View Single Post
  #4   Report Post  
Posted to sci.electronics.repair
Jon Elson[_3_] Jon Elson[_3_] is offline
external usenet poster
 
Posts: 1,148
Default reading "secure" GAL chips

Ray Carlsen wrote:

I know they are almost a thing of the past but I wonder if there is
any way to extract the code from a protected GAL IC (example: GAL16V8A)
that has had its security bit set.
I repair mostly old Commodore 8 bit computers. There are a lot of
users of an after-market device called a RAMLink originally made by
Creative Micro Designs (CMD is now out of business) back in the 1980's,
and I was asked to repair a few of them. Turns out each one has four or
five GALs and they all are copy protected which makes repair of those
orphan devices impossible unless I can find a way to extract the code
from the chips in a working unit. Any hackers out there?

Ray

The amount of logic in the typical GAL is not very great. After figuring
out which pins are inputs and outputs, and the clock (I think that will
be a fixed assignment for most parts) you could probably hook them to
a computer parallel port and write a program to go through a bunch of
patterns. In most cases for glue logic on a CPU board, there is NOT going
to be a whole lot of feedback or state machines in them. Mostly it would
be expected to be D FFs and decode trees, and the logic should become
clear quickly.

In other words, a brute-force attack on the logic function with no attempt
to read back the program pattern.

Jon