Reverse Engineering the Macintosh SE PCB & Custom Chips for 1:1 reproduction

[maceffects]

@Phipli this one has the 2.5 newest Firmware. So if I copy that it should be good. The PDS card looks really strange. I hope it’s though hole but it maybe well be SMD.  In any event I’m sure I can reverse engineer that part if anyone wants to tackle the BBU. 
 

@quorten I must admit when things are above my head and the whole BBU is above my head. I know that the Brainstorm BBU does more than 16mhz per the results online.  Implementing those things is very much beyond my ability. I’m an accountant that likes to pretend he’s an engineer 

 

@ScutBoy at your convenience can you post pictures of the PDS card both sides? I want to start order parts I need to make a clone.  That one should be easy enough for me to do (I hope).  
 

[demik]

14 hours ago, Kai Robinson said:

@maceffects reversing a PAL is 'easy' if the PAL isn't registered!  Can use the PAL dumper PCB here and read it as a 27C020 and reverse it from the .bin file it produces. 

PALDUMPERV2.zip 11.26 kB · 3 downloads

 

 

Thanks, that will be useful !

[Phipli]

So could the contents of the Brainstorm be extracted from the firmware updater?

[ScutBoy]

8 hours ago, Phipli said:

So could the contents of the Brainstorm be extracted from the firmware updater?

Don't know, but the updater is on Macintosh Garden (along with previous versions) if you want to download it and play around

 

[Kai Robinson]

@asicsolutions - hadn't seen you for a few pages and it's starting to encroach on ASIC stuff again! Would you be up for helping the BBU reverse engineering?

[asicsolutions]

2 hours ago, Kai Robinson said:

@asicsolutions - hadn't seen you for a few pages and it's starting to encroach on ASIC stuff again! Would you be up for helping the BBU reverse engineering?

Always. I think @maceffectswas making a breakout board. If I can get a hold of an SE with the breakout board I can ressurect my HP logic analyzer. I'm also open to other ideas on how to figure out what is going on.

[techknight]

what about decapping a stock BBU. using fuming nitric acid, and doing some type of die imagry/scan? 

[maceffects]

3 hours ago, techknight said:

what about decapping a stock BBU. using fuming nitric acid, and doing some type of die imagry/scan? 

This can definitely be done but if I'm not mistaken it will need a scanning electron microscope and then someone to decode what is found.  I work at part-time at a university and they don't even let me near the good toys like that...  Though if anyone has access and knowledge to do so, that would be the most efficient way to do this.  Having a service do all of that could easily cost $10,000+.  For my accelerator idea, its not worth it and I don't think the combined effort for the new logic board is worth it.  But then again, if we know all of the logic on the board I don't see why a modern board using modern parts couldn't be made. 

 

@Kai Robinson that's right, I've ordered the 4 layer PCB from China and parts.  However, I realized this attaches to the PLCC on the logic board, right?  If so, I'm not sure I quite understand the entire design.  I get that the 84pin PLCC is on top with the BBU attached, but what about the one for the logic board, is there an adapter?  Can you send a photo of a completed unit?  Or maybe a part number for that.  I'll de-solder the PLCC from an SE board and attach the break-out and send it to @asicsolutions.  I don't really want to burden him too much on this project as I know he is busy and also is focusing much effort on the Xceed project.  While I think this might help a bit with this project, if it looks like it will take too much time, I'll see who I can dig up in China to help. 

 

[maceffects]

@techknight here is a cheap service in China: https://dirtypcbs.com/store/decap

 

But, if I'm not mistaken, if we can't see the gates it doesn't serve much purpose. 

[techknight]

2 hours ago, maceffects said:

@techknight here is a cheap service in China: https://dirtypcbs.com/store/decap

 

But, if I'm not mistaken, if we can't see the gates it doesn't serve much purpose. 

 

that was the idea of decapping and high resolution scans, for the potential of reverse engineering the gate structures. But, it would take someone in the semiconductor reverse engineering sector to know how to do this. 

[maceffects]

I'll ask around, it may be that I can find someone to do one or the other, but not both given that we aren't prepared to pay thousands.  That said, I'd even be willing to send a stock BBU for medium resultion pictures.  I'm not prepared to lose the Brainstorm for a crap decapping.  I'll ask one company how high of a resultion they can produce and at what given cost.  Maybe a medium resolution, @Kai Robinson's SE logic board schematic, and @asicsolutions's logic probe of the breakout can allow us to glean some of her secrets. 

 

 

[techknight]

2 hours ago, maceffects said:

but not both given that we aren't prepared to pay thousands.  

 

Yeaaahh.... thats kind of what I was afraid of. 

[Kai Robinson]

@maceffects, @techknight Actually...no need to pay thousands - friend of mine on discord is doing this with a desktop microscope and a raspberry pi4 w/HD camera module: https://chips.c128.se/8521R0/index.html

He's offered to decap and do die shots

Basically - if someone can get some DEAD custom chips - ie, ones with legs missing from battery damage etc - he can decap those, to spare working chips from being sacrificed. 

[maceffects]

@Kai Robinson I have a friend who has a good one in their battery damaged logic board.  Are you sure a digital microscope will get the gates?  In any case, PM me where to send this one to decap and do die shots.  Unless, anyone has a dead one, which I've never seen.  I'd assume it would be similar to the BBU from Brainstorm. 

[Kai Robinson]

4 hours ago, maceffects said:

 

@Kai Robinson that's right, I've ordered the 4 layer PCB from China and parts.  However, I realized this attaches to the PLCC on the logic board, right?  If so, I'm not sure I quite understand the entire design.  I get that the 84pin PLCC is on top with the BBU attached, but what about the one for the logic board, is there an adapter?  Can you send a photo of a completed unit?  Or maybe a part number for that.  I'll de-solder the PLCC from an SE board and attach the break-out and send it to @asicsolutions.  I don't really want to burden him too much on this project as I know he is busy and also is focusing much effort on the Xceed project.  While I think this might help a bit with this project, if it looks like it will take too much time, I'll see who I can dig up in China to help. 

 

 

So the board you have - you desolder the BBU socket - solder either of the socket locations on the PCB into the board, plug the BBU back into a socket located on that PCB, and then the pin headers allow you to snoop the signals. 

[maceffects]

@Kai Robinson are the pins going to be long enough or will I need a spacer?  Sorry for asking so many questions, I just want to have everything in place so I can solder it once it comes and send it off.

[Kai Robinson]

@maceffects https://www.ebay.co.uk/itm/40-Pin-2-54mm-0-1-19mm-Long-single-row-Male-Breakable-Pin-Header-NEW-UK-Seller/202448089589?hash=item2f22d8b1f5:g:PmsAAOSwEqhbqS9P or

https://www.ebay.co.uk/itm/2-54mm-Single-Row-Male-Connector-PCB-Board-Pin-Header-Long/223980988737?hash=item34264ea941:g:XwwAAOSwROtemjgA

is what you'll want to use as a spacer - to clear the other components. Just use rows of strips. 

I've found a supplier on UTSource claiming to have BBU's (searching by 343S0603) and i've ordered 8 of them - i'll sacrifice 1 or 2 of them for the cause, if they actually DO turn up!

Edited December 30, 2020 by Kai Robinson

[maceffects]

@Kai Robinson OK I got it use 2.54 pitch headers I bought mainly for the headers on the side as spacers to clear components.  Perfect!  I just wanted to make sure since I'd hate to spent a long time soldering dozens of 84-pin connectors, haha.  Let us know of those parts turn out to be genuine. 

 

Edited December 30, 2020 by maceffects

[Kai Robinson]

Mad idea - this weekend, who fancies a zoom call to brainstorm/collab?

[maceffects]

2 hours ago, Kai Robinson said:

Mad idea - this weekend, who fancies a zoom call to brainstorm/collab?

I'd be in if we can get some others involved.  I believe @asicsolutions will be busy this weekend.  I am free except 5-9pm (CST) on Saturday. 

[quorten]

@Kai Robinson Honestly I think much of the new interest here needs to spend some time to review some of the existing documentation we have before we can get much progress on a zoom call.  Really, there's not much hidden info remaining after my analysis thus far, I just feel that no one has yet taken the time to look at and play around with my work-in-progress.

 

But yeah, after some prep-work to get us together into a more cohesive team, I'd be in for a call.

[maceffects]

@quorten I'm a late comer to the party so I'm not sure what existing information you have.  Can you repost so we can all have a fresh look?  I will admit right now that I'm an accountant not an electrical engineer so I'm best suited for grunt work rather than careful electrical analysis, but I'll do whatever I can.  That includes paying someone who might be able to do more complex analysis than we can do.

[asicsolutions]

I can hop on a call. I'm not sure what I can add so far. I'm happy enough to throw in my experiences with capturing PCI traffic on a board I developed using my trusty albeit aging logic analyzer and what I could try to do with it to try to capture stuff in the ASIC. I'm happy to help understanding the die shots if you get any, although, all the ASIC work I've done, I've had access to the GDSII files and sources to fabricate, so I'm not sure how much help I'll be in reverse engineering it that way. 

 

 

[quorten]

@maceffects Sure, my GitHub repository for my leg of the project seeks to be a useful reference repository that links to all the pertinent information.  A lot of the essential information should be copied in and covered there.  I'll be updating it with a few more links shortly but it is pretty comprehensive so far.

 

https://github.com/quorten/macsehw

 

@asicsolutions It would probably be a good idea for you to head on over to hardware/fpga/bbu/test_mac128pal.v in my GitHub repository and play around simulating what I have there.  That will give you a good glimpse of how the signals will be looking like on your logic analyzer with the BBU, and also it will be helpful for forming a plan on which hypotheses need to be tested/verified about signal generation.

 

@Kai Robinson Do you think you could post the updated BOM and board diagrams/photos in your Macintosh SE Reloaded repository?

[maceffects]

@quorten, thank you!  This is some useful information.  I think with the Verilog data combined with a logic probe, this shouldn't be much problem.  Looks like you've done tons of work.  Thanks for all your efforts.