| |
 |
|
|
Science Forum Index » Electronics - Design Forum » reversing a gate array
Page 1 of 1
|
| Author |
Message |
| Keith M |
 Posted: Tue Apr 29, 2008 3:06 pm |
|
|
|
Guest
|
I've got an old gate array that was developed in the mid-80's. While
most of the gate array function is documented, and available, a small
portion of it is simply not mentioned in anything I've found yet. It
was a custom(by definition?) chip used in a small number of products.
While it's a 48-pin DIP, the majority of the leads are used by the other
documented functions. The remaining (4) input leads and (4) output
leads are the ones I'm interested in.
Do you think that hooking a logic analyzer to the inputs and outputs
would be sufficient to determine the function? I have pinout
information and there appears to be a 1->1 relationship for input and
output pins. The pins in question are not clocks, or address/data busses.
I've also thought about simulating the inputs, since there are only
2^4=16 possibilities for input, and then recording the results at the
output.
There was no reason for obfuscation or encryption, etc --- just lack of
documentation.
Or am I completely crazy and have no chance of this working?
Thanks for the psychiatric exam. :)
Keith |
|
|
| Back to top |
|
| Frank Buss |
| Posted: Tue Apr 29, 2008 3:16 pm |
|
|
|
Guest
|
Keith M wrote:
Quote: I've also thought about simulating the inputs, since there are only
2^4=16 possibilities for input, and then recording the results at the
output.
This should work for simple lookup functions, but if it is e.g. a counter,
a shift register or something like this, or if it is related to the other
pins, there is not a simple 1:1 relationship.
--
Frank Buss, fb@frank-buss.de
http://www.frank-buss.de, http://www.it4-systems.de |
|
|
| Back to top |
|
| Joerg |
| Posted: Tue Apr 29, 2008 3:21 pm |
|
|
|
Guest
|
Keith M wrote:
Quote: I've got an old gate array that was developed in the mid-80's. While
most of the gate array function is documented, and available, a small
portion of it is simply not mentioned in anything I've found yet. It
was a custom(by definition?) chip used in a small number of products.
While it's a 48-pin DIP, the majority of the leads are used by the other
documented functions. The remaining (4) input leads and (4) output
leads are the ones I'm interested in.
Do you think that hooking a logic analyzer to the inputs and outputs
would be sufficient to determine the function? I have pinout
information and there appears to be a 1->1 relationship for input and
output pins. The pins in question are not clocks, or address/data busses.
I've also thought about simulating the inputs, since there are only
2^4=16 possibilities for input, and then recording the results at the
output.
It usually doesn't work that way. There could be all kinds of sequential
things happening in a gate array so that something might come out of it
umpteen clock cycles after some input has been static.
Quote: There was no reason for obfuscation or encryption, etc --- just lack of
documentation.
Or am I completely crazy and have no chance of this working?
Thanks for the psychiatric exam. :)
:-)
You best bet might be to
a. Try to understand the external stuff connected to those pins and
deduce the required gate array behavior from that.
b. Find at least one of the guys who worked on it 20+ years ago.
Seriously, that's exactly what I once did during a first consulting
project with a new client. I found that the system they produced needed
additional filering and a logarithmic function. Documentation of that
part? Pretty much zilch. So we searched and found the guy, made him an
offer, and bingo.
--
Regards, Joerg
http://www.analogconsultants.com/
"gmail" domain blocked because of excessive spam.
Use another domain or send PM. |
|
|
| Back to top |
|
| Mook Johnson |
| Posted: Wed Apr 30, 2008 1:45 pm |
|
|
|
Guest
|
"Keith M" <keithvz@yanktheobvious.verizon.net> wrote in message
news:idLRj.7202$zw6.5478@trnddc06...
Quote: I've got an old gate array that was developed in the mid-80's. While most
of the gate array function is documented, and available, a small portion
of it is simply not mentioned in anything I've found yet. It was a
custom(by definition?) chip used in a small number of products.
While it's a 48-pin DIP, the majority of the leads are used by the other
documented functions. The remaining (4) input leads and (4) output leads
are the ones I'm interested in.
Do you think that hooking a logic analyzer to the inputs and outputs would
be sufficient to determine the function? I have pinout information and
there appears to be a 1->1 relationship for input and output pins. The
pins in question are not clocks, or address/data busses.
I've also thought about simulating the inputs, since there are only 2^4=16
possibilities for input, and then recording the results at the output.
There was no reason for obfuscation or encryption, etc --- just lack of
documentation.
Or am I completely crazy and have no chance of this working?
Thanks for the psychiatric exam. :)
Keith
get the schematics for the boards and the firmware it was previously used
with and figure out what it was supposed to do. |
|
|
| Back to top |
|
| |
|
Page 1 of 1
All times are GMT - 5 Hours
The time now is Mon Sep 08, 2008 1:21 pm
|
|