, 02:29:14 pm »
nice work rj45 :):)

lilshawn

funny how i see dallas posted in them there pic's eh ?

ed
Shipping something from the U.S. to Canada for repair/exchange?  Please use USPS to avoid (additional?/excessive?) shipping charges.  PM me if you have any questions.

lilshawn

  • Trade Count: (+3)
  • Full Member
  • ***
  • Offline Offline
  • Posts: 6277
  • Last login:Yesterday at 08:04:38 pm
  • I break stuff...then fix it...sometimes
Re: silent scope 2 - fatal judgement nvram image
« Reply #25 on: September 23, 2013, 03:19:53 pm »
yes, the D1225 is pretty much the same chip only it's made by...well, Dallas Semi.

My programmer does support the D1225Y as well, and I did try to program as that chip (and several others) but it errors on me when I go to write. maybe as Francis2013 mentioned, this chip could be old as dirt and no good...but the date code is 17th week of 2010. so it's about 3 years old.

ed12

  • Trade Count: (-1)
  • Full Member
  • ***
  • Offline Offline
  • Posts: 3972
  • Last login:March 31, 2018, 03:44:39 pm
  • it is what it is..."Nobody Said It Was Easy"....
Re: silent scope 2 - fatal judgement nvram image
« Reply #26 on: September 23, 2013, 04:48:49 pm »
a few hints here,and it as far as i can go

ds1225-xx >>xx<< is your date code
not the speed,not the nv time write

ed
Shipping something from the U.S. to Canada for repair/exchange?  Please use USPS to avoid (additional?/excessive?) shipping charges.  PM me if you have any questions.

lilshawn

  • Trade Count: (+3)
  • Full Member
  • ***
  • Offline Offline
  • Posts: 6277
  • Last login:Yesterday at 08:04:38 pm
  • I break stuff...then fix it...sometimes
Re: silent scope 2 - fatal judgement nvram image
« Reply #27 on: September 23, 2013, 05:01:37 pm »
the original ST part M48T58Y-70PC  date code is above the part number as follows:

H99XXYYZZ


The H99 means it was manufactured in texas (H) and assembled in malaysia (9) and tested in malaysia. (9) I believe all these chips were manufactured, assembled and tested in these places... so the code will always start with "H99"

Where XX is the lot number and/or assembly line number
Where YY is the 2 digit date year
Where ZZ is the date week

Mine is H994E1017

lot number 4E, year 2010, week 17 (may sometime)

BTW,

lilshawn

  • Trade Count: (+3)
  • Full Member
  • ***
  • Offline Offline
  • Posts: 6277
  • Last login:Yesterday at 08:04:38 pm
  • I break stuff...then fix it...sometimes
Re: silent scope 2 - fatal judgement nvram image
« Reply #28 on: September 23, 2013, 06:45:03 pm »
STmicroelectronics gives free samples of the chip (M48T58Y-70PC)

as does Maxim IC who bought dallas semi aways back. (DS1225) If you order/request a sample be sure you order one with at least a 70ns (the original speed) access time. they have a range of 100 and 200ns ones that may end up being incompatible.

I went to ST's website and signed up and requested a "free sample", it's under review right now. I'll let you know what the outcome is with that. Be forewarned, they also want all kinds of production info etc. to get free samples. I basically fudged together a product info that would require said part. (vending machine bookkeeping and system settings backup unit) and plunk in the relative data.

I've gotten samples in the past from maxim but i've changed My e-mail addy with them to a free one from hotmail and/or gmail, and maxim doesn't like the free ones. if you have an e-mail addy from your ISP then you should be good to go. I'll have to get one from my ISP and change it to be able to get samples. I'll give the DS1225 a try too as well.

SavannahLion

  • Wiki Contributor
  • Trade Count: (+1)
  • Full Member
  • ***
  • Offline Offline
  • Posts: 5986
  • Last login:December 19, 2015, 02:28:15 am
Re: silent scope 2 - fatal judgement nvram image
« Reply #29 on: September 24, 2013, 03:09:20 am »
I was only able to ever get samples from ST once. Back when I still had an email address with a research facility. I got a few tips on what to say when/if they contacted me, which they did. I haven't been able to do it again since. I keep getting turned down for one reason or another.  :dunno

Maxim is really good about samples, I usually ask for just two or three of a particular IC and they often send me double, sometimes triple what I asked for. But grab up the datasheets sooner than later. I got a bunch of samples about two or three years ago and lost the datasheets for them. Now I haven't the foggiest what they do and how to use them. I think they are ADC(?) state switches used in video switching equipment. :dunno

lilshawn

  • Trade Count: (+3)
  • Full Member
  • ***
  • Offline Offline
  • Posts: 6277
  • Last login:Yesterday at 08:04:38 pm
  • I break stuff...then fix it...sometimes
Re: silent scope 2 - fatal judgement nvram image
« Reply #30 on: September 24, 2013, 10:13:47 am »
i've gotten my confirmation e-mail from ST with even a USPS tracking number.

1:) i used a hotmail addy
2:) used a real business (the one i work for)
3:) shipped to the businesses address
4:) requested 1 item only

everything looks legit to them...well, it kinda is.  :cheers:

ed12

  • Trade Count: (-1)
  • Full Member
  • ***
  • Offline Offline
  • Posts: 3972
  • Last login:March 31, 2018, 03:44:39 pm
  • it is what it is..."Nobody Said It Was Easy"....
Re: silent scope 2 - fatal judgement nvram image
« Reply #31 on: September 24, 2013, 12:26:45 pm »
do not be surprised if 4-5 show up :)

ed
Shipping something from the U.S. to Canada for repair/exchange?  Please use USPS to avoid (additional?/excessive?) shipping charges.  PM me if you have any questions.

lilshawn

  • Trade Count: (+3)
  • Full Member
  • ***
  • Offline Offline
  • Posts: 6277
  • Last login:Yesterday at 08:04:38 pm
  • I break stuff...then fix it...sometimes
Re: silent scope 2 - fatal judgement nvram image
« Reply #32 on: September 24, 2013, 05:36:45 pm »
do not be surprised if 4-5 show up :)

ed

that would be nice...although these chips from mouser are 18 buck a piece. i guess we will see soon enough.  :cheers:

Jitterdoomer

  • Trade Count: (0)
  • Full Member
  • ***
  • Offline Offline
  • Posts: 57
  • Last login:January 22, 2018, 02:35:32 pm
  • I want to build my own arcade controls!
    • Personal Twitter Page
Re: silent scope 2 - fatal judgement nvram image
« Reply #33 on: September 24, 2013, 11:35:04 pm »
But before this process, does the game lock with the error code? Because I'm trying to help the MAME guys to resolve this issue.
For amusement only.

Francis2013

  • Trade Count: (0)
  • Full Member
  • ***
  • Offline Offline
  • Posts: 14
  • Last login:February 04, 2014, 09:03:44 am
  • I want to build my own arcade controls!
Re: silent scope 2 - fatal judgement nvram image
« Reply #34 on: September 25, 2013, 04:17:45 pm »
So I have two choice

The Dallas one (They are coming from hong kong)
http://www.ebay.com/itm/Brand-New-M48T58Y-70PC1-M48T58Y-Timekeeper-SRAM-/270953844189?pt=LH_DefaultDomain_0&hash=item3f161b8ddd

or the other one
http://www.ebay.com/itm/Brand-New-M48T58Y-70PC1-M48T58Y-Timekeeper-SRAM-/270953844189?pt=LH_DefaultDomain_0&hash=item3f161b8ddd


Wich one is better?
I think I will try the dallas one since I didnt get good result with the other one

ed12

  • Trade Count: (-1)
  • Full Member
  • ***
  • Offline Offline
  • Posts: 3972
  • Last login:March 31, 2018, 03:44:39 pm
  • it is what it is..."Nobody Said It Was Easy"....
Re: silent scope 2 - fatal judgement nvram image
« Reply #35 on: September 25, 2013, 09:12:46 pm »
lilshawn
if your chip-s ? are not in
snag a golden tee golf red board
same chip

ed
Shipping something from the U.S. to Canada for repair/exchange?  Please use USPS to avoid (additional?/excessive?) shipping charges.  PM me if you have any questions.

lilshawn

  • Trade Count: (+3)
  • Full Member
  • ***
  • Offline Offline
  • Posts: 6277
  • Last login:Yesterday at 08:04:38 pm
  • I break stuff...then fix it...sometimes
Re: silent scope 2 - fatal judgement nvram image
« Reply #36 on: September 25, 2013, 09:46:30 pm »
lilshawn
if your chip-s ? are not in
snag a golden tee golf red board
same chip

ed

lol i didn't even think to look  :lol

lilshawn

  • Trade Count: (+3)
  • Full Member
  • ***
  • Offline Offline
  • Posts: 6277
  • Last login:Yesterday at 08:04:38 pm
  • I break stuff...then fix it...sometimes
Re: silent scope 2 - fatal judgement nvram image
« Reply #37 on: October 07, 2013, 10:10:03 am »
well, i recieved my new time keeper. I did only receive one. it came packaged from mouser. ST had an "option" in the form where i selected from a number of distributors to select my preferred parts place. I happened to select mouser.  :dunno meh, all good.

but, i plopped the chip in my programmer and selected the D1225Y and it does the same as the other chips. gets to 0400c and errors out. It must just be this programmer.  :-[  :banghead:

ed12

  • Trade Count: (-1)
  • Full Member
  • ***
  • Offline Offline
  • Posts: 3972
  • Last login:March 31, 2018, 03:44:39 pm
  • it is what it is..."Nobody Said It Was Easy"....
Re: silent scope 2 - fatal judgement nvram image
« Reply #38 on: October 07, 2013, 03:08:08 pm »
ok
what type of programmer are u using again ?
lets start there and either allow or disallow it,as u are working with otp
style chips,unless u speced a re-programable 1 ?

u see part of the security code set is to lock out ceritan parts of the nvram and the eeprom,of that chip..yes it dose have a eeprom

there is olny but a few and i mean very few units that will do a proper dump
of them chips

qs4/needhams emp stuff/and a dallas dumper
that is a few right there
the reason for this i went over
hexcsum...must match

so back to the origanl q
what is the programmer u are using ? and i will chase it down
and ring u back up

ed
Shipping something from the U.S. to Canada for repair/exchange?  Please use USPS to avoid (additional?/excessive?) shipping charges.  PM me if you have any questions.

lilshawn

  • Trade Count: (+3)
  • Full Member
  • ***
  • Offline Offline
  • Posts: 6277
  • Last login:Yesterday at 08:04:38 pm
  • I break stuff...then fix it...sometimes
Re: silent scope 2 - fatal judgement nvram image
« Reply #39 on: October 07, 2013, 04:00:39 pm »
i'm using some chinese made "top2003" programmer. it's been good for everything i've thrown at it so far... I think with a software update it would probably work...but because it's a chinese unit, they pushed out some crappy english translated software and that was it.

it uses the cyprus EZ usb interface, so perhaps some kind of universal software could work with it.

while it doesn't have the M48TY numbered part to programm, it does have a dallas D1225Y which is what another user here used to program the ST timekeeper, but it doesn't work in my case.

ed12

  • Trade Count: (-1)
  • Full Member
  • ***
  • Offline Offline
  • Posts: 3972
  • Last login:March 31, 2018, 03:44:39 pm
  • it is what it is..."Nobody Said It Was Easy"....
Re: silent scope 2 - fatal judgement nvram image
« Reply #40 on: October 07, 2013, 08:45:32 pm »
hi
ok i am going to take it this is a mcmull ?
2003/2004/-2012 ?
with tophat s/w ?
if so please read this thread on the problem
>http://www.mcumall.com/forum/topic.asp?TOPIC_ID=184<
it explains it in a simler area,as to what i was refering to
if not,please advise and i will dig futher
i do believe i used an olld dallas hexscum generator to big indian hexcsum conveter

ed
Shipping something from the U.S. to Canada for repair/exchange?  Please use USPS to avoid (additional?/excessive?) shipping charges.  PM me if you have any questions.

lilshawn

  • Trade Count: (+3)
  • Full Member
  • ***
  • Offline Offline
  • Posts: 6277
  • Last login:Yesterday at 08:04:38 pm
  • I break stuff...then fix it...sometimes
Re: silent scope 2 - fatal judgement nvram image
« Reply #41 on: October 08, 2013, 01:40:36 am »
yes this was some kind of mcumall dealy. it was here at work before my time. but, yeah it sounds about right. I had a feeling there is an issue with the program itself.

i'm not sure exactly what's going on, but i pissed around with the chip for a while. I found while but normally the chip is blanked with F's. If I try to write my silent scope data it gets to that 0400c space and errors out. if i write all f's to the chip, it will gloss over whatever the issue is with memory space 0400c but error out at 0800c (or something like that.) I can also get the software to offset write the chip, (start write at 0600c until 0fffc and also offset the data by the same ammount) but it stops at 0400c same as before. it must have to run through all the addresses.

sorry, just kind of rambling hoping something sticks to the wall.

If i randomly fill the codespace and write the data and can get it to stop at random places... sometimes i can get it to complete 100% ok. it's bizzare.

I'd normally just say to hell with it and buy a new one, but i had a hard enough time getting the boss to cough up a couple of hunskies to purchase a new CRT chassis after the original one burned itself a nice dime size hole in the board.

- can't you just fix it

me: *looking at him through the hole* with this face
« Last Edit: October 08, 2013, 01:43:34 am by lilshawn »

ed12

  • Trade Count: (-1)
  • Full Member
  • ***
  • Offline Offline
  • Posts: 3972
  • Last login:March 31, 2018, 03:44:39 pm
  • it is what it is..."Nobody Said It Was Easy"....
Re: silent scope 2 - fatal judgement nvram image
« Reply #42 on: October 08, 2013, 10:45:49 am »
as i rem more on this problem
it did dawn on me that i to went to mplab for the proper assigened hexcsum
and i could then shove it >the chip<,in my emp30
and it would stick
i have yet to try it on my qc-4 >mcmull<
but i have fresh chips here can give it a go if u like ?
just post me your dump

ed
Shipping something from the U.S. to Canada for repair/exchange?  Please use USPS to avoid (additional?/excessive?) shipping charges.  PM me if you have any questions.

minicooperscooter

  • Trade Count: (0)
  • Jr. Member
  • **
  • Offline Offline
  • Posts: 3
  • Last login:June 17, 2019, 10:00:20 am
  • Engineer, Developer, Inventor - NEVER give up!
    • The Newyawk Blog
Re: silent scope 2 - fatal judgement nvram image
« Reply #43 on: January 11, 2015, 10:15:07 am »
I wanted to drop a post in here, and say THANKS to the good people here work worked out the Timekeeper issue.  THIS thread was the most credible and useful one I found on the Internet when my Silent Scope died six months back.  I had to do a lot of this work posted here, and some other fun things, to make it all work - but again, the basis for what to do was here.  For the benefit of anyone else struggling with a Timekeeper IC, I have two things:

* What I did to get it to work
* What I have for anyone else that gets stuck!

In short...

- The -11p hardware boot failure issue in the Konami Hornet CPU is in fact the failed Timekeeper chip
- The chip has an internal LiOn battery in it, servicing the internal wafer, keeping it "alive." The battery's voltage does not pin-out, so you cannot measure it, nor can you put an external 3.3v to it and make it work
- The battery is buried in the resin - I ventured in one to dig it out and get to the points where it services the waver with voltage.  This is a tricky process - you need to know where the battery lives ahead of time, and you need to work slowly, because you can damage the wafer, or destroy the physical integrity of the chip - and it won't tolerate being plugged and unplugged from a socket
- Even a "bad" Timekeeper can be brought back to life (more on this, in a minute) when the battery inside it is replaced!  The wafer doesn't usually fail - just the battery
- If you try to buy a "new" Timekeeper, you're going to see 1999 era date codes - bad news, even for NOS.  Since the battery is servicing the wafer, it is ALWAYS under load, and therefore dying.  That means even a "new" chip has a dying or dead battery in it.  I sourced several replacements for mine, and all but one were bad.  You'll know it's bad when all you see are blocks of '00' and 'FF' over and over on read and write cycles - this means the chip is "dead"
- You need the "right" kind of programmer to make this work.  Many $50 USB programmers won't handle this class of chip.  As others posted, this chip also works like a Dallas 1225Y, so you need to be sure your programmer can WRITE (not just read/test) this class of SRAM.  I found the MCUMall GQ-4X "true USB" rig does the trick, and can be purchased for $100
- You'll need to short pins 28 to 26 to read or write this chip properly!
- You'll need the right file to write to your chip - for Silent Scope (first run), I used the "SS1830UAA.dat" file as a binary program input file, which I got from a MAME archive.  "UA" in the name means US.  "EA" in the code apparently means Europe, so be careful which file you select
- Once the chip is back in the game, you'll know it works when the CPU and both video boards pass their checks - the screen will go into a deep color static pattern, twice, and then drop you at a screen where you'll need to execute at least three or four setup tests before you can get to game mode.  If the screen doesn't flash like this, you'll be back to the original block scramble boot screen, which means you're in a loop, which means your chip didn't work
- Apparently, one should never set the correct date and time in the Bookeeping menu - this causes the game to password protect the setup menu, thus locking you out!  I do not know the password to unlock this, and while I suspect the reprogramming of the Timekeeper will alleviate this, I am not sure - I can't recall if I read it here or elsewhere

So, what do you do if you find yourself here?  Contact me!  I came up with my own way to get the Timekeeper working, bulletproofed, for anyone with this kind of issue!

If you have a Timekeeper SRAM, or any other similar format chip with a failed battery inside of it, I can help!

Please see - the Dragonfish Reserviced Timekeeper in the B/S/T section here - http://forum.arcadecontrols.com/index.php/topic,143303.0.html!

« Last Edit: January 11, 2015, 11:23:34 am by minicooperscooter »