NEO-CMC: Difference between revisions

From NeoGeo Development Wiki
Jump to navigation Jump to search
No edit summary
No edit summary
Line 5: Line 5:
Bellow the detailed information:
Bellow the detailed information:


The NEO-CMC Chip is a Asic (Application Specific Integrated Circuit). This device can be programmed only once after be created severals prototypes until reach the stable condiction, using FPGA (Field Programmable Gate Array).  
The NEO-CMC Chip is a Asic (Application Specific Integrated Circuit).  
The Asci must be considerated a final step from this process.
This device can be programmed only once. Usually its a time consuming to design a custom chip directly, because this severals try to use FPGA (Field Programmable Gate Array) before of that. The Asic could be considered a final step from this process where many trials has been performed.


To get a intuition about costs related, please read this:
To get a intuition about costs related, please read this:
[[http://www.design-reuse.com/articles/9010/fpga-s-vs-asic-s.html FPGA vs ASICs production and design]]
[[http://www.design-reuse.com/articles/9010/fpga-s-vs-asic-s.html FPGA vs ASICs production and design]]


SNK had planned to put his next protection to try avoid NeoGeo piracy using the NEOCMC algorithm and the new PCB '''NEO-MVS CHAFIO'''.
SNK had planned to put protections to avoid NeoGeo piracy using the NEOCMC algorithm on the PCB '''NEO-MVS CHAFIO'''.


Because Toshiba was partner and not only made solution to hold data on it's Mask Roms (TC5xxxx), they has used its technology in Asic solutions to help to create this Chip. Until 1995 Toshiba had a line of Asics called TC190G series, the evolution of this series can be found at [[http://www.toshiba-components.com/ASIC/Technology.html Toshiba Technology RoadMap]].
This chip is a Toshiba Asic TC190G Series developed between 1990 and 1994. (TODO: include Datasheet)
 
The evolution of this series can be found at [[http://www.toshiba-components.com/ASIC/Technology.html Toshiba Technology RoadMap]].
The serie that SNK get advantage to build a valuable chip with it's algorithm to protect Cs and S1 initially was the serie TC190G:


The series TC190G cannot be found in datasheets anymore, but in past years had these models:
The series TC190G cannot be found in datasheets anymore, but in past years had these models:
Line 23: Line 22:
and more...
and more...


Apparently the last two models was used because the number of internal number of gates acceptable to the logic SNK have developed:
Inside this Custom Chip, SNK put the following Chip designs together:
*NEO-ZMC
*NEO-ZMC
*NEO-273
*NEO-273
*And a new scrambling system that interlaces M1 + (CX + S1) ROM data
*New scrambling system that interlaces M1 + (CX + S1) to decrypt all the Cartridge ROM data in real time.


Inicially the released model of CMC was '''NEO-CMC42''' on the following cartridges:
The first released PCB with this Asic was '''NEO-CMC42''' on the following cartridges:
{|  
{|  
|'''CART ID'''  
|'''CART ID'''  
Line 65: Line 64:
|}
|}


This version had only S1 and CRoms Encrypted and M1 remained in normal condition (unencrypted).  
On this version only S1 and CRoms were encrypted and M1 remained unencrypted. One year later SNK decided release one more layer on the algorithm, to encrypt M1 also on this mixer chip. Releasing the second model '''NEO-CMC50''' on the following cartridges:
This was just a "test", to see if SNK and Toshiba could be more further in protection.
Almost one year later SNK decided release one more layer on the algorithm, to encrypt M1 on the mixer.  
 
So they released the model '''NEO-CMC50''' on the following cartridges:
{|
{|
|'''CART ID'''  
|'''CART ID'''  
Line 115: Line 110:
|}
|}


Some peoples talk about Jockey Grand Prix not be a official game, but it´s not true.
Some peoples talk about Jockey Grand Prix not be a official game, but it´s not all true.
At least it's production was official of the card was official, because they had used the real encryption that cannot be mocked easily.
At least it's production was official, because was used the real encryption on that board.
Only the Toshiba and SNK knew the encryption. And until today "NO ONE" piracy goes so forensic to mock it. They prefer just Dump and use the dumped version on its own solution rater use the same chips.
That encryption cannot be mocked so easily and only the Toshiba and SNK knew the encryption.  
That explain why several M1 Rom release over the web wasn't correct until Andreas Naive create a mathematical algorithm and publish. This made capable to create a correct DUMPED version of the M1, but the actual released algorithm will not help anybody that desire to put other unencrypted game in the encrypted condition over '''NEO-MVS CHANFIO''' PCB. This will not work!!! Explanation Later.
 
Until today, nobody has released one card using in piracy market using the real chip.  
That explained why several M1 Rom release over the web wasn't correct until Andreas create a mathematical algorithm that can only half  decrypt M1 not totally. Cause totally must be include more controls and keys that only in possession of the hardware can be figured out.


Explanation Later!


Neo-CMC only have two series and can only be found in original cartridges encrypted as listed above.


[[File:brd_cmcnoref.jpg|thumb|"CMC50"]]
[[File:brd_cmcnoref.jpg|thumb|"CMC50"]]


Also found on [[ROM-Only boards|ROM-only]] arcade boards, without the "NEO-CMC" marking.
=Pinout=
=Pinout=
[[File:Neocmc_7050_7042_pinout.png]]
[[File:Neocmc_7050_7042_pinout.png]]

Revision as of 18:42, 2 December 2011

"CMC42" chip on a MVS cartridge. Picture courtesy of [MVS-Scans].

The most "basic" information published can be found at [MAME:neocrypt.c]

Bellow the detailed information:

The NEO-CMC Chip is a Asic (Application Specific Integrated Circuit). This device can be programmed only once. Usually its a time consuming to design a custom chip directly, because this severals try to use FPGA (Field Programmable Gate Array) before of that. The Asic could be considered a final step from this process where many trials has been performed.

To get a intuition about costs related, please read this: [FPGA vs ASICs production and design]

SNK had planned to put protections to avoid NeoGeo piracy using the NEOCMC algorithm on the PCB NEO-MVS CHAFIO.

This chip is a Toshiba Asic TC190G Series developed between 1990 and 1994. (TODO: include Datasheet) The evolution of this series can be found at [Toshiba Technology RoadMap].

The series TC190G cannot be found in datasheets anymore, but in past years had these models:

  • TC190G06CF7008
  • TC190G06CF7042
  • TC190G06CF7050

and more...

Inside this Custom Chip, SNK put the following Chip designs together:

  • NEO-ZMC
  • NEO-273
  • New scrambling system that interlaces M1 + (CX + S1) to decrypt all the Cartridge ROM data in real time.

The first released PCB with this Asic was NEO-CMC42 on the following cartridges:

CART ID TITLE NAME
070 Zupapa
251 King Of Fighters 99
252 Ganryu
253 Garou Mark Of the Wolves
254 Strikers 1945
255 Prehistoric Isle 2
256 Metal Slug 3
259 Bang Bead
260 Nightmare in the Dark
261 Sengoku 3

On this version only S1 and CRoms were encrypted and M1 remained unencrypted. One year later SNK decided release one more layer on the algorithm, to encrypt M1 also on this mixer chip. Releasing the second model NEO-CMC50 on the following cartridges:

CART ID TITLE NAME
008 Jockey Grand Prix
257 King Of Figthers 2000
262 King Of Figthers 2001
263 Metal Slug 4
264 Rage of the Dragons
265 King Of Fighters 2002
266 Power Instinct - Matrimele
267 Pochi to Nyaa
268 Metal Slug 5
269 SNK vs Capcom Chaos
270 Samurai Showdown Zero / Samurai Showdown 5
271 King of Fighters 2003
272 Samurai Showdown Zero Special / Samurai Showdown 5 Special

Some peoples talk about Jockey Grand Prix not be a official game, but it´s not all true. At least it's production was official, because was used the real encryption on that board. That encryption cannot be mocked so easily and only the Toshiba and SNK knew the encryption.

Until today, nobody has released one card using in piracy market using the real chip. That explained why several M1 Rom release over the web wasn't correct until Andreas create a mathematical algorithm that can only half decrypt M1 not totally. Cause totally must be include more controls and keys that only in possession of the hardware can be figured out.

Explanation Later!

Neo-CMC only have two series and can only be found in original cartridges encrypted as listed above.

File:Brd cmcnoref.jpg
"CMC50"

Pinout

Notes:

  • C_e_D[0-15]: C1/C3/C5/C7 data bus
  • C_o_D[0-15]: C2/C4/C6/C8 data bus
  • CX A[0-21]: C1/C2/C3/C4/C5/C6/C7/C8 address bus
  • Pins 87,88 contains a RC circuit clock driver like in a 8085 with X1 and X2 pinouts
  • Pins 89 and 92 are short circuited in Cartridge board.
Retrieved from "https://wiki.neogeodev.org/index.php?title=NEO-CMC&oldid=1539"