Making an N64 T-Connector from a dead Passport Plus 3 - HELP NEEDED

[radorn]

I have a dead PP+3 and thought I could make use of it by turning it into a simpler (but hopefully still effective) T-Connector, to allow using of a local cart to boot import ones, given they use the same CIC variant. Since I have carts for all CIC's except for x106, this should not be a problem.

Here's what I did. I forcefully removed all the onboard chips, and then used crazynation's cart pinout to test pin connections.

http://www.crazynation.org/N64/n64_cart_info.htm

all pins find their way to the top cart except for 18 [CIC(15)_TO_PIF] and 43 [PIF_TO_CIC(14)] which only connect to the bootcart, obviously, and also pi 10 [/read] is not connected to either cart, because it's routed to reach 2 of the internal components and from one of them another trace finally reaches the cart. I guess this is how the cart controls what is read at each time so, at first, it can boot it's own code and then boot the actual game.
What I did was just route a cable to connect pin 10 from the console side connector to the top slot in the passport and tried the thing, but it didn't work.
Something that I find suspicious is that the bootcart connector is also connected to all the pins except pin 10, like the top connector, and not just those related to the CIC chip. This includes all the data lines and stuff, which, theoretically, are not needed for the bootcart, which is only lending it's bootchip.
I suspect that this and all the remaining traces left in the board are doing something they should not, preventing the thing from working, but at this point I don't know.

So this is when I ask for help.
Anyone knows what I did wrong and which is the correct way to do this? what pins have to be routed to each slot?

[Link83]

Its been a while since I last looked into this, so forgive me if theres any mistakes, but here how I remember the N64 security system working...

Its not just a simple matter of a matching security chips with the N64  as it was with the NES and SNES previously

The N64's PIF-NUS chip (the security chip inside the console) first checks if the cart has a valid CIC security chip. It then goes throw a check calculation with it which generates a checksum. At the same time the CIC security chip in the game tells the PIF-NUS to search a specific part of the games ROM for some lines of code that also generates a checksum. The PIF-NUS then compares the two checksums (one from the CIC and one from the games ROM) and if they dont match it wont allow the console/game to boot.

Each of the different CIC security chips tell the PIF-NUS to search different parts of the games ROM or have different lines of code which generate different checksums. For loads more information Nintendo's patent here will explain alot, and also other possible ways they could have made the security system work:-
http://www.google.com/patents?id=OnIDAAAAEBAJ&printsec=abstract&zoom=4

The Passport Plus 3 needs to control the 'read pin' so as to alter where the PIF-NUS reads the lines of security code in the games ROM. It can also attempt to 'replace' the security code with the correct one to match the CIC security chip in the boot cart so as to trick the PIF-NUS chip into booting the console/game - sometimes this is successful, sometimes it isn't.

---------------------------------------------------------------------------------------------------------------------------------------------------------------

I am not sure if what you hope to do is possible (Although I am pretty sure it should be) but if it is possible the boot CIC will need more than just the data in and data out pins connecting. If you look further down the page you linked to you will see the cart CIC has the following connections:-

VCC
GROUND
DATA IN
DATA OUT
CLK (1.5MHz)
COLD RESET

So all of those will need connecting to the boot cart (If you open an N64 cart you will be able to see what connections the CIC chip needs) You will also need to make sure that Data In, Data Out, Clock and Cold Reset signals are all disconnected from the top slot. I would also imagine that Pin 10 will need a direct connection to the correct pin in the top slot (Since you said it was interrupted by the Passports chip)

I think that should work but I take no responsibility for any damage/injuries caused if it doesnt!
(Hopefully someone more knowledgable on the N64's security than me will also chime in)

[radorn]

I really appreciate you took the time to explain all that, but I already knew about the general workings of the security scheme, and also, from my tests, all these pins you mention are already connected to the rear slot for the boot cart. Of course the first thing I did was checking that all the needed pins from the CIC pinout where reaching the rear slot. I even opened a real cart and traced them from the CIC to the edge and tested these specific pins. The pp+3 needed them for its normal operation anyways, so they are already connected. The problem, I think, is that more pins than these are connected to the rear slot too and that the left over traces may be causing trouble too.

So, basically, unless I failed somewhere, what you described is what I already did, and it didn't work.

Adding to that, I know that some carts have additional region checking and also other security measures and may not boot in my PAL machine even if I provide a cart with an equivalent PAL CIC chip, but many/most should work anyway (specially those with the standard 6102/7101 chip), since, from what I gather, that was how the first generation of t-connector import adapters worked.

[Link83]

Sorry, didnt realise you knew all that already 

I can only suggest double checking the pins on the slot and connector match 1:1, with the exception of the CIC pins. Also maybe remove the Passport Plus 3's chip if you havent already done so?   

[radorn]

From my first post.

"Here's what I did. I forcefully removed all the onboard chips, and then used crazynation's cart pinout to test pin connections."

I did

EDIT: I just rechecked evey pin's connectivity from edge to each of the connectors. All pins find their way to BOTH SLOTS with these exceptions:
Pin 10 (/read) only reaches the top slot, and pins 18 and 43 (both traces for the CIC) only reach the back slot.
I noticed that the traces for the save chips, for example, reach both slots, which could explain these warnings about lost saves while using these devices... quite bad design, I should say. But that's not the problem now.

The thing is that the needed pins for the CIC chip in the boot cart reach the back slot, so, that requirement is met. With the wire I laid for pin 10 between the edge connector and the top slot, the top slot should be readable but it still doesn't work. Maybe I should erase all the traces in the board (except the pins of the edge connector, of course), and lay my own cables so I can be absolutelly sure only the needed pins reach each cart.

[phreak97]

ok reviving an old post:(

if youre still trying this a good way to see if you've made a mistake would be to plug in two copies of the same game, both pal. if it doesnt boot you've got something wrong.