Hi all,
Since Dandu's dump of the 1.3 Pippin ROM (which supposedly does no authentication checks), my interest in Apple's only foray into the gaming console space has been renewed. I do a bit of homebrew game development for the Atari 2600 and Nintendo Virtual Boy in my spare time, and a few years ago ported an unreleased Pippin title to OS X and Windows, so I'm very interested in the possibility of unlocking homebrew for the Pippin.
I currently have in my custody two Pippin units on loan: a retail US @WORLD model, and a late atMark prototype. Both kits have the stock 5MB of RAM. I have dumped the ROMs of both units-- the @WORLD has ROM 1.2, and the prototype unit has the "Golden Master" pre-release ROM. Using Pease Turbo, I can (occasionally-- it's pretty flaky) mount an AppleShare over the printer port and run my own software, albeit very slowly. Relying on Pease Turbo however (or even the "Tuscon" CD-ROM) imposes additional constraints, particularly with regard to what INITs and other system files I may or may not choose to load at startup. I can alternatively mount an external hard drive using a dual drive SCSI ribbon cable in either kit, but only the prototype with the GM ROM can boot from an external drive. This by itself opens up a world of possibilities for running my own software on the Pippin-- anything that can run well in 3500K of RAM on a Power Mac 6100 is a solid candidate.
However, therein lies the rub-- I can only fully take control of the prototype system. Pippins are scarce enough, pre-release units even more so, 1.3 ROM Pippins possibly rarer than that. Seems I've hit a wall if I want a realistic shot at this.
Maybe not. All Pippin ROM boards are 120-pin PCBs with an as-of-yet unknown pinout. Retail Pippin ROM boards are populated with four custom Apple chips-- most probably ROM chips of some type, but without public datasheets or other relevant documentation, that's a dead end. *However* the GM ROM my prototype has is populated not with custom Apple chips, but with 16 AMD erasable Flash chips; AM28F020-120JC chips to be precise. Bonus points: the datasheet for that chip *is* available! Looks like my GM ROM was for the most part built with off-the-shelf components, the PCB itself notwithstanding.
What does all this mean? If the GM ROM board can be traced, and thereby cloned (not entirely unlike dougg3/BMOW's ROM SIMMs), then one could conceivably flash their own Pippin ROM and use it in a dev kit, a retail kit, or any Pippin really. In the absence of the RSA signing key and process to create new authenticated Pippin boot discs, this could be the key to making Pippin homebrew available to a wider audience. I don't know the capabilities of the 1.3 ROM since I have yet to experiment with it, but I do know that the GM ROM does allow for arbitrary software to boot and run, so at the very least, a cloned ROM board could be flashed with this ROM and thereby run homebrew software. As a test, I swapped out the 1.2 board for the GM board in my @WORLD with no observed issues, so if there are any differences in the final hardware, they appear to be irrelevant.
Now, I have some good news and some bad news. The bad news is that unfortunately, the GM ROM board appears to be a multi-layer PCB, so tracing it out will be non-trivial. I do not have access to an x-ray machine (yet, but I'm working on it) nor am I willing to destroy this rare board in my efforts by sanding down each layer. The good news though is that I think(?) I've determined the pin numbering based on labels near the ROM socket on the Pippin logic board, and based on those labels and the datasheet for the Flash chips, I've traced out a small percentage (about 1/6th) of the pins that have visible traces on the outer layers of the PCB.
I admit that I am in way over my head with this endeavor; I am very much a software guy, and I'm doing this mostly so I can get to the software part. Is there anybody with experience tracing multi-layer boards who could give me tips as to what to do next, what questions to ask, and/or who to go to for help?
Thanks
Since Dandu's dump of the 1.3 Pippin ROM (which supposedly does no authentication checks), my interest in Apple's only foray into the gaming console space has been renewed. I do a bit of homebrew game development for the Atari 2600 and Nintendo Virtual Boy in my spare time, and a few years ago ported an unreleased Pippin title to OS X and Windows, so I'm very interested in the possibility of unlocking homebrew for the Pippin.
I currently have in my custody two Pippin units on loan: a retail US @WORLD model, and a late atMark prototype. Both kits have the stock 5MB of RAM. I have dumped the ROMs of both units-- the @WORLD has ROM 1.2, and the prototype unit has the "Golden Master" pre-release ROM. Using Pease Turbo, I can (occasionally-- it's pretty flaky) mount an AppleShare over the printer port and run my own software, albeit very slowly. Relying on Pease Turbo however (or even the "Tuscon" CD-ROM) imposes additional constraints, particularly with regard to what INITs and other system files I may or may not choose to load at startup. I can alternatively mount an external hard drive using a dual drive SCSI ribbon cable in either kit, but only the prototype with the GM ROM can boot from an external drive. This by itself opens up a world of possibilities for running my own software on the Pippin-- anything that can run well in 3500K of RAM on a Power Mac 6100 is a solid candidate.
However, therein lies the rub-- I can only fully take control of the prototype system. Pippins are scarce enough, pre-release units even more so, 1.3 ROM Pippins possibly rarer than that. Seems I've hit a wall if I want a realistic shot at this.
Maybe not. All Pippin ROM boards are 120-pin PCBs with an as-of-yet unknown pinout. Retail Pippin ROM boards are populated with four custom Apple chips-- most probably ROM chips of some type, but without public datasheets or other relevant documentation, that's a dead end. *However* the GM ROM my prototype has is populated not with custom Apple chips, but with 16 AMD erasable Flash chips; AM28F020-120JC chips to be precise. Bonus points: the datasheet for that chip *is* available! Looks like my GM ROM was for the most part built with off-the-shelf components, the PCB itself notwithstanding.
What does all this mean? If the GM ROM board can be traced, and thereby cloned (not entirely unlike dougg3/BMOW's ROM SIMMs), then one could conceivably flash their own Pippin ROM and use it in a dev kit, a retail kit, or any Pippin really. In the absence of the RSA signing key and process to create new authenticated Pippin boot discs, this could be the key to making Pippin homebrew available to a wider audience. I don't know the capabilities of the 1.3 ROM since I have yet to experiment with it, but I do know that the GM ROM does allow for arbitrary software to boot and run, so at the very least, a cloned ROM board could be flashed with this ROM and thereby run homebrew software. As a test, I swapped out the 1.2 board for the GM board in my @WORLD with no observed issues, so if there are any differences in the final hardware, they appear to be irrelevant.
Now, I have some good news and some bad news. The bad news is that unfortunately, the GM ROM board appears to be a multi-layer PCB, so tracing it out will be non-trivial. I do not have access to an x-ray machine (yet, but I'm working on it) nor am I willing to destroy this rare board in my efforts by sanding down each layer. The good news though is that I think(?) I've determined the pin numbering based on labels near the ROM socket on the Pippin logic board, and based on those labels and the datasheet for the Flash chips, I've traced out a small percentage (about 1/6th) of the pins that have visible traces on the outer layers of the PCB.
I admit that I am in way over my head with this endeavor; I am very much a software guy, and I'm doing this mostly so I can get to the software part. Is there anybody with experience tracing multi-layer boards who could give me tips as to what to do next, what questions to ask, and/or who to go to for help?
Thanks