Author Topic: SNES Lockout Chip Mods/Queries  (Read 13742 times)

Offline Link83

  • MassiveMember
  • ****
  • Posts: 248
SNES Lockout Chip Mods/Queries
« on: December 31, 2008, 04:33:34 am »
Hi all,
Recently I have been intrigued by the lockout chips used in the SNES and have a few questions I would love answered. As far as I know, there were three revisions of the lockout chip used in each region, which have the foillowing codes:-
NTSC     PAL
F411      F413              Launch/First revision consoles
F411A    F413A            Mid produced consoles
F411B    F413B            Later/last produced consoles

I have read that the F411B/F413B lockout chip used in later SNES consoles cannot be disabled like the earlier lockout chips - but is this confirmed? Has anybody actually tested the common lockout disable method (Method 1 below) doesnt work on the F411B/F413B chips? Or is it just a rumour?

My next query is regarding the best method for disabling the SNES lockout chip - I have read so many methods for doing this that I am totally bewildered!

Having read this document by Mark Knibbs:-
http://home.freeuk.com/markk/Consoles/SNES_Lockout.txt
I understand that the lockout chip simply holds the CPU and PPU chips in a state of 'reset' until its given the 'key' by the security chip in the cartridge, then it releases the chips from the 'reset' state.

The first mod suggest by Mark Knibbs seems to be the one most commonly used and is shown in the link below - I will call this Method 1:-
http://www.mmmonkey.co.uk/console/nintendo/snes-switches-2.htm
However some games are still incompatible with this mod (Such as Super Mario RPG, unless you mod the game)

Mark Knibbs also mentions two other possible mod methods:-
Method 2"The first involves connecting the lockout chip's input to its own output. Thus it may always think that its counterpart chip is present."
Method 3
"The second involves simply disconnecting the chip's clock input."
But I have no idea if these work - has anybody tested either of these and had any success?

Method 4
silver_surfers mod(?)
http://cgcc.ca/forum/viewtopic.php?t=4473&start=0&postdays=0&postorder=asc&highlight=&sid=a9598226d093caa42046fceea302453b
and
http://www.mmmonkey.co.uk/console/nintendo/snes-alt-region.htm
I am guessing this mod connects the two 'reset' points together, allowing the SNES to boot without the lockout chip at all - and that by removing the lockout chip it no longer 'challenges' the cartridge for the security chip/key at all? In theory this could be the best method? silver_surfer seemed to have had great success with it, but didnt seem to know about or use the 50/60hz mod.

Method 5
The last method (which I am guessing is the most successful) is to remove the security chip from a SNES game (from the same region as the console) and connect it directly to the lockout chip itself. Then cut the traces/lift the pins from the cartridge port that correspond to the lockout chip.
However this mod requires butchering a game, and is quite complex for a beginner, so I would prefer any of the previous methods to this.

So what is the overal consensus? I am leaning towards Method 4 being the best, but its not easily reversible if im wrong.  :(

...Or is there another option I have not covered? If it helps at all here are some links to the SNES lockout chip patent sheets where the idea for the Method 1 mod came from:-
http://www.google.com/patents?id=81EWAAAAEBAJ&dq=4,799,635
http://www.google.com/patents?id=h8kpAAAAEBAJ&dq=5,070,479
The pdf diagrams at the bottom of the links are quite interesting  ;)

Perhaps we could come up with a new improved method!  ;D
« Last Edit: December 31, 2008, 06:37:19 am by Link83 »

Offline Tiido Priimägi

  • MassiveMember
  • ****
  • Posts: 232
  • Mega Drive Modding Master
    • Tiido's QB45 & MD site
Re: SNES Lockout Chip Mods/Queries
« Reply #1 on: January 01, 2009, 06:26:28 am »
I have F413A in my PAL SNES, and its disabled in the "standard" manner, and it works fine.

How does tha Mario RPG cart work actually ?

I did an alternative lockout removal by just cutting the reset output from the chip, and wired the CPU side end to reset switch through an inverter (you can use one part of the logic chip on the lockout chip clock generator in NTSC machines) or make the switch use other power line, and single pull up resistor.
Mida sa loed ? Nagunii aru ei saa ;)

Offline l_oliveira

  • MassiveMember
  • ****
  • Posts: 497
Re: SNES Lockout Chip Mods/Queries
« Reply #2 on: January 01, 2009, 10:29:12 pm »
If you have access to failed SNES/SFC consoles, the F411/3 chip in them can be used as both key and lock.
Actually games such as "Super Mario World 2: Yoshi's Island" do use a F411 chip of the same kind that the one inside the console.
Remove one from a dead console and wire up as key chip then save yourself the hassle of ruining an perfectly fine cartridge.

Offline Link83

  • MassiveMember
  • ****
  • Posts: 248
Re: SNES Lockout Chip Mods/Queries
« Reply #3 on: March 25, 2009, 10:42:37 am »
Thanks for the replies and sorry for letting this thread die, I kept meaning to come back to it but just never got round to it...

Anyway, recently I have been looking into the SNES lockout chip some more and have been wondering why certain games (Super Mario RPG, Kirby's Fun Pak, Street Fighter 2 Alpha, etc) wont work with the lockout chip disabled.

I read that the reason these few games dont work is because the security chip in the cartridge is able to detect the 'deadlock' status with the lockout chip disabled (as a key), and since 'silver_surfers' mod (lockout chip totally removed) supposedly works with these games, it suggests to me that I could just disable the lockout chip in the usual way and then lift the F411/F413 CIC data in and CIC data out legs off the board (Pins 1 & 2?):-
http://www.dforce3000.de/snes/cic_pinout_d4s.txt
Shouldnt this then prevent the deadlock status as the cart CIC wouldnt be able to detect the error?

The only question I have is - if I lift these legs can I just leave them floating or should I connect them to something? Also would it be even necessary to lift the 'data in' pin, or could I just lift 'data out'?

Hope that all makes sense, and thanks in advance  :)
« Last Edit: March 29, 2009, 12:34:27 pm by Link83 »

Offline Tiido Priimägi

  • MassiveMember
  • ****
  • Posts: 232
  • Mega Drive Modding Master
    • Tiido's QB45 & MD site
Re: SNES Lockout Chip Mods/Queries
« Reply #4 on: March 28, 2009, 06:37:33 am »
I'd like to get one of those trouble games, but I'm not particulary fond of any...

I guess there is a reset line on the cartslot ? Perhaps the CIC in the cart is connected to it ? If so, cutting that line will make things work... Or if you don't want to mess with the cart, you'd have to cut it in the console... I don't think any of the special chip games make use of that signal, not sure...
Mida sa loed ? Nagunii aru ei saa ;)

Offline Hojo_Norem

  • MassiveMember
  • ****
  • Posts: 197
    • JCOM Computer Productions
Re: SNES Lockout Chip Mods/Queries
« Reply #5 on: March 29, 2009, 04:48:22 am »
I can't be certain but I guess that the reset output of the cart's lockout chip could be connected to the cart's mapper somehow.  If the cart can't validate the console then the lockout inside the cart could disable access to the rom (or do something nasty like tie the battery ram #WE and #CE low and continuously corrupt the save ram.)

The lockout for the NES was designed with this cind of feature but it was never used in any carts.  As the SNES lockout is very similar to the NES one its a surprise that Nintendo didn't use this function in their carts sooner than later.
l
Formerly 'butter_pat_head'

Offline Link83

  • MassiveMember
  • ****
  • Posts: 248
Re: SNES Lockout Chip Mods/Queries
« Reply #6 on: March 29, 2009, 12:27:07 pm »
Thanks for the replies :)

One of the things I realised whilst doing abit more research (although this may have been obvious to some people) is that all the games that are incompatible with the lockout chip disabled use a SNES 'enhancement chip' of some kind, such as the SA-1 (Super Mario RPG) or S-DD1 (Street Fighter Alpha 2)

Now you may be wondering whats so special about these two enhancement chips compared to the Super FX or DSP chips, Well the CIC security chip in these games has actually been combined with the extra processor chip! Its not a separate security chip anymore as it is in most other games. So now this CIC security chip actually has control over something - it can disable this extra processor so the game wont run :( Hence why these particular games have problems when the consoles lockout chip is disabled.

------------------------------------------------------------------------------------------------------------------------------------------

One interesting thing I found out about the SA-1 and S-DD1 chips that seems to be relatively unknown is that the CIC/security chip thats inside the processor can actually be 'switched' to be either NTSC or PAL! No other Nintendo CIC security chip that I know off can be configured in this way.

On the SA-1 chip if Pin 127 is connected to Ground the internal CIC will be NTSC and if its connected to VCC it will be PAL. See these pictures of the rear of a carts PCB for comparison (The key difference is circled in red):-
SA-1 NTSC (GND)-----------------SA-1 PAL (VCC)

(Game is Kirby Super Star/Kirby's Fun Pak)

On the S-DD1 chip if Pin 82 is connected to Ground the internal CIC will be NTSC and if its connected to VCC it will be PAL. See these pictures of the rear of a carts PCB for comparison (The key difference is circled in red):-
S-DD1 NTSC (GND)-------------S-DD1 PAL (VCC)

(Game is Street Fighter Alpha 2)

All pictures taken from SNES Central:-
http://www.snescentral.com/

If you are interested in modding these games for your region all you need to do is lift the particular leg on the chip and then connect it to whichever point you need for your region. You must have a working/enabled console lockout chip though  :-\

------------------------------------------------------------------------------------------------------------------------------------------

Although configuring each game to work on NTSC or PAL consoles is one solution, its not really what I am aiming for as it still requires the consoles lockout chip to be fully working :-[

However, after abit of research I am pretty confident I have a solution that should work (Although I havent tested it yet!) Basically theres four main signals that go from the SNES console to the carts CIC. Three of them come from the consoles CIC, they are:-
CIC Data In
CIC Data Out
CIC Reset Signal

and the last one is a separate Clock signal.

Now after reading a few old threads and your replies im pretty confident that if I remove either the Clock signal, the Reset signal, or both, that this will allow these games to work...

I have just bought an SA-1 game for testing and when it arrives I will experiment with removing different signals and let you know how I get on - wish me luck!  ;D
« Last Edit: May 21, 2010, 08:33:23 pm by Link83 »

Offline phreak97

  • ThrobbingMember
  • *****
  • Posts: 1043
Re: SNES Lockout Chip Mods/Queries
« Reply #7 on: May 04, 2009, 11:23:23 am »
I'm pretty keen to have a look at the lines that go between the cartridge and the cic, I remember i had a quick look be yeah, snes death stopped me from doing any more.. I've got a new console set up for testing now, so staying away from silver's mod i should be able to find something...

Offline simonbelmont2

  • BigMember
  • ***
  • Posts: 85
Re: SNES Lockout Chip Mods/Queries
« Reply #8 on: May 07, 2009, 02:48:17 am »
I've search about "Silver mod" and I found that was used on SNES MODEL II (don't know if Super Nintendo Jr. or Super Famicom Jr.). If someone tried Method 2 and Method 3 or know how to do please inform me.

By the way here are the patent sheets where the idea for the Method 1 mod came from (direct links):

- U.S. patent 4,799,635: http://www.google.com/patents?id=81EWAAAAEBAJ&pg=PA2&dq=4799635&source=gbs_selected_pages&cad=1_1#PPA1,M1

- U.S. patent 5,070,479: http://www.google.com/patents?id=h8kpAAAAEBAJ&pg=PA2&dq=5070479&source=gbs_selected_pages&cad=1_1#PPA1,M1
« Last Edit: May 07, 2009, 03:12:40 am by simonbelmont2 »

Offline simonbelmont2

  • BigMember
  • ***
  • Posts: 85
Re: SNES Lockout Chip Mods/Queries
« Reply #9 on: May 09, 2009, 02:59:10 am »
I've made some research about snes games with special chips and I found this sites:
http://wiki.pocketheaven.com/SNES_games_with_special_chips (list with little description)
and this
http://www.raregame.ru/file/c1/SNES_Games_with_Chips.doc (list with good description)
http://www.raregame.ru/file/50/SNES_Carts_List.txt (list without description)
Here you will find a list with some games that use special chips (SA-1 for example)
« Last Edit: May 10, 2009, 07:14:13 pm by simonbelmont2 »

Offline simonbelmont2

  • BigMember
  • ***
  • Posts: 85
Re: SNES Lockout Chip Mods/Queries
« Reply #10 on: May 09, 2009, 06:22:47 pm »
About the lockout chip, I have one question: if I don't disable the lockout chip (lockout chip is enabled) and change to 60 Hz it will damage the console (it's about a pal game on a pal console modded)? An friend of mine tried this and he said the console was working :o
If you do this it's realy working?
« Last Edit: May 09, 2009, 08:27:39 pm by simonbelmont2 »

Offline phreak97

  • ThrobbingMember
  • *****
  • Posts: 1043
Re: SNES Lockout Chip Mods/Queries
« Reply #11 on: May 09, 2009, 11:26:33 pm »
the refresh rate and the lockout chip (cic) are completely seperate parts of the console, you can have either of them switched either way at any time, you cant damage the console by doing that. the only way you would damage the console is if you wired it up incorrectly.

Offline simonbelmont2

  • BigMember
  • ***
  • Posts: 85
Re: SNES Lockout Chip Mods/Queries
« Reply #12 on: May 10, 2009, 05:17:12 am »
Then the pal games with special chip will work on the modded pal console when the frequency is 60 and the lockout chip is disabled.
So the problem is for ntsc console with pal games with special chip and pal console with ntsc games with special chip?

Offline phreak97

  • ThrobbingMember
  • *****
  • Posts: 1043
Re: SNES Lockout Chip Mods/Queries
« Reply #13 on: May 10, 2009, 10:29:39 am »
yep, thats right:)
but it just doesnt work, it wont actually damage anything.

Offline simonbelmont2

  • BigMember
  • ***
  • Posts: 85
Re: SNES Lockout Chip Mods/Queries
« Reply #14 on: May 10, 2009, 07:08:10 pm »
I think the best idea is to create a mod that simulate "lockout chip enabled". When the lockout chip is disabled actually will be "enabled".
I think if this mode can be done :-\
« Last Edit: May 10, 2009, 07:10:56 pm by simonbelmont2 »

Offline phreak97

  • ThrobbingMember
  • *****
  • Posts: 1043
Re: SNES Lockout Chip Mods/Queries
« Reply #15 on: May 10, 2009, 08:21:26 pm »
that's what my mod does, but I dont have any of the games that dont normally run so i cant really test it.

Offline taxititan

  • SmallMember
  • **
  • Posts: 4
Re: SNES Lockout Chip Mods/Queries
« Reply #16 on: June 29, 2009, 10:29:49 am »
Hi Ive just gotten a region lockout switch & also have a 60hz switch.
Mega man x3 pal uses the speedcheck pal protection every time you try to enter a door in the game when playing in 60hz.
So the lockout switch wont help any.
neither a converter will let me play mmx3 pal cart in 60hz.

Is there any action replay code I can use as bypass this??
I have a action replay mk3.

Offline phreak97

  • ThrobbingMember
  • *****
  • Posts: 1043
Re: SNES Lockout Chip Mods/Queries
« Reply #17 on: June 29, 2009, 07:20:51 pm »
As far as I know you'll just have to play in 50Hz. Chances are it will run too fast in 60Hz anyway..
I dont think I have any games which perform that check, otherwise I'd look into it for you.

Offline taxititan

  • SmallMember
  • **
  • Posts: 4
Re: SNES Lockout Chip Mods/Queries
« Reply #18 on: June 29, 2009, 11:15:18 pm »
Mega man x3 pal cart 50hz 60hz speed check issue Solved!

It works with action replay mk3 in 60hz!
I just start the game when the action replay MK3 cart switch is on the middle setting, and I choose europe in the meny, then start the game.
A great thing is that I dont have to insert an another cart into the other cart slot, on the action replay MK3 device.

Wow this game "ROX" un-emulated in 60hz with RGB!


And another thing Im sure of.
This game is not pal optimized,so 60hz mode gives both correct speed and aspect ratio ;)
Just compare with any emulator.

Offline l_oliveira

  • MassiveMember
  • ****
  • Posts: 497
Re: SNES Lockout Chip Mods/Queries
« Reply #19 on: June 30, 2009, 12:34:29 am »
Why not hack the cart ROM and make it into a full NTSC Megaman X3 game, then ?
;)

Offline taxititan

  • SmallMember
  • **
  • Posts: 4
Re: SNES Lockout Chip Mods/Queries
« Reply #20 on: June 30, 2009, 04:37:20 am »
There is also flash cart available from tototek.
But I dont wanna mess with my original mmx3 cartrige since I got it boxed, & its the most expensive pal game.

Offline AlmostOriginal

  • SmallMember
  • **
  • Posts: 6
Re: SNES Lockout Chip Mods/Queries
« Reply #21 on: September 23, 2010, 05:34:31 am »
Hello
I recently disabled my snes lockout chip it works great but I don't own any NTSC/JAP games to test it out.
Does any one know which NTSC/JAP/PAL games that don’t work? Does the snes work the same as a nes whit a disabled lockout chip?
 
 ???

Did anybody bought the Ultra16 Snes?
« Last Edit: September 23, 2010, 05:36:45 am by AlmostOriginal »