123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373 |
- Disabling the Super NES/Super Famicom "Lockout Chip"
- ====================================================
- (rev. 0.5 27-Dec-97)
- [Expert summary: disconnect CIC pin 4]
- This document is copyright © 1997 by Mark Knibbs <mark_k@iname.com>. The latest
- version, and several other console-related documents, should be available at:
- http://www.netcomuk.co.uk/~markk/index.html
- The direct URL for this file is:
- http://www.netcomuk.co.uk/~markk/Consoles/SNES_Lockout.txt
- You are explicitly permitted to include the *unmodified* document on web sites,
- FTP sites and the like. But it is best to simply link to the document on my web
- page, as this means that you automatically pick up any changes made.
- If you have any comments, suggestions or questions about this document, please
- contact me. If you would like to perform a similar modification to your NES 8-
- bit console, you should see:
- http://www.netcomuk.co.uk/~markk/Consoles/NES_Lockout.txt
- Revision History
- ----------------
- 0.1 27-Jul-97 First release.
- 0.2 19-Aug-97 Added information about another PCB revision and the lockout
- chip used in U.S./Japanese consoles.Various other small
- changes.
- 0.3 21-Aug-97 Added information about later model U.S. console (PCB
- revision SNS-CPU-GPM-01). Added section about removing a game
- pak with power on. Other minor changes.
- 0.4 22-Sep-97 Changed email address and web URLs. Added "Possible
- Incompatibilities" section.
- 0.5 27-Dec-97 Added step describing how to dissipate stored charge in the
- console before opening it. Added paragraph on precautions
- against static electricity. Added pointer to my SNES 50/60Hz
- modification document. Minor edits and changes.
- Introduction
- ------------
- This document details a simple modification that you can perform on your Super
- NES or Super Famicom 16-bit video game console in order to disable the "lockout
- chip" protection system. The "lockout chip" system means that no PAL games can
- be played on an unmodified U.S. or Japanese console, or vice versa.
- If you have a PAL model Super NES, I strongly recommend that you also fit a
- switch to change between 50Hz and 60Hz modes. 60Hz mode runs games full-screen,
- at the correct speed (20% faster than the usual PAL speed). Additionally, more
- recent games (e.g. Super Mario All-Stars, Super Metroid) contain code to check
- for 60Hz. So it is not usually possible to run, say, the Japanese version of
- such a game on a PAL console. Details of this modification, and an accompanying
- picture, can be found at:
- http://www.netcomuk.co.uk/~markk/index.html
- The procedure given here should work for ANY model Super NES or Super Famicom,
- both NTSC and PAL versions. As of this writing I have only applied the
- modification to two UK model PAL Super NES consoles.
- Why might you want to do this? Well, I can think of a few reasons:
- · You own a PAL Super NES, and currently have to use a clumsy "universal
- adapter" to be able to use American or Japanese games - with this
- modification you are able to directly use Japanese cartridges, and can use
- American games either by cutting a larger hole for the cartridge, or using
- an extension adapter (you can use your old universal adapter for this - you
- will no longer need to plug in the second "domestic" cartridge);
- · You own illicit or unlicensed games which can't be played on your console (I
- have seen a counterfeit Street Fighter II cartridge which contains no lockout
- chip, and thus normally requires that a universal adapter be used);
- · If you own an American model console, you can make it run almost every SNES
- game by removing the tabs behind the cartridge slot, disabling the lockout
- chip, and fitting a 50Hz/60Hz switch. If you have a PAL or Japanese console,
- you will need to file away the cartridge slot in order to accomodate the
- larger U.S. cartridges, if you want to be able to directly run every game.
- If you perform this procedure on your console, PLEASE LET ME KNOW WHETHER IT
- WORKS! I want to update this document so that it's applicable to as many
- consoles as possible. Please also tell me which PCB revision your console has
- (e.g. "SHVC-CPU-01"), the model (e.g. "SNS-001"), serial number, and the date
- code stamped on the label underneath (e.g. "9313"). I don't anticipate there
- being many relevant differences between different SNES models, though. I would
- welcome any comments you have about this document. Send them to the email
- address given above.
- If you are interested in the operation of the lockout chip and Nintendo's
- history in general, you might like to read David Sheff's book "Game Over", and
- consult U.S. patents 4,799,635 and/or 5,070,479. Indeed, I obtained the
- information necessary to carry out this modification from one of the patents.
- Background
- ----------
- Before the NES was first released in the U.S.A., Nintendo developed a system
- for preventing the use of unauthorised software with it. Much counterfeit
- software had apparently been produced for their Famicom (Family Computer)
- system, and Nintendo wanted to avoid this happening for the NES.
- Another benefit (to Nintendo) of the system was that legal third-party
- development was severely hindered. Only Nintendo licensees could buy the
- lockout chips, one of which was fitted inside every game cartridge. Licensees
- were apparently charged around US$9 for each chip, in addition to having to pay
- steep royalties. Nintendo patented the lockout chip concept, and copyrighted
- the code contain within it.
- Nintendo also used the lockout system to provide "territorial protection". This
- means that you can't use a U.K. or European NES game in a U.S. console, for
- example.
- Nintendo used exactly the same system for the Super NES. American and Japanese
- consoles use identical lockout chips. You can run Japanese games on an American
- console by simply removing two plastic tabs from behind the cartridge slot.
- PAL versions of the Super NES use a different lockout chip. So PAL cartridges
- cannot be played on an American or Japanese machine, or vice versa. Many
- companies produced "universal adapters" to get around this problem. Typically,
- these have two cartridge slots. You put the foreign game in one, and a domestic
- game in the other. The adapter uses the lockout chip from the domestic game to
- enable the foreign game to be played.
- How the Lockout System Works
- ----------------------------
- This is a very brief, simplified description. Consult Nintendo's patent for
- detailed information.
- Functionally identical chips are fitted in the console and inside every game
- cartridge. (For the SNES, the chips are packaged differently - the one inside
- the console is surface-mounted, and the one in game cartridges is usually a
- normal DIL package.)
- Depending on whether a certain pin (pin 4) of the chip is grounded or at +5V,
- the chip functions as either a lock or as a key. Inside the console, pin 4 of
- the lockout chip is at +5V (lock), and inside the game cartridge pin 4 is at 0V
- (key).
- When you switch on the console, the CPU and PPU chips are held in a reset
- state. The two lockout chips talk to each other. Since they are identical, they
- should be saying exactly the same thing at exactly the same time. Each chip
- compares its output with that of its counterpart. If they match, the lock chip
- releases the reset state of the console, and the game can start. The two chips
- still talk to each other, and if their outputs ever differ, the lock chip
- causes the console to reset, and the key chip (inside the game cartridge) may
- use the chip select lines of the cartridge ROM chips to disable the ROMs.
- The lockout chip is in fact a 4-bit microprocessor with its own internal ROM
- and RAM. The program it runs was called "10NES" for the NES version of the
- chip.
- How the Modification Works
- --------------------------
- This depends on changing the lock device to think that it's actually a key. If
- both devices are configured to be the same type (i.e., both keys), to quote
- Nintendo's patent "an unstable state takes place and no operations are
- performed at all." This means that the two chips will do nothing. So the
- console will not be reset, and the key device will not disable the cartridge
- ROM chips.
- To carry out the modification you need to disconnect pin 4 of the lockout chip,
- and connect this pin to ground (0V) instead. (In fact, it seems that you only
- need to disconnect the pin.)
- Whilst coming up with this method, I considered two other possible ways of
- achieving the result. I have not tried either of these, and I would be
- interested to hear if they work. If you feel like doing one of these, contact
- me for pinout information. The first involves connecting the lockout chip's
- input to its own output. Thus it may always think that its counterpart chip is
- present. The second involves simply disconnecting the chip's clock input.
- Performing the Modification
- ---------------------------
- Whilst the modification is very simple, if you have not used a soldering iron
- before I suggest that you ask someone who has some experience with soldering
- and electronics in general to help you. Maybe your local TV repair person will
- be willing to do it for you, if you provide a copy of this document and a
- screwdriver for opening the Super NES case.
- Game consoles, in common with most modern electronic devices are VERY SENSITIVE
- TO STATIC ELECTRICITY. Ideally, wear a grounding strap and work on a conductive
- surface when modifying your console. Avoid wearing clothes containing man-made
- fibres, which are prone to static (e.g. nylon). As far as possible, avoid
- touching component leads or PCB tracks. Handle the board by its edges.
- Print out and read this document several times before opening your console.
- You will need the following:
- · A screwdriver suitable for opening the Super NES case. The screws are special
- tamperproof screws, referred to as "System Zero" or "Line Head System". A
- suitable screwdriver can be obtained from a company called MCM Electronics in
- the USA (http://www.mcmelectronics.com/) or from RS Components in the UK.
- · A crosshead screwdriver suitable for removing some screws inside the Super
- NES (a "No. 1" bit will be suitable).
- · A low power grounded soldering iron with a fine bit and some desoldering
- braid.
- · A thin needle or similar implement.
- · A pair of sharp scissors.
- When removing screws, make sure you remember which type goes in which hole!
- Here are step-by-step instructions:
- 1. Turn off the console and remove all leads attached to it (AC adapter,
- controller, A/V lead, etc.). After doing this, turn the power switch on for
- a couple of seconds and then off again. This dissipates any stored charge
- inside; you may see the power LED light for a moment as you do this. IT IS
- *VERY IMPORTANT* THAT YOU DO THIS! YOU RISK DAMAGING YOUR CONSOLE IF YOU
- DO NOT!
- 2. Turn the console upside-down, and remove the six screws from the base. Turn
- it back over, and lift off the upper part of the case. Position the console
- so that it is facing you.
- 3. Remove the eject lever. Pull up the right-hand side of the metal rod and
- slide it out, then remove the lever and spring.
- 4. Remove the two screws which secure the power switch to the casing. Lift up
- the switch so that you can get at the screw below.
- 5. Gently remove the ribbon cable which leads to the controller socket PCB
- from the connector at the front of the PCB.
- You do not need to do this if you have a late revision console. You can
- identify this by the fact that there are only two screws holding down the
- shielding, and you can see that the ribbon cable does not interfere with
- removal of the shielding.
- 6. Now unscrew the metal shielding from in front of the cartridge slot. The
- exact details of this step depend on which revision PCB your console has. I
- will give specifics for the three variants that are known to me.
- · For early consoles, which can be identified by the separate plug-in sound
- module "SHVC-SOUND", there are six screws to remove from the shielding,
- including the two which are on either side of the cartridge slot. (After
- removing the shielding, you may see "SHVC-CPU-01" printed on the PCB if
- you have a U.S. or Japanese console.)
- · For later consoles, which have no separate sound module, there are four
- screws to remove. (You may see "SNSP-CPU-02" printed on the PCB after
- removing the shielding for a PAL console.)
- · For still later consoles, there are two screws to remove. For this type
- of console, there is no need to remove the controller ribbon cable. (You
- may see "SNS-CPU-GPM-01" printed on the PCB after removing the shielding
- for a U.S. model console.)
- 7. Carefully lift up the metal shielding. The edges may be quite sharp. You
- will see various chips. There is more than one type of SNES PCB. Earlier
- models can be distinguished because the sound hardware is contained in a
- separate plug-in module labelled "SHVC-SOUND" (towards the rear right of
- the console). Later revisions integrated this onto the main PCB.
- The position of the lockout chip depends on which kind of PCB your console
- has. For a U.S. model console with separate sound module, PCB revision
- "SHVC-CPU-01", the lockout chip is labelled U8 on the PCB, and says:
- F411
- © 1990
- Nintendo
- It is located just behind the reset switch.
- For a later revision PAL console with integrated sound, PCB revision
- "SNSP-CPU-02", the lockout chip is labelled U8 on the PCB, and says:
- F413A
- © 1992
- Nintendo
- It is located towards the front left of the PCB, near the power switch.
- For a still later revision U.S. console, PCB revision "SNS-CPU-GPM-01", the
- lockout chip is labelled U8 on the PCB, and says:
- F411A
- © 1990
- Nintendo
- It is located behind and to the left of the reset switch.
- 8. Locate pin 4 of the lockout chip. The pins at each corner are numbered on
- the PCB. Just count along from pin 1 to find pin 4.
- 9. Use the desoldering braid and soldering iron to remove some of the solder
- from pin 4. It may help to cut the end of the braid into a "V" shape, so
- that you don't inadvertently desolder any adjacent pins. Position the end
- of the braid over where pin 4 meets the PCB, and briefly press down on this
- with the soldering iron bit. You should see that some solder has been
- "sucked into" the braid.
-
- Using the needle, apply a gentle levering action to the pin as you
- momentarily touch the soldering iron to it. The pin should come away from
- the PCB. Carefully pull it up using the tip of the needle as a lever, so
- that the end is a couple of millimetres away from the PCB.
- 10. That's it! You can optionally solder a short length of wire between pin 4
- and 0V. Pin 9 of the lockout chip is at 0V, so you could connect these two
- pins. Alternatively, you may wish to add a switch; see the "Possible
- Incompatibilities" section below.
- 11. It is a good idea to test the console before putting it back together. Rest
- the power switch on its mounting and connect the AC adapter, controller,
- video lead and a game pak. Switch the console on. If all has gone well, the
- display should appear as usual. Turn the console off, and insert a foreign
- game pak (i.e., a U.S. or Japanese game pak if you have a PAL console; PAL
- game pak if you have a U.S. or Japanese console). Turn the console off and
- remove all attachments (AC adapter, etc.). Turn the power switch on and
- then off.
- 12. Put the console back together. The procedure is the reverse of steps 2 to 7
- above. You may find fitting the eject lever tricky. If so, put the metal
- rod through the lever, and put the spring on the left end of this, so that
- the outwards-pointing end of the spring is downwards. The outwards-pointing
- end should be the longer of the two. Ease the spring and lever into
- position, ensuring that the end of the spring goes into the recess in the
- casing. Now carefully move the other end of the spring back until it is in
- the recess in the lever.
- Possible Incompatibilities
- --------------------------
- A few very recent titles may be incompatible with this modification. One
- example is PAL "Street Fighter Alpha 2", used with a PAL SNES whose lockout
- chip has been disabled. The graphics were reported to be corrupted in some way.
- There is also reported to be more than one version of "Super Mario RPG", one of
- which may be incompatible.
- I know why this is. One explanation might be that Nintendo changed the lockout-
- related circuitry inside the cartridges, to detect the "deadlock" situation
- caused by disabling the console's lockout chip, and interfere with normal use
- of the game in this case.
- To solve this problem, and allow at least all domestic titles to be played, you
- can fit a DPST switch to pin 4 of the lockout chip. Connect the middle switch
- terminal to pin 4, and the other two terminals to +5V and ground respectively.
- Then, with the switch in one position the lockout chip will be disabled, and in
- the other it will operate as normal. Contact me if you are unsure of how to do
- this.
- At Your Own Risk!
- -----------------
- There are some interesting things which can be done now that the lockout chip
- is disabled. If you try the following, it is at your own risk. Be aware that
- removing a game pak while the console is on may damage your console or your
- game pak.
- If your SNES has an "eject prevention lever", you will have to try this before
- fitting the case back on. (To see whether your console has one, open the game
- pak shutter, and move the power switch. If you see a piece of plastic move out
- when the switch is in the "on" position, that is the eject prevention lever.
- Nintendo removed this from later U.S. models of the SNES, at least.)
- Plug in a game pak; "Street Fighter II" is a suitable one. Turn on the console,
- and wait until some music starts playing. Now carefully remove the game pak,
- without turning off the console first. You should find that the display blanks,
- but the music keeps playing until the end of the tune! This is because the
- sound processor has its own RAM, and the music code is loaded into this. So
- music continues to play even after removing the game pak.
- ---
|