• Hello MLAers! We've re-enabled auto-approval for accounts. If you are still waiting on account approval, please check this thread for more information.

Apple custom ASIC dissection, imaging and analysis

Choose the ASIC you'd most like to see disassembled

  • Total voters
    19
K

Kai Robinson

6502
How many Custom Apple ASIC's are there? Hundreds, i bet! But, what i'm interested in, is the simpler stuff - in this case, the BBU, the SWIM, SND and RTC Chip from the SE to start with. 

Who's seen Ken Shirriff's blog posts before? The guy is nuts, but in the best possible way - take a look: https://www.righto.com/2020/08/reverse-engineering-8086s.html

This is the sort of thing i'd like to do with the custom ASICS, but i don't want to sacrifice working ones if i can help it - so...if anyone has any one of the aforementioned chips that are DEAD - please could you donate them to me so i can have them imaged?  The more chips of each type i can source, the easier it'll be to image, and ultimately, reverse engineer. 

One of the guys who's working in the same group as me on discord, for the A500++ project, Johan has been reverse engineering the Commodore C128 PLA in his spare time and has developed a process to decap and image most, if not all, of the die itself, so it can be analyzed. I may reach out to a few other people who might be interested, as well - but yes, this is the general idea. Of course join in, if you have the expertise!

This gives a good overview of the process, and the site also has a collection of commonly available die shots for analysis.

https://siliconpr0n.org/wiki/doku.php?id=delayer:wet 

And here's an example of Johan's work: https://chips.c128.se/8521R0/index.html

 
I know the MAME folks are always looking for decaps. I seem to recall the Apple Sound Chip being one that was tough to emulate.

 
SWIM, RTC, and SND is a good bet – you get them on many models.

What is the VIA chip, by the way? I've had Maxell bombs get them on Classics, but after doing some research I notice that many models have them.

 
ASC - too many Macs have ASC's left and right channels blended into mono for for driving the internal speaker. For one, it's a massive PITA to get get past that kluge to wring stereo of out of a Duo/DuoDock even tweaking system and driver for coaxing the PAS16 NuBus card to do the trick! ASC is a large enough package to do the likes of the Portable's kluge chip with modern logic, providing headers or a connector for a daughtercard if necessary for implementing internal stereo in any number of Macs and the likes of the PowerBook 1400c. Dunno if anyone would really be interested in doing something with such a thing when I guess you could hotwire to a line level stereo headphone jack, but it would be neat play with at board or daughtercard level.

On second thought, adding headers to a new logic board design for making the internal headphone jack connection might be a plan. Dunno, ASC/Sound limitations were the first thing that popped into my head when you asked for suggestions.

 
I have a 47.8MB TIFF (3800x4080px) of a decapped IWM, as well as a bunch of technical information (schematics, specs, engineering drawings, etc.). Do you already have these?

View attachment IWM_Info.zip

 
Last edited by a moderator:
The SWIM or GLU sound like good candidates for actually looking at what logic is inside something.  The ADB and Egret, as far as I know, we know what they are in terms of the underlying microcontroller, but we don't have the code running on that microcontroller.  So my suspicion is that in those cases there are perhaps better/easier ways to read the ROM out than decapping and imaging?  Then again, I'm mostly talking out of my hat here, so...

 
Kai Robinson said:
How many Custom Apple ASIC's are there? Hundreds, i bet! But, what i'm interested in, is the simpler stuff - in this case, the BBU, the SWIM, SND and RTC Chip from the SE to start with. 

Who's seen Ken Shirriff's blog posts before? The guy is nuts, but in the best possible way - take a look: https://www.righto.com/2020/08/reverse-engineering-8086s.html

This is the sort of thing i'd like to do with the custom ASICS, but i don't want to sacrifice working ones if i can help it - so...if anyone has any one of the aforementioned chips that are DEAD - please could you donate them to me so i can have them imaged?  The more chips of each type i can source, the easier it'll be to image, and ultimately, reverse engineer. 

One of the guys who's working in the same group as me on discord, for the A500++ project, Johan has been reverse engineering the Commodore C128 PLA in his spare time and has developed a process to decap and image most, if not all, of the die itself, so it can be analyzed. I may reach out to a few other people who might be interested, as well - but yes, this is the general idea. Of course join in, if you have the expertise!

This gives a good overview of the process, and the site also has a collection of commonly available die shots for analysis.

https://siliconpr0n.org/wiki/doku.php?id=delayer:wet 

And here's an example of Johan's work: https://chips.c128.se/8521R0/index.html
Click to expand...
actually, I think the Commodore SID chip needs properly reverse engineered. The clones that are out there, do not sound the same. 

 
Kai Robinson said:
How many Custom Apple ASIC's are there? Hundreds, i bet! But, what i'm interested in, is the simpler stuff - in this case, the BBU, the SWIM, SND and RTC Chip from the SE to start with. 
Click to expand...
I doubt there are nearly that many. They started out with single function ASICSs and consolidated processes within multi-function ASICS thereafter. I've always wondered what a timeline of Macs by family charted against the development tree of the ASICs on board would look like?

I'm all but sure the masks within the consolidated ASICs look different for each baseline function block and some functions become more powerful as you move along the consolidation/complexity tree, but concentrating on the basic building blocks ought to lead to a growing understanding of the logical functions in later, consolidated silicon?

 
I'd love to know where the masks/layouts/schematics for them are - or if they're just lost to time...

I know the WIM chip is basically a consolidation of an Apple Disk II card, and the SWIM is a minor improvement over that...we need more schematics for things - there has to be a way...i wonder, would apple not provide such things for vintage machines like they used to, to dealers?

 
Is there a reverse equivalent of a code disassembler to reassemble silicon masks into schematic form?

Don't recall the name of the non-destructive process or where I mentioned it, but it's new, out there and has to be a lot more efficient than de-capping.

As Cory said in the other thread, if anything like that still exists, it's boxed up in storage at the Stanford(?). Someone contacted the curator to find out the stored away bit, but mention (likely unnecessarily) needs be made that any magnetic storage media in those boxes needs to be backed up pronto. My guess is that what you're looking for is on tape.

 
IWM already has a bunch of FPGA re-implementations, here's one made by Steve Chamberlin inside the released Yellowstone design info:

https://github.com/steve-chamberlin/fpga-disk-controller

I'd think SWIM would not be that much harder to make your own re-implementation, and the RTC already has a number of re-implementations out and about too.  I'd probably be most interested in seeing the ADB dis-assembled to dump the mask ROM contents since it can't be dumped conventionally due to its code-protect configuration.  BBU and GLU, I'd suspect software emulator folks have already figured out enough of those to make translation into a hardware design fairly straightforward.  GLUE (SE/30) is probably still up in the air though, but maybe easy to also do re-implementation if all the info on previous models has been put together.

 
SWIM would be the one I would be interested in. It would be neat to get say, a Mac Plus SWIM capable including the .Sony ROM patch. 

 
You must log in or register to reply here.

Similar threads

D
Another IIci ROM hack
49 50 51
Replies
1K
Views
148K
uniserver
uniserver
Back
Top