Jump to content

Apple custom ASIC dissection, imaging and analysis


Custom ASIC reverse engineering priority  

19 members have voted

  1. 1. Choose the ASIC you'd most like to see disassembled

    • RTC
    • GLU/BBU/GLUE Logic
    • ADB
    • WIM/SWIM
    • SND
      0
    • Other (state why in the thread)


Recommended Posts

How many Custom Apple ASIC's are there? Hundreds, i bet! But, what i'm interested in, is the simpler stuff - in this case, the BBU, the SWIM, SND and RTC Chip from the SE to start with. 

Who's seen Ken Shirriff's blog posts before? The guy is nuts, but in the best possible way - take a look: https://www.righto.com/2020/08/reverse-engineering-8086s.html

This is the sort of thing i'd like to do with the custom ASICS, but i don't want to sacrifice working ones if i can help it - so...if anyone has any one of the aforementioned chips that are DEAD - please could you donate them to me so i can have them imaged?  The more chips of each type i can source, the easier it'll be to image, and ultimately, reverse engineer. 

One of the guys who's working in the same group as me on discord, for the A500++ project, Johan has been reverse engineering the Commodore C128 PLA in his spare time and has developed a process to decap and image most, if not all, of the die itself, so it can be analyzed. I may reach out to a few other people who might be interested, as well - but yes, this is the general idea. Of course join in, if you have the expertise!

This gives a good overview of the process, and the site also has a collection of commonly available die shots for analysis.

https://siliconpr0n.org/wiki/doku.php?id=delayer:wet 

And here's an example of Johan's work: https://chips.c128.se/8521R0/index.html

Link to post
Share on other sites

ASC - too many Macs have ASC's left and right channels blended into mono for for driving the internal speaker. For one, it's a massive PITA to get get past that kluge to wring stereo of out of a Duo/DuoDock even tweaking system and driver for coaxing the PAS16 NuBus card to do the trick! ASC is a large enough package to do the likes of the Portable's kluge chip with modern logic, providing headers or a connector for a daughtercard if necessary for implementing internal stereo in any number of Macs and the likes of the PowerBook 1400c. Dunno if anyone would really be interested in doing something with such a thing when I guess you could hotwire to a line level stereo headphone jack, but it would be neat play with at board or daughtercard level.

 

On second thought, adding headers to a new logic board design for making the internal headphone jack connection might be a plan. Dunno, ASC/Sound limitations were the first thing that popped into my head when you asked for suggestions.

Link to post
Share on other sites

The SWIM or GLU sound like good candidates for actually looking at what logic is inside something.  The ADB and Egret, as far as I know, we know what they are in terms of the underlying microcontroller, but we don't have the code running on that microcontroller.  So my suspicion is that in those cases there are perhaps better/easier ways to read the ROM out than decapping and imaging?  Then again, I'm mostly talking out of my hat here, so...

Link to post
Share on other sites
On 9/18/2020 at 9:47 AM, Kai Robinson said:

How many Custom Apple ASIC's are there? Hundreds, i bet! But, what i'm interested in, is the simpler stuff - in this case, the BBU, the SWIM, SND and RTC Chip from the SE to start with. 

Who's seen Ken Shirriff's blog posts before? The guy is nuts, but in the best possible way - take a look: https://www.righto.com/2020/08/reverse-engineering-8086s.html

This is the sort of thing i'd like to do with the custom ASICS, but i don't want to sacrifice working ones if i can help it - so...if anyone has any one of the aforementioned chips that are DEAD - please could you donate them to me so i can have them imaged?  The more chips of each type i can source, the easier it'll be to image, and ultimately, reverse engineer. 

One of the guys who's working in the same group as me on discord, for the A500++ project, Johan has been reverse engineering the Commodore C128 PLA in his spare time and has developed a process to decap and image most, if not all, of the die itself, so it can be analyzed. I may reach out to a few other people who might be interested, as well - but yes, this is the general idea. Of course join in, if you have the expertise!

This gives a good overview of the process, and the site also has a collection of commonly available die shots for analysis.

https://siliconpr0n.org/wiki/doku.php?id=delayer:wet 

And here's an example of Johan's work: https://chips.c128.se/8521R0/index.html

actually, I think the Commodore SID chip needs properly reverse engineered. The clones that are out there, do not sound the same. 

Link to post
Share on other sites
On 9/18/2020 at 9:47 AM, Kai Robinson said:

How many Custom Apple ASIC's are there? Hundreds, i bet! But, what i'm interested in, is the simpler stuff - in this case, the BBU, the SWIM, SND and RTC Chip from the SE to start with. 

I doubt there are nearly that many. They started out with single function ASICSs and consolidated processes within multi-function ASICS thereafter. I've always wondered what a timeline of Macs by family charted against the development tree of the ASICs on board would look like?

 

I'm all but sure the masks within the consolidated ASICs look different for each baseline function block and some functions become more powerful as you move along the consolidation/complexity tree, but concentrating on the basic building blocks ought to lead to a growing understanding of the logical functions in later, consolidated silicon?

Link to post
Share on other sites

I'd love to know where the masks/layouts/schematics for them are - or if they're just lost to time...

 

I know the WIM chip is basically a consolidation of an Apple Disk II card, and the SWIM is a minor improvement over that...we need more schematics for things - there has to be a way...i wonder, would apple not provide such things for vintage machines like they used to, to dealers?

Link to post
Share on other sites

Is there a reverse equivalent of a code disassembler to reassemble silicon masks into schematic form?

 

Don't recall the name of the non-destructive process or where I mentioned it, but it's new, out there and has to be a lot more efficient than de-capping.

 

As Cory said in the other thread, if anything like that still exists, it's boxed up in storage at the Stanford(?). Someone contacted the curator to find out the stored away bit, but mention (likely unnecessarily) needs be made that any magnetic storage media in those boxes needs to be backed up pronto. My guess is that what you're looking for is on tape.

 

Link to post
Share on other sites

IWM already has a bunch of FPGA re-implementations, here's one made by Steve Chamberlin inside the released Yellowstone design info:

 

https://github.com/steve-chamberlin/fpga-disk-controller

 

I'd think SWIM would not be that much harder to make your own re-implementation, and the RTC already has a number of re-implementations out and about too.  I'd probably be most interested in seeing the ADB dis-assembled to dump the mask ROM contents since it can't be dumped conventionally due to its code-protect configuration.  BBU and GLU, I'd suspect software emulator folks have already figured out enough of those to make translation into a hardware design fairly straightforward.  GLUE (SE/30) is probably still up in the air though, but maybe easy to also do re-implementation if all the info on previous models has been put together.

Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Loading...
×
×
  • Create New...