Help identifying mac plus upgrade pcb

[Andrew]

Hello all,

I just bought a used mac plus. can someone help me identify this addon? It looks as some kind of rom expansion. Functionality-wise it does not make any difference.

thanks

 

[johnklos]

Very interesting. It's really hard to guess without reading out the ROM. It's a 16K ROM, whereas the originals are 64K, and since it can only replace 8 out of the 16 bits, I wonder if it's some sort of patch ROM swapped in to fix some bugs or something like that.

Reading the ROM from Mac OS, then comparing with the 128K Mac Plus ROM, should be informative.

 

[johnklos]

You can use this tool:

https://www.gryphel.com/c/minivmac/extras/copyroms/index.html

to get a copy of the ROM contents. This might help, too:

Macintosh Plus ROM:

1st version (Lonely Hearts, checksum 4D 1E EE E1 ):
Bug in the SCSI driver; won't boot if external drive is turned off.
We only produced about one and a half months worth of these.

2nd version (Lonely Heifers, checksum 4D 1E EA E1 ):
Fixed boot bug. This version is the vast majority of beige Macintosh Pluses.

3rd version (Loud Harmonicas, checksum 4D 1F 81 72):
Fixed bug for drives that return Unit Attention on power up or reset.
Basically took the SCSI bus Reset command out of the boot sequence
loop, so it will only reset once during boot sequence. This version
shipped with the platinum Macintosh Pluses.

 

[bibilit]

The upper Rom is original and I guess below the EPROM the second Rom is still there. 

Will the 16k unit be used for any kind of improvement ?

 

[Andrew]

I read in another thread that macs sold in japan had an eeprom expansion to accommodate for fonts. Being that the computer was sold in greece, could it be that the distributor did the same with greek fonts?

I do not care much about the card. The only reason I would dump it is if it could be isefull for someone else.

 

[cheesestraws]

If the Plus is working, it would be really interesting to see a dump of the composite ROM using the tool @johnklos linked above.  That would let people work out what it is.

 

[Andrew]

@cheesestraws , @johnklos I managed to export it. When doing a get-filehash, the exported one is different than the one I have in mini vmac. So i guess this confirms that some sort of rom patching is performed.

Also, why would someone sand off the markings on the small IC...

View attachment vMac-export.rom

 

[Andrew]

Actually, the rom sizes are different. My export is exactly 128kb, however mac plus roms I find on the internet are a few kb longer. Wht?

 

[cheesestraws]

Yes, the missing markings on the small chip struck me as odd, too...

I think the extra bits on the end of the Plus ROMs floating around are rubbish?  Some of the Plus ROMs I have here are the same length as yours, some are longer, but the longer ones are identical up to the point where the extra stuff starts, so...

Unless I'm doing something very wrong, there only seem to be two bytes of difference between this and the "Loud Harmonicas" (v3) ROM.  Two bytes of the form $8x for some x in the original are replaced with $88 in your patched ROM.  I have no idea why, perhaps someone more familiar with 68000 machine code can spot a pattern here (I can read the assembler, but how it actually maps to bytes is beyond me )

 

[CircuitBored]

This is a really neat discovery. 

One thing that's sticking out to me: what's with the two unused holes and traces to the left of the IC with no markings? The lunatic part of my brain wants to boot the machine with them shorted out just to see what happens. Can you use a multimeter to see if they have any continuity? 

I am having a lot of fun trying to envision what this little gizmo might be. 

 

[cheesestraws]

Also: is that a reflashable ROM chip?

Looks like a UV-erasable one to me.  The one-time-programmable ones tend to have the part number up the middle, like more conventional-looking chips, rather than at one end like that, IME.

 

[CircuitBored]

Looks like a UV-erasable one to me

I came to the same conclusion after I made my post, hence the edit. I've seen plenty of UV-erasables with stickers placed exactly so over the years. 

If whoever made this wanted to update the ROM they'd surely have just replaced the whole chip, not done this weird mod that required two extra chips on a custom PCB. I'm hazarding a guess that this is some sort of dual-ROM for making this Mac pretend to be something that it's not. 

@Andrew It would be great if you could try inserting just the original ROM chip into the slot that this mod currently resides in and then seeing if the system still boots. If it does, a second ROM dump would be in order. That way we can see if this custom circuitry is actually doing anything at the moment. 

 

[Andrew]

I came to the same conclusion after I made my post, hence the edit. I've seen plenty of UV-erasables with stickers placed exactly so over the years. 

If whoever made this wanted to update the ROM they'd surely have just replaced the whole chip, not done this weird mod that required two extra chips on a custom PCB. I'm hazarding a guess that this is some sort of dual-ROM for making this Mac pretend to be something that it's not. 

@Andrew It would be great if you could try inserting just the original ROM chip into the slot that this mod currently resides in and then seeing if the system still boots. If it does, a second ROM dump would be in order. That way we can see if this custom circuitry is actually doing anything at the moment. 

What you mean is to try it with the mod removed? This is my current setup. The original LO rom chip is in the factory socket and the plus works normal.

Also, doesn't the mac test the rom checksum during startup? If yes, why don't I get a sad mac icon?

If it is of any use, the seller told me that the Plus was used at a betting company. (A large well known greek betting company).

The two headers, go to pins 2 and 12 of the mystery ic. (1st pin being the one near the capacitor)

 

[CircuitBored]

What you mean is to try it with the mod removed? This is my current setup.

You should definitely post ROM dumps both with and without the mod installed if you can. 

The ROM checksum is stored as a 32-bit value in the first 4 bytes of the ROM and the Mac tests it pre-boot by adding all the 16-bit values in the ROM together and comparing the result to the checksum. 

If it is of any use, the seller told me that the Plus was used at a betting company.

How interesting. I think it's possible that this Mac was running some bespoke software that required a ROM modification to work properly. Perhaps it was a terminal in a gambling shop and this is some sort of security enhancement? 

Have you tried looking at the mystery IC under different light conditions? I'd be interested to see what it looks like under UV, for example. 

 

[demik]

Really interesting. It's definitively some sort of ROM patching.

Whats more interesting here, is that it's a patch on top of V3 ROMs. 

Agreeing with @PowerMac_G4 here, we need both dumps with and without the mod to get a proper diff.

Also if I remember correctly, vMac is patching ROMs, so that's why you are seeing differences.

 

[Andrew]

Hello,

I am uploading a 2nd dump, this time with the factory lo ROM in the factory slot. The good news is that the 2 exported files have indeed a different checksum, so I guess the mod does in fact work and perform some patching.

Update 1 - There are two bytes changed in total, and both of them are in near vicinity. Look below

1st difference:



2nd difference:



@PowerMac_G4 How does the checksum check succeed when the mod is in place?

View attachment vMac-without-mod.rom

 

[CircuitBored]

How does the checksum check succeed when the mod is in place?

Since the checksum is stored in the ROM the mod chip is probably inserting a new one to accommodate for itself. I can't think of any other feasible ways it could pass the checksum besides potentially using negative numbers to goof the results. I don't know enough to say whether that's actually possible on this hardware though. 

 

[Andrew]

Since the checksum is stored in the ROM the mod chip is probably inserting a new one to accommodate for itself. I can't think of any other feasible ways it could pass the checksum besides potentially using negative numbers to goof the results. I don't know enough to say whether that's actually possible on this hardware though. 

Actually that makes a lot of sense. The two differences add up to 0. (0x88+0x88-0x8E-0x82 = 0)

So I guess the only thing left is to figure out what is special about rom offsets 0xfbc9, 0xfc3b

 

[cheesestraws]

Actually that makes a lot of sense. The two differences add up to 0. (0x88+0x88-0x8E-0x82 = 0)

a-HA.  Well spotted.  I was too tired last night to do mental arithmetic and couldn't work out why the checksum hadn't changed.