Thursday, May 13, 2010

ROM ripping rampage

When I bought the PromPro-7, it came with a lot of EPROM and related MCU chips. Unfortunately, the picture of it didn't migrate over when I switched accounts with this blog and I can't find the original picture. Since the PromPro-7 didn't work very well, they never got ripped. Although I really wasn't looking to get a parallel port unit, I finally got the tried and true Willem programmer since other things weren't working out. My Linux file server hasn't been up for a while since the software only works in Windows and I didn't feel like reconfiguring all of my shares and drives.
In addition to the chips the Prompro 7 came with, I've had a bunch of other boards and chips laying about my room. The largest was probably a stack of boards from a Siemens PBX that was thrown out and I got to torture. One of the first stumbling blocks I encountered from this was that there was a 1Mb EPROM on it. This is an issue since the stock Willem programmer can only handle 512Kb EPROMs. So, I ordered an adapter board and ripped it. I had a few other large EPROMs, so this turned out to be a good idea. One notable was from a Rockwell Collins Pro 2000-SL transciever/GPS unit that I found cheap ($20 shipped) on eBay a bit back. This unit should prove interesting for a variety of RE purposes since it seems to be military grade. Here is a picture of it:
The until is composed of 4 main board assemblies: power supply (+module), CPU board, GPS translator, and GPS. The GPS translator board is the only board that contained an easily accessible (socketed) ROM:
ROM data like GPS_SOLUTION_LOCK gives it a military feel. A 28F flash chip is also visible. Especially since I broke some of the flimsy cables on the PSU module, I might just rip the unit to shreds and rip all of the chips since its probably a better use of time than getting the unit running anyway. With some luck, there will be assorted ASICs using rare standard cell libraries that I can submit to Silicon Zoo.
There are several types of chips that are still in my rip queues though. The first are 24C SOIC EPROMs. This is what a small group of us has been doing to experiment with some radio units we've been messing with. Hopefully, more on that later as it develops. Although I have some adapter boards, I don't feel like soldering to them each time I want a clean rip. I might be able to get away with just gently placing them on the pads, but really I need a ZIF socket. I'll hopefully be ordering 150 mil and 200 mil SOIC8 compatible (probably SOIC16 and I'll just slide it into position as needed) ZIF sockets.
The second type are 27C PLCC32 type EPROMs. I didn't realize originally that I needed a seperate adapter for those and that the flash sockets wouldn't work for those. Next, I have the stack of MCS-48 combo MCU/EPROM ICs that also require an adapter to work with the Willem. Finally, I have some Altera ROMs I'm trying to rip. The bus pirate might be a good choice, but I actually have some old Altera programmers (Altera Programming Units (APU)) that I was hoping would be a nice way to rip them. Unfortunatly, it seems I can't see to read the ROMs unless I setup a project or something. Lame. Maybe there is a better behaved command line utility in the suite or I can port the code to an open source Linux program.
Of all of the boards and ROMs I've ripped, my favorite so far has come from an IBM RS/6000 43P Model 260. In one of the ROMs, I found the string:
16-6, Go Horns !
Take that, Dave
Probably thought that nobody would ever read that. This ROM I think was labeled 0373.


  1. Hi,

    I read the "16-6, Go Horns" in the hexa dump of firmware downloaded from IBM fixcentral.

    I have a 7043/260 IO planar and wanted to reflash manually the eprom, because I did a mistake. Can you help me finding the eprom on the motherboard, and help me to manually reflash it ?



  2. Hey,
    The file I have it in I called IBM_RS_6000__43P_260__AM29F040B__0373.bin This probably was a AM29F040 flash chip labeled "0373". However, there were 2 other chips. You'll first need to figure out which parts of the flash image go in which chip(s). It will help to know what went wrong with your flashing. Did you flash the wrong file? If so, you can use a copy of that file and compare it to the ripped ROMs to know which of them you clobbered. It will also tell you the file you need to write your image too as well.
    To actually burn it, you'll need a ROM burner. Probably the best bang for your book is a William unit. I tried to play around with some USB and serial units, but in the end it sadly worked a lot better than the others for general use. It will, however, require a parallel port. I also recommend a PLCC extractor so you don't do something that breaks the socket.
    Out of curiosity. is this a "oh dang I hurt my toy computer" or a "OH F*** WE KILLED THAT REALLY IMPORTANT COMPUTER NOBODY KNOWS ANYTHING ABOUT!" situation? Feel free to e-mail me directly at JohnDMcMaster if you have more questions