silent scope 2 - fatal judgement nvram image

[lilshawn]

I Have a silent scope 2 fatal judgment game that errors out on boot. I've found its because the battery on the timekeeper NVRam is dead. The fix seems easy enough, buy a new chip and reprogram the data to it. Mame doesn't look like it has a dump of this game. Does Anybody have a dump or know if any of the same hardware series games would be the same info or is it specific to that exact game. I'm not interested in spending 300 bucks to have someone at the vendor fix it.

[lilshawn]

I dug and dug and dug and dug (like dig dug) and finally found this on a li'l server from the netherlands.

best i could translate is that there is 4 dumps here, you make sure the board revision matches and it should work.

off to ebay for a new timekeeper ram chip.

[retrorepair]

Does anyone have the JA version? Seems like the only one that's missing from that archive

[Francis2013]

Thanks for your research LilShawn

Is there anybody who fix this error 11P with those files yet?

[lilshawn]

I wasn't able to find anybody willing to do just a chip and send it to me. I guess it could be considered a legal issue since the info contains copyrighted information. The repair places I did find wanted me to send the whole computer and it would cost us a fortune to do that. (in addition to the cost of fixing the machine)

I figured why spend over $600 to fix a machine that needs a $1.30 part to repair.

[Francis2013]

Ok I think I find someone I will try it and let you know when the RTC come back

[SavannahLion]

I dug and dug and dug and dug (like dig dug) and finally found this on a li'l server from the netherlands.

best i could translate is that there is 4 dumps here, you make sure the board revision matches and it should work.

off to ebay for a new timekeeper ram chip.

what's the part number. Maybe find a replacement or suitable substitute at DigiKey, Mouser or Farnell?

[lilshawn]

I dug and dug and dug and dug (like dig dug) and finally found this on a li'l server from the netherlands.

best i could translate is that there is 4 dumps here, you make sure the board revision matches and it should work.

off to ebay for a new timekeeper ram chip.

what's the part number. Maybe find a replacement or suitable substitute at DigiKey, Mouser or Farnell?

M48T58Y-70PC It's a legit number and you can still find them. problem is you need to program the data back into the chip in order for the game to boot. this is the main issue, it doesn't program like a normal flash ram chip.

[ed12]

nor will it dump like a good chip
once the bat goes south your ram goes with it
to read write them i use a qsx-4..sweet little thing
but the chip its self is like a dallas bat back up pkg
once the bat goe's south so dose the key u need
olny way around the problem is to reg on to  dallas web site and go to there forms
and snag a master key
form there u are about 75% of the way there

ed

[MonMotha]

Master key from Dallas?  It's not like these things are crypto devices.  The part in question is also from ST - not even made by Dallas/Maxim.  FWIW, I have a few of them laying around if someone needs one (though IIRC Mouser stocks them).  Konami used them on EVERYTHING in the late 90s, though most devices will self-initialize.

The Hornet system may have kept an activation key or similar in its NVRAM, but you're not going to get it from Dallas (why would they care?).  If so, that may explain why people are unwilling to trade images of it - not only is it potentially copyrighted, but if it controls access to the game, then the DMCA's anti-circumvention terms could come into play.

I unfortunately don't have a particularly handy way to program one, but if it's REALLY important and you don't mind how long it takes (seriously, these things sometimes take years to bubble up on my priority list), I could rig up a little MCU to read/write one.  All I'd need then is an image which I'll assume you took from a running system or similar.

[SavannahLion]

I'm really just expanding on what MonMotha has said. There's really not too much standing in your way from what I can see.

I haven't really dug too deep into this but according to STM M48T58Y datasheet:

The M48T58/Y is a non-volatile pin and function equivalent to any JEDEC standard
8b Kb x 8 SRAM.

My first thought is to look at the AVR and XMEM to read/write this IC, but there is a little trickery involved with XMEM and I'm not currently inclined to examine the AVR and STM datasheets to see if it can be worked out.

But that doesn't mean one can't use an AVR or any other microcontroller to write what you want. I hate to say this, but this is probably a good instance where using the Arduino will probably come in handy. It stands to reason that somewhere in that atrocious library of theirs, they must have a standard SRAM library that bitbangs a parallel interface or manages the XMEM interface with an appropriate shield. (You don't need a shield. A breadboard, jumpers and the necessary support components is all that's needed) The M48T58 appears to be small enough that you can program it straight into a good selection of AVRs and do a one-off payload.

Just a thought. 

[lilshawn]

  Konami used them on EVERYTHING in the late 90s, though most devices will self-initialize.

yes most of the konami systems had a chip with the NVRAM data written to it...if your timekeeper battery was dead, it simply takes a little longer to boot because they had to reload the data from slower ROM.

Konami CONVENIENTLY left this chip unpopulated on the Silent Scope series boards. 

I have an EEPROM burner (top2000) that can write data to sram for testing purposes but the data writing for a standard 8k sram chip (which is basically what this nvram chip is) fails after a few bytes and corrupts after a few reads.

[ed12]

MonMotha
i do not as a rule correct
but u are wrong
the dallas key is cryocrypted before loading to the chip
without there os u cannot dump the ic2 chip chain
which u must ask for and be a member of there forms in good standing to recieve
same with the xlink crap
so having a home built dumper may work ?
but with out the hash,the chk-sum will never be right
so in short loading a blank is a 50/50 1 off
with the current dump u are working with
hence the reason for the batt back up-on chip
to save the nv-ram contents
so please i have dealt with this style system for well over 20 odd years
from video games straight through to pos systems >point of sale<
up to and into the crypto for batt loader cards
u must watch the last part of the chk-sum
the easy way was to convert
bin to hex or bin to img
then back again to hex
u then get the proper hexcsum


ed

[SavannahLion]

  Konami used them on EVERYTHING in the late 90s, though most devices will self-initialize.

I have an EEPROM burner (top2000) that can write data to sram for testing purposes but the data writing for a standard 8k sram chip (which is basically what this nvram chip is) fails after a few bytes and corrupts after a few reads.

interesting, despite ST datasheet claims. Maybe something is amiss and it's trying to R/W to the timkeeper bytes. Just a guess, I don't have the datasheet handy atm.

[MonMotha]

MonMotha
i do not as a rule correct
but u are wrong
the dallas key is cryocrypted before loading to the chip
without there os u cannot dump the ic2 chip chain
which u must ask for and be a member of there forms in good standing to recieve
same with the xlink crap
so having a home built dumper may work ?
but with out the hash,the chk-sum will never be right
so in short loading a blank is a 50/50 1 off
with the current dump u are working with
hence the reason for the batt back up-on chip
to save the nv-ram contents
so please i have dealt with this style system for well over 20 odd years
from video games straight through to pos systems >point of sale<
up to and into the crypto for batt loader cards
u must watch the last part of the chk-sum
the easy way was to convert
bin to hex or bin to img
then back again to hex
u then get the proper hexcsum


ed

I'm sorry, but what does Dallas (aka Maxim) semiconductor have to do with this?  It's an ST part.  Are you saying it's a clone of a Dallas part? Dallas did make a ton of this sort of thing, so that's possible, I guess.  Are you trying to say that this part has a ton of functionality that's just totally undocumented in the public datasheet?  That's possible, I guess...one ARM9 CPU I used a few years ago apparently had a GPS receiver built into it that wasn't even mentioned in the datasheet, but that was apparently because it didn't really work.

Dallas does also have a large lineup of crypto memories.  IIRC, they all have a 1-wire interface, but maybe some are I2C.  They're available as little chips or in the larger "iButton" format.  These are chips that do MD5 using a pre-programmed secret.  They have a unique ID (factory set) number on them, but IIRC it's up to the buyer to set the MD5 secret on all of them.  They are quite commonly used for copy protection systems and for things like printer consumable tracking/restriction.  Some of them, especially older ones in iButton formfactor, are battery backed RAM internally, not EEPROM/Flash.  These parts are well documented, publicly.  You don't need their "OS" or anything, though you do need a 1-wire master (and they have an FPGA HDL implementation) and a driver of some sort to talk to it.  They provide all the info you need to create those yourself, though if somebody has already loaded an MD5 key onto the part, you're sunk (there's a good chance that Dallas doesn't even have it).

Xilinx has a kinda-sorta related mechanism for bitstream protection where you can load a crypto key into some battery-backed SRAM on the FPGA, and it will use that key to decrypt the bitstream it loads off an external ROM (people commonly use the Xilinx "Platform Flash" for this, but you can use other industry-standard flash parts) on-the-fly during powerup/program.

Atmel also has a series of "cryptomemories" though I'm not aware of any of them that are battery backed.  Atmel doesn't release full datasheets on these parts, though the datasheets they do release are clear that they're incomplete and do not document all aspects of the part.  The teardowns I've seen show them to be of somewhat questionable security.  They tend to focus more on data confidentiality than integrity, which is a harder problem to solve.  These DO have a factory-installed key of some sort, though the user can also assign a key.  I'm not sure what operations are related to which keys.

Then of course there's all sorts of little embedded CPUs intended for use in smart cards and other smart "tokens".  These are usually very difficult to work with as they include several countermeasures to prevent data extraction and copying - that's the whole point of them.

Now, assuming the part under discussion here (ST M48T58/Y) really is just what's documented in the public datasheet from ST...

There's surely a checksum or similar in use in the data that's on the part, but it would be application specific and application implemented.  It may be cryptographic in nature - e.g. using a known secret (HMAC style), but Dallas would have nothing to do with distribution of such a secret, and the entirety of the data on the chip is exposed, bare.

The ST M48T58/Y is not one of these Dallas crypto parts, nor is it an FPGA, nor does it have an embedded CPU or any documented data extraction countermeasures...  It's a bog-standard parallel bus interface battery-backed NV SRAM+RTC.  Same thing my old Sparcstation had, and similar to what all my old PCs had before they got integrated into the southbridge/SuperIO.  I'm sure you've encountered a system like you speak of - they definitely exist and are downright common in copy protection systems - but this doesn't appear to be one of them.  It's just a data dump with a clock.

Now, it goes without saying that you need a dump of one from BEFORE the battery died, and if the data is keyed (by the software) to a serial number or similar on the system, then it won't work on another system, but none of that has to do with Dallas (!?).

[SavannahLion]

Konami CONVENIENTLY left this chip unpopulated on the Silent Scope series boards. 

This may sound a bit crazy because I can't find any schematic for that board.

I theory, do you think that if you can populate that ROM IC with NVRAM image that it would do the trick?

Obviously it depends on the board, software and some other important details, but who is to say that the original programmers did include that functionality but the specific ROM was left out as a cost saving measure?

[lilshawn]

I'm sure Dallas semi makes a part that is compatible... dallas tends to document their parts a little better than most. That's probably why ed mentioned them.

here is the rundown...

the nvram contains a string of code a few bytes long that contains the version and region codes of the software. this string also has a checksum to ensure the data doesn't get corrupted.

when you boot the board, the game software starts to load and then calls the info from the nvram... it compares the region code and version with the software contained in the game ROM. if it matches...it runs. If it doesn't - error 11 is displayed. (it assumes the rom is not matching either the version or region.)

so when the battery dies, the software doesn't run because the data is all 00's. in order to get it running again, you must program the nvram with the original data it had with the correct region/version/checksum, so when it calls for the info, it checks out okay and boots the game.

the problem is, even though the nvram seems to be a standard 8Kx8, it doesn't program like one. (at least my eeprom programmer doesn't)

[MonMotha]

Also, crazy.  Looks like Dallas isn't giving out full datasheets to their 1-wire crypto parts without an NDA anymore.  No idea why, because they used to and were actually secure (i.e. they did not rely on "security through obscurity").  Even the older SHA-1 parts now need an NDA for the full datasheet.

No mater, it's not really relevant to this discussion: the part in question does no crypto.  There's nothing preventing you from obtaining a usable "dump" so long as you do it before the battery dies.  The game software might still tie the data to the system serial number, though.

[lilshawn]

it's more security from people burning rom sets from ss2 and upgrading their ss1 (and other same system) machines with new roms or buying japanese machines and burning roms for USA so they run legit.

for really really, literally for real, the only data it checks is the very first 8 bytes for the version, region, and the checksum bytes.

Code: [Select]

47 4B 39 33 31 00 00 00 19 99 45 41 41 00 AF A6
translates to:

GK931....™EAA.¯¦

931 is the version (830 for SS1 or 931 for SS2)

EAA is the region (UAA for USA EAA for europe etc)

the last 2 bytes are the checksum (AF A6)

even the 2 bytes (19 99) are used as the copyright date in the game.

if the nvram contained only these first 8 bytes, it would probably work.

i had another thread going about all this here:

http://forum.arcadecontrols.com/index.php/topic,130917.msg1340996.html#msg1340996

somehow i ended up with 2 threads 

[RJ45]

THANK YOU, Lilshawn!
Thanks to the posting of your zip-file with the contents of the timekeepers I was able to finally get my SilentScope 2 931EA working!
Just programmed the file into the the ST M48T58Y and the game works again.
Do you still need a programmed timekeeper, I can send you one. That would be the least I could do to thank you.

If appreciated, I can post a detailed description of how I did it.

[lilshawn]

Cool man, if you wouldn't mind posting your method of programming. (equipment, software, or programmer used) That would be awesome.

There seems to be something slightly off about how I'm programming it that's holding me up. If it's really not going to work with my equipment, I may just have to take you up on your offer of a chip. 

[RJ45]

OK, here is how I did it:
1. I replaced the original Timekeeper (M48T58Y-70PC1) with a 28pins socket for easy access.
2. Programmed the new Timkeeper (also M48T58Y-70PC1) with the SS2_931EA.DAT file out of the ZIPfile posted earlier in this thread. I used the for me only available programmer, wich was a Dataman 48-UXP. As you can see on their homepage (http://www.dataman.com/m48t58y.html?package=1593) this programmer does not support the M48T58Y-70PC1, but when I choose a Dallas 1225Y as device it was possible to do it anyway. The verify error is normal, because of the time-data wich changes every second, dont mention it.
3. Insert new programmed Timekeeper in socket, put little board back on and the game functions!

4. DON'T adjust the clock, which comes up after you clear the bookkeeping. If you do save something else then the time which is already shown  the game get's locked and asks for a password! In that case you have to re-program the Timekeeper. (or know the password of course)

[RJ45]

Pictures of how I did it....

Socket, without and with RTC

Programming the RTC:
1. Select RTC
2. RTC selected
3. Load file
4. Read complete
5. Verify error (no worries, it's normal!)

Bookkeeping as stored in the file in this post:
bookkeeping 1
bookkeeping 2

Menu with cleared bookkeeping

Clocksetup in bookkeepingmenu (DO NOT CHANGE!)

Game mode locked: (this only happens when you try to change the clock)

Menu with locked game mode

[Francis2013]

Thanks for the information!

I have send several timekeeper for programming, and only one came back correct
I suspect that the Timekeeper I ordered, where no good.
can you give me the name of a good provider for those!

[ed12]

nice work rj45

lilshawn

funny how i see dallas posted in them there pic's eh ?

ed

[lilshawn]

yes, the D1225 is pretty much the same chip only it's made by...well, Dallas Semi.

My programmer does support the D1225Y as well, and I did try to program as that chip (and several others) but it errors on me when I go to write. maybe as Francis2013 mentioned, this chip could be old as dirt and no good...but the date code is 17th week of 2010. so it's about 3 years old.

[ed12]

a few hints here,and it as far as i can go

ds1225-xx >>xx<< is your date code
not the speed,not the nv time write

ed

[lilshawn]

the original ST part M48T58Y-70PC  date code is above the part number as follows:

H99XXYYZZ


The H99 means it was manufactured in texas (H) and assembled in malaysia (9) and tested in malaysia. (9) I believe all these chips were manufactured, assembled and tested in these places... so the code will always start with "H99"

Where XX is the lot number and/or assembly line number
Where YY is the 2 digit date year
Where ZZ is the date week

Mine is H994E1017

lot number 4E, year 2010, week 17 (may sometime)

BTW,

[lilshawn]

STmicroelectronics gives free samples of the chip (M48T58Y-70PC)

as does Maxim IC who bought dallas semi aways back. (DS1225) If you order/request a sample be sure you order one with at least a 70ns (the original speed) access time. they have a range of 100 and 200ns ones that may end up being incompatible.

I went to ST's website and signed up and requested a "free sample", it's under review right now. I'll let you know what the outcome is with that. Be forewarned, they also want all kinds of production info etc. to get free samples. I basically fudged together a product info that would require said part. (vending machine bookkeeping and system settings backup unit) and plunk in the relative data.

I've gotten samples in the past from maxim but i've changed My e-mail addy with them to a free one from hotmail and/or gmail, and maxim doesn't like the free ones. if you have an e-mail addy from your ISP then you should be good to go. I'll have to get one from my ISP and change it to be able to get samples. I'll give the DS1225 a try too as well.

[SavannahLion]

I was only able to ever get samples from ST once. Back when I still had an email address with a research facility. I got a few tips on what to say when/if they contacted me, which they did. I haven't been able to do it again since. I keep getting turned down for one reason or another. 

Maxim is really good about samples, I usually ask for just two or three of a particular IC and they often send me double, sometimes triple what I asked for. But grab up the datasheets sooner than later. I got a bunch of samples about two or three years ago and lost the datasheets for them. Now I haven't the foggiest what they do and how to use them. I think they are ADC(?) state switches used in video switching equipment.

[lilshawn]

i've gotten my confirmation e-mail from ST with even a USPS tracking number.

1:) i used a hotmail addy
2:) used a real business (the one i work for)
3:) shipped to the businesses address
4:) requested 1 item only

everything looks legit to them...well, it kinda is. 

[ed12]

do not be surprised if 4-5 show up

ed

[lilshawn]

do not be surprised if 4-5 show up

ed

that would be nice...although these chips from mouser are 18 buck a piece. i guess we will see soon enough. 

[Jitterdoomer]

But before this process, does the game lock with the error code? Because I'm trying to help the MAME guys to resolve this issue.

[Francis2013]

So I have two choice

The Dallas one (They are coming from hong kong)
http://www.ebay.com/itm/Brand-New-M48T58Y-70PC1-M48T58Y-Timekeeper-SRAM-/270953844189?pt=LH_DefaultDomain_0&hash=item3f161b8ddd

or the other one
http://www.ebay.com/itm/Brand-New-M48T58Y-70PC1-M48T58Y-Timekeeper-SRAM-/270953844189?pt=LH_DefaultDomain_0&hash=item3f161b8ddd


Wich one is better?
I think I will try the dallas one since I didnt get good result with the other one

[ed12]

lilshawn
if your chip-s ? are not in
snag a golden tee golf red board
same chip

ed

[lilshawn]

lilshawn
if your chip-s ? are not in
snag a golden tee golf red board
same chip

ed

lol i didn't even think to look 

[lilshawn]

well, i recieved my new time keeper. I did only receive one. it came packaged from mouser. ST had an "option" in the form where i selected from a number of distributors to select my preferred parts place. I happened to select mouser.  meh, all good.

but, i plopped the chip in my programmer and selected the D1225Y and it does the same as the other chips. gets to 0400c and errors out. It must just be this programmer.   

[ed12]

ok
what type of programmer are u using again ?
lets start there and either allow or disallow it,as u are working with otp
style chips,unless u speced a re-programable 1 ?

u see part of the security code set is to lock out ceritan parts of the nvram and the eeprom,of that chip..yes it dose have a eeprom

there is olny but a few and i mean very few units that will do a proper dump
of them chips

qs4/needhams emp stuff/and a dallas dumper
that is a few right there
the reason for this i went over
hexcsum...must match

so back to the origanl q
what is the programmer u are using ? and i will chase it down
and ring u back up

ed

[lilshawn]

i'm using some chinese made "top2003" programmer. it's been good for everything i've thrown at it so far... I think with a software update it would probably work...but because it's a chinese unit, they pushed out some crappy english translated software and that was it.

it uses the cyprus EZ usb interface, so perhaps some kind of universal software could work with it.

while it doesn't have the M48TY numbered part to programm, it does have a dallas D1225Y which is what another user here used to program the ST timekeeper, but it doesn't work in my case.