SNES_Lockout.txt 18 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373
  1. Disabling the Super NES/Super Famicom "Lockout Chip"
  2. ====================================================
  3. (rev. 0.5 27-Dec-97)
  4. [Expert summary: disconnect CIC pin 4]
  5. This document is copyright © 1997 by Mark Knibbs <mark_k@iname.com>. The latest
  6. version, and several other console-related documents, should be available at:
  7. http://www.netcomuk.co.uk/~markk/index.html
  8. The direct URL for this file is:
  9. http://www.netcomuk.co.uk/~markk/Consoles/SNES_Lockout.txt
  10. You are explicitly permitted to include the *unmodified* document on web sites,
  11. FTP sites and the like. But it is best to simply link to the document on my web
  12. page, as this means that you automatically pick up any changes made.
  13. If you have any comments, suggestions or questions about this document, please
  14. contact me. If you would like to perform a similar modification to your NES 8-
  15. bit console, you should see:
  16. http://www.netcomuk.co.uk/~markk/Consoles/NES_Lockout.txt
  17. Revision History
  18. ----------------
  19. 0.1 27-Jul-97 First release.
  20. 0.2 19-Aug-97 Added information about another PCB revision and the lockout
  21. chip used in U.S./Japanese consoles.Various other small
  22. changes.
  23. 0.3 21-Aug-97 Added information about later model U.S. console (PCB
  24. revision SNS-CPU-GPM-01). Added section about removing a game
  25. pak with power on. Other minor changes.
  26. 0.4 22-Sep-97 Changed email address and web URLs. Added "Possible
  27. Incompatibilities" section.
  28. 0.5 27-Dec-97 Added step describing how to dissipate stored charge in the
  29. console before opening it. Added paragraph on precautions
  30. against static electricity. Added pointer to my SNES 50/60Hz
  31. modification document. Minor edits and changes.
  32. Introduction
  33. ------------
  34. This document details a simple modification that you can perform on your Super
  35. NES or Super Famicom 16-bit video game console in order to disable the "lockout
  36. chip" protection system. The "lockout chip" system means that no PAL games can
  37. be played on an unmodified U.S. or Japanese console, or vice versa.
  38. If you have a PAL model Super NES, I strongly recommend that you also fit a
  39. switch to change between 50Hz and 60Hz modes. 60Hz mode runs games full-screen,
  40. at the correct speed (20% faster than the usual PAL speed). Additionally, more
  41. recent games (e.g. Super Mario All-Stars, Super Metroid) contain code to check
  42. for 60Hz. So it is not usually possible to run, say, the Japanese version of
  43. such a game on a PAL console. Details of this modification, and an accompanying
  44. picture, can be found at:
  45. http://www.netcomuk.co.uk/~markk/index.html
  46. The procedure given here should work for ANY model Super NES or Super Famicom,
  47. both NTSC and PAL versions. As of this writing I have only applied the
  48. modification to two UK model PAL Super NES consoles.
  49. Why might you want to do this? Well, I can think of a few reasons:
  50. · You own a PAL Super NES, and currently have to use a clumsy "universal
  51. adapter" to be able to use American or Japanese games - with this
  52. modification you are able to directly use Japanese cartridges, and can use
  53. American games either by cutting a larger hole for the cartridge, or using
  54. an extension adapter (you can use your old universal adapter for this - you
  55. will no longer need to plug in the second "domestic" cartridge);
  56. · You own illicit or unlicensed games which can't be played on your console (I
  57. have seen a counterfeit Street Fighter II cartridge which contains no lockout
  58. chip, and thus normally requires that a universal adapter be used);
  59. · If you own an American model console, you can make it run almost every SNES
  60. game by removing the tabs behind the cartridge slot, disabling the lockout
  61. chip, and fitting a 50Hz/60Hz switch. If you have a PAL or Japanese console,
  62. you will need to file away the cartridge slot in order to accomodate the
  63. larger U.S. cartridges, if you want to be able to directly run every game.
  64. If you perform this procedure on your console, PLEASE LET ME KNOW WHETHER IT
  65. WORKS! I want to update this document so that it's applicable to as many
  66. consoles as possible. Please also tell me which PCB revision your console has
  67. (e.g. "SHVC-CPU-01"), the model (e.g. "SNS-001"), serial number, and the date
  68. code stamped on the label underneath (e.g. "9313"). I don't anticipate there
  69. being many relevant differences between different SNES models, though. I would
  70. welcome any comments you have about this document. Send them to the email
  71. address given above.
  72. If you are interested in the operation of the lockout chip and Nintendo's
  73. history in general, you might like to read David Sheff's book "Game Over", and
  74. consult U.S. patents 4,799,635 and/or 5,070,479. Indeed, I obtained the
  75. information necessary to carry out this modification from one of the patents.
  76. Background
  77. ----------
  78. Before the NES was first released in the U.S.A., Nintendo developed a system
  79. for preventing the use of unauthorised software with it. Much counterfeit
  80. software had apparently been produced for their Famicom (Family Computer)
  81. system, and Nintendo wanted to avoid this happening for the NES.
  82. Another benefit (to Nintendo) of the system was that legal third-party
  83. development was severely hindered. Only Nintendo licensees could buy the
  84. lockout chips, one of which was fitted inside every game cartridge. Licensees
  85. were apparently charged around US$9 for each chip, in addition to having to pay
  86. steep royalties. Nintendo patented the lockout chip concept, and copyrighted
  87. the code contain within it.
  88. Nintendo also used the lockout system to provide "territorial protection". This
  89. means that you can't use a U.K. or European NES game in a U.S. console, for
  90. example.
  91. Nintendo used exactly the same system for the Super NES. American and Japanese
  92. consoles use identical lockout chips. You can run Japanese games on an American
  93. console by simply removing two plastic tabs from behind the cartridge slot.
  94. PAL versions of the Super NES use a different lockout chip. So PAL cartridges
  95. cannot be played on an American or Japanese machine, or vice versa. Many
  96. companies produced "universal adapters" to get around this problem. Typically,
  97. these have two cartridge slots. You put the foreign game in one, and a domestic
  98. game in the other. The adapter uses the lockout chip from the domestic game to
  99. enable the foreign game to be played.
  100. How the Lockout System Works
  101. ----------------------------
  102. This is a very brief, simplified description. Consult Nintendo's patent for
  103. detailed information.
  104. Functionally identical chips are fitted in the console and inside every game
  105. cartridge. (For the SNES, the chips are packaged differently - the one inside
  106. the console is surface-mounted, and the one in game cartridges is usually a
  107. normal DIL package.)
  108. Depending on whether a certain pin (pin 4) of the chip is grounded or at +5V,
  109. the chip functions as either a lock or as a key. Inside the console, pin 4 of
  110. the lockout chip is at +5V (lock), and inside the game cartridge pin 4 is at 0V
  111. (key).
  112. When you switch on the console, the CPU and PPU chips are held in a reset
  113. state. The two lockout chips talk to each other. Since they are identical, they
  114. should be saying exactly the same thing at exactly the same time. Each chip
  115. compares its output with that of its counterpart. If they match, the lock chip
  116. releases the reset state of the console, and the game can start. The two chips
  117. still talk to each other, and if their outputs ever differ, the lock chip
  118. causes the console to reset, and the key chip (inside the game cartridge) may
  119. use the chip select lines of the cartridge ROM chips to disable the ROMs.
  120. The lockout chip is in fact a 4-bit microprocessor with its own internal ROM
  121. and RAM. The program it runs was called "10NES" for the NES version of the
  122. chip.
  123. How the Modification Works
  124. --------------------------
  125. This depends on changing the lock device to think that it's actually a key. If
  126. both devices are configured to be the same type (i.e., both keys), to quote
  127. Nintendo's patent "an unstable state takes place and no operations are
  128. performed at all." This means that the two chips will do nothing. So the
  129. console will not be reset, and the key device will not disable the cartridge
  130. ROM chips.
  131. To carry out the modification you need to disconnect pin 4 of the lockout chip,
  132. and connect this pin to ground (0V) instead. (In fact, it seems that you only
  133. need to disconnect the pin.)
  134. Whilst coming up with this method, I considered two other possible ways of
  135. achieving the result. I have not tried either of these, and I would be
  136. interested to hear if they work. If you feel like doing one of these, contact
  137. me for pinout information. The first involves connecting the lockout chip's
  138. input to its own output. Thus it may always think that its counterpart chip is
  139. present. The second involves simply disconnecting the chip's clock input.
  140. Performing the Modification
  141. ---------------------------
  142. Whilst the modification is very simple, if you have not used a soldering iron
  143. before I suggest that you ask someone who has some experience with soldering
  144. and electronics in general to help you. Maybe your local TV repair person will
  145. be willing to do it for you, if you provide a copy of this document and a
  146. screwdriver for opening the Super NES case.
  147. Game consoles, in common with most modern electronic devices are VERY SENSITIVE
  148. TO STATIC ELECTRICITY. Ideally, wear a grounding strap and work on a conductive
  149. surface when modifying your console. Avoid wearing clothes containing man-made
  150. fibres, which are prone to static (e.g. nylon). As far as possible, avoid
  151. touching component leads or PCB tracks. Handle the board by its edges.
  152. Print out and read this document several times before opening your console.
  153. You will need the following:
  154. · A screwdriver suitable for opening the Super NES case. The screws are special
  155. tamperproof screws, referred to as "System Zero" or "Line Head System". A
  156. suitable screwdriver can be obtained from a company called MCM Electronics in
  157. the USA (http://www.mcmelectronics.com/) or from RS Components in the UK.
  158. · A crosshead screwdriver suitable for removing some screws inside the Super
  159. NES (a "No. 1" bit will be suitable).
  160. · A low power grounded soldering iron with a fine bit and some desoldering
  161. braid.
  162. · A thin needle or similar implement.
  163. · A pair of sharp scissors.
  164. When removing screws, make sure you remember which type goes in which hole!
  165. Here are step-by-step instructions:
  166. 1. Turn off the console and remove all leads attached to it (AC adapter,
  167. controller, A/V lead, etc.). After doing this, turn the power switch on for
  168. a couple of seconds and then off again. This dissipates any stored charge
  169. inside; you may see the power LED light for a moment as you do this. IT IS
  170. *VERY IMPORTANT* THAT YOU DO THIS! YOU RISK DAMAGING YOUR CONSOLE IF YOU
  171. DO NOT!
  172. 2. Turn the console upside-down, and remove the six screws from the base. Turn
  173. it back over, and lift off the upper part of the case. Position the console
  174. so that it is facing you.
  175. 3. Remove the eject lever. Pull up the right-hand side of the metal rod and
  176. slide it out, then remove the lever and spring.
  177. 4. Remove the two screws which secure the power switch to the casing. Lift up
  178. the switch so that you can get at the screw below.
  179. 5. Gently remove the ribbon cable which leads to the controller socket PCB
  180. from the connector at the front of the PCB.
  181. You do not need to do this if you have a late revision console. You can
  182. identify this by the fact that there are only two screws holding down the
  183. shielding, and you can see that the ribbon cable does not interfere with
  184. removal of the shielding.
  185. 6. Now unscrew the metal shielding from in front of the cartridge slot. The
  186. exact details of this step depend on which revision PCB your console has. I
  187. will give specifics for the three variants that are known to me.
  188. · For early consoles, which can be identified by the separate plug-in sound
  189. module "SHVC-SOUND", there are six screws to remove from the shielding,
  190. including the two which are on either side of the cartridge slot. (After
  191. removing the shielding, you may see "SHVC-CPU-01" printed on the PCB if
  192. you have a U.S. or Japanese console.)
  193. · For later consoles, which have no separate sound module, there are four
  194. screws to remove. (You may see "SNSP-CPU-02" printed on the PCB after
  195. removing the shielding for a PAL console.)
  196. · For still later consoles, there are two screws to remove. For this type
  197. of console, there is no need to remove the controller ribbon cable. (You
  198. may see "SNS-CPU-GPM-01" printed on the PCB after removing the shielding
  199. for a U.S. model console.)
  200. 7. Carefully lift up the metal shielding. The edges may be quite sharp. You
  201. will see various chips. There is more than one type of SNES PCB. Earlier
  202. models can be distinguished because the sound hardware is contained in a
  203. separate plug-in module labelled "SHVC-SOUND" (towards the rear right of
  204. the console). Later revisions integrated this onto the main PCB.
  205. The position of the lockout chip depends on which kind of PCB your console
  206. has. For a U.S. model console with separate sound module, PCB revision
  207. "SHVC-CPU-01", the lockout chip is labelled U8 on the PCB, and says:
  208. F411
  209. © 1990
  210. Nintendo
  211. It is located just behind the reset switch.
  212. For a later revision PAL console with integrated sound, PCB revision
  213. "SNSP-CPU-02", the lockout chip is labelled U8 on the PCB, and says:
  214. F413A
  215. © 1992
  216. Nintendo
  217. It is located towards the front left of the PCB, near the power switch.
  218. For a still later revision U.S. console, PCB revision "SNS-CPU-GPM-01", the
  219. lockout chip is labelled U8 on the PCB, and says:
  220. F411A
  221. © 1990
  222. Nintendo
  223. It is located behind and to the left of the reset switch.
  224. 8. Locate pin 4 of the lockout chip. The pins at each corner are numbered on
  225. the PCB. Just count along from pin 1 to find pin 4.
  226. 9. Use the desoldering braid and soldering iron to remove some of the solder
  227. from pin 4. It may help to cut the end of the braid into a "V" shape, so
  228. that you don't inadvertently desolder any adjacent pins. Position the end
  229. of the braid over where pin 4 meets the PCB, and briefly press down on this
  230. with the soldering iron bit. You should see that some solder has been
  231. "sucked into" the braid.
  232. Using the needle, apply a gentle levering action to the pin as you
  233. momentarily touch the soldering iron to it. The pin should come away from
  234. the PCB. Carefully pull it up using the tip of the needle as a lever, so
  235. that the end is a couple of millimetres away from the PCB.
  236. 10. That's it! You can optionally solder a short length of wire between pin 4
  237. and 0V. Pin 9 of the lockout chip is at 0V, so you could connect these two
  238. pins. Alternatively, you may wish to add a switch; see the "Possible
  239. Incompatibilities" section below.
  240. 11. It is a good idea to test the console before putting it back together. Rest
  241. the power switch on its mounting and connect the AC adapter, controller,
  242. video lead and a game pak. Switch the console on. If all has gone well, the
  243. display should appear as usual. Turn the console off, and insert a foreign
  244. game pak (i.e., a U.S. or Japanese game pak if you have a PAL console; PAL
  245. game pak if you have a U.S. or Japanese console). Turn the console off and
  246. remove all attachments (AC adapter, etc.). Turn the power switch on and
  247. then off.
  248. 12. Put the console back together. The procedure is the reverse of steps 2 to 7
  249. above. You may find fitting the eject lever tricky. If so, put the metal
  250. rod through the lever, and put the spring on the left end of this, so that
  251. the outwards-pointing end of the spring is downwards. The outwards-pointing
  252. end should be the longer of the two. Ease the spring and lever into
  253. position, ensuring that the end of the spring goes into the recess in the
  254. casing. Now carefully move the other end of the spring back until it is in
  255. the recess in the lever.
  256. Possible Incompatibilities
  257. --------------------------
  258. A few very recent titles may be incompatible with this modification. One
  259. example is PAL "Street Fighter Alpha 2", used with a PAL SNES whose lockout
  260. chip has been disabled. The graphics were reported to be corrupted in some way.
  261. There is also reported to be more than one version of "Super Mario RPG", one of
  262. which may be incompatible.
  263. I know why this is. One explanation might be that Nintendo changed the lockout-
  264. related circuitry inside the cartridges, to detect the "deadlock" situation
  265. caused by disabling the console's lockout chip, and interfere with normal use
  266. of the game in this case.
  267. To solve this problem, and allow at least all domestic titles to be played, you
  268. can fit a DPST switch to pin 4 of the lockout chip. Connect the middle switch
  269. terminal to pin 4, and the other two terminals to +5V and ground respectively.
  270. Then, with the switch in one position the lockout chip will be disabled, and in
  271. the other it will operate as normal. Contact me if you are unsure of how to do
  272. this.
  273. At Your Own Risk!
  274. -----------------
  275. There are some interesting things which can be done now that the lockout chip
  276. is disabled. If you try the following, it is at your own risk. Be aware that
  277. removing a game pak while the console is on may damage your console or your
  278. game pak.
  279. If your SNES has an "eject prevention lever", you will have to try this before
  280. fitting the case back on. (To see whether your console has one, open the game
  281. pak shutter, and move the power switch. If you see a piece of plastic move out
  282. when the switch is in the "on" position, that is the eject prevention lever.
  283. Nintendo removed this from later U.S. models of the SNES, at least.)
  284. Plug in a game pak; "Street Fighter II" is a suitable one. Turn on the console,
  285. and wait until some music starts playing. Now carefully remove the game pak,
  286. without turning off the console first. You should find that the display blanks,
  287. but the music keeps playing until the end of the tune! This is because the
  288. sound processor has its own RAM, and the music code is loaded into this. So
  289. music continues to play even after removing the game pak.
  290. ---