22

I've read that the PlayChoice 10's security system includes a 64-bit serial EPROM that gets compared against the first 64 bits of code, and that it's possible to swap the ROMs between compatible cartridges (that use the same mapper) to play different games. What's not clear is exactly which program code is compared with the security EPROM - does this work because different games happen to have the same first 64 bits, is it checking against the PlayChoice-only title/instructions ROM, or does this only work with an alternate PlayChoice BIOS?

  • 1
    Great first post, welcome to Retrocomputing! – JAL Jan 3 '17 at 18:08
  • 1
    The 6502 begins executing code pointed to by $FFFC/$FFFD which obviously means the "first 64 bytes of code" can vary. Most if not all normal NES PRG ROM mappers work on 8K or 16K blocks, and switch in a default "block 0" on reset (on some mappers the upper 8K or 16K is a fixed block). So I think this is probably what external hardware would consider the "first 64 bytes", which would start at $8000 or $C000 on the NES memory map. – LawrenceC Jan 6 '17 at 17:59
  • 2
    The NES PlayChoice has a Z80 that manages the security and game selection logic, wired into the same large PCB as the NES part. – joeforker Jul 21 '17 at 16:30
12

The security is handled entirely by the Z80, the NES side of the machine has no awareness of anything outside of the normal behavior of an NES. In fact, all the games (except for Mike Tyson's Punch Out) are 100% identical to the NES cartridge versions, and frequently use the same maskROMs from the NES version. Because of this, you can exchange the ROMs for another game that uses the same mapper. The downside to this, is that in the game list and instructions screen, it will show up with the name/instructions of the original title. Note that the boards have extensive solder jumpers that can be used to allow it support various sizes of EPROMs and maskROMs.

There actually are 2 security chips on a Playchoice cartridge. There is the small serial ROM, and there is also another standard 27C64 EPROM that is used by the Z80. That ROM contains the game's name, instruction screen, and also the Z80 code that does the actual comparison to the serial ROM. If it doesn't match, then the game will not show up on the list.

So the Z80 boots into the Playchoice "BIOS" ROM, and when it selects a cartridge slot, the cartridge's Z80 ROM gets mapped into an area of the Z80's memory. The Z80 then executes code in that ROM to validate the cartridge.

This is known thanks to the work of Martin Korth (author of the NO$NES emulator), and he has also created a utility which will allow anyone to create a custom ROM with their own game name and instructions, and also does no checking of the serial ROM, so you no longer need that part on the board. I have designed my own Playchoice game boards and used his utility with it, it does work.

  • Welcome to Retrocomputing Stack Exchange. I wondered why the custom ROM would disable all checks - I just assumed that it was circumventing it and not actually replacing it. Thanks for the explanation of how this really works. – wizzwizz4 Oct 26 '17 at 7:57
  • 2
    Martin Korth is an absolute legend, by the way. His documentation is often the only thing you need to know a system inside out. Any platform he has touched, he has improved. – Tommy Oct 26 '17 at 11:25
  • Are you willing to share the gerbers? – joeforker Oct 26 '17 at 15:10
  • @joeforker what is a gerber? – Wilson Oct 26 '17 at 15:35
  • 1
    @Wilson it is a file that you use to get a printed circuit board manufactured – joeforker Oct 26 '17 at 17:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.