Disabling the Super NES/Super Famicom "Lockout Chip"
====================================================
(rev. 0.5 27-Dec-97)
[Expert summary: disconnect CIC pin 4]
This document is copyright © 1997 by Mark Knibbs <mark_k@iname.com>. The latest
version, and several other console-related documents, should be available at:
http://www.netcomuk.co.uk/~markk/index.html
The direct URL for this file is:
http://www.netcomuk.co.uk/~markk/Consoles/SNES_Lockout.txt
You are explicitly permitted to include the *unmodified* document on web sites,
FTP sites and the like. But it is best to simply link to the document on my web
page, as this means that you automatically pick up any changes made.
If you have any comments, suggestions or questions about this document, please
contact me. If you would like to perform a similar modification to your NES 8-
bit console, you should see:
http://www.netcomuk.co.uk/~markk/Consoles/NES_Lockout.txt
Revision History
----------------
0.1 27-Jul-97 First release.
0.2 19-Aug-97 Added information about another PCB revision and the lockout
chip used in U.S./Japanese consoles.Various other small
changes.
0.3 21-Aug-97 Added information about later model U.S. console (PCB
revision SNS-CPU-GPM-01). Added section about removing a game
pak with power on. Other minor changes.
0.4 22-Sep-97 Changed email address and web URLs. Added "Possible
Incompatibilities" section.
0.5 27-Dec-97 Added step describing how to dissipate stored charge in the
console before opening it. Added paragraph on precautions
against static electricity. Added pointer to my SNES 50/60Hz
modification document. Minor edits and changes.
Introduction
------------
This document details a simple modification that you can perform on your Super
NES or Super Famicom 16-bit video game console in order to disable the "lockout
chip" protection system. The "lockout chip" system means that no PAL games can
be played on an unmodified U.S. or Japanese console, or vice versa.
If you have a PAL model Super NES, I strongly recommend that you also fit a
switch to change between 50Hz and 60Hz modes. 60Hz mode runs games full-screen,
at the correct speed (20% faster than the usual PAL speed). Additionally, more
recent games (e.g. Super Mario All-Stars, Super Metroid) contain code to check
for 60Hz. So it is not usually possible to run, say, the Japanese version of
such a game on a PAL console. Details of this modification, and an accompanying
picture, can be found at:
http://www.netcomuk.co.uk/~markk/index.html
The procedure given here should work for ANY model Super NES or Super Famicom,
both NTSC and PAL versions. As of this writing I have only applied the
modification to two UK model PAL Super NES consoles.
Why might you want to do this? Well, I can think of a few reasons:
· You own a PAL Super NES, and currently have to use a clumsy "universal
adapter" to be able to use American or Japanese games - with this
modification you are able to directly use Japanese cartridges, and can use
American games either by cutting a larger hole for the cartridge, or using
an extension adapter (you can use your old universal adapter for this - you
will no longer need to plug in the second "domestic" cartridge);
· You own illicit or unlicensed games which can't be played on your console (I
have seen a counterfeit Street Fighter II cartridge which contains no lockout
chip, and thus normally requires that a universal adapter be used);
· If you own an American model console, you can make it run almost every SNES
game by removing the tabs behind the cartridge slot, disabling the lockout
chip, and fitting a 50Hz/60Hz switch. If you have a PAL or Japanese console,
you will need to file away the cartridge slot in order to accomodate the
larger U.S. cartridges, if you want to be able to directly run every game.
If you perform this procedure on your console, PLEASE LET ME KNOW WHETHER IT
WORKS! I want to update this document so that it's applicable to as many
consoles as possible. Please also tell me which PCB revision your console has
(e.g. "SHVC-CPU-01"), the model (e.g. "SNS-001"), serial number, and the date
code stamped on the label underneath (e.g. "9313"). I don't anticipate there
being many relevant differences between different SNES models, though. I would
welcome any comments you have about this document. Send them to the email
address given above.
If you are interested in the operation of the lockout chip and Nintendo's
history in general, you might like to read David Sheff's book "Game Over", and
consult U.S. patents 4,799,635 and/or 5,070,479. Indeed, I obtained the
information necessary to carry out this modification from one of the patents.
Background
----------
Before the NES was first released in the U.S.A., Nintendo developed a system
for preventing the use of unauthorised software with it. Much counterfeit
software had apparently been produced for their Famicom (Family Computer)
system, and Nintendo wanted to avoid this happening for the NES.
Another benefit (to Nintendo) of the system was that legal third-party
development was severely hindered. Only Nintendo licensees could buy the
lockout chips, one of which was fitted inside every game cartridge. Licensees
were apparently charged around US$9 for each chip, in addition to having to pay
steep royalties. Nintendo patented the lockout chip concept, and copyrighted
the code contain within it.
Nintendo also used the lockout system to provide "territorial protection". This
means that you can't use a U.K. or European NES game in a U.S. console, for
example.
Nintendo used exactly the same system for the Super NES. American and Japanese
consoles use identical lockout chips. You can run Japanese games on an American
console by simply removing two plastic tabs from behind the cartridge slot.
PAL versions of the Super NES use a different lockout chip. So PAL cartridges
cannot be played on an American or Japanese machine, or vice versa. Many
companies produced "universal adapters" to get around this problem. Typically,
these have two cartridge slots. You put the foreign game in one, and a domestic
game in the other. The adapter uses the lockout chip from the domestic game to
enable the foreign game to be played.
How the Lockout System Works
----------------------------
This is a very brief, simplified description. Consult Nintendo's patent for
detailed information.
Functionally identical chips are fitted in the console and inside every game
cartridge. (For the SNES, the chips are packaged differently - the one inside
the console is surface-mounted, and the one in game cartridges is usually a
normal DIL package.)
Depending on whether a certain pin (pin 4) of the chip is grounded or at +5V,
the chip functions as either a lock or as a key. Inside the console, pin 4 of
the lockout chip is at +5V (lock), and inside the game cartridge pin 4 is at 0V
(key).
When you switch on the console, the CPU and PPU chips are held in a reset
state. The two lockout chips talk to each other. Since they are identical, they
should be saying exactly the same thing at exactly the same time. Each chip
compares its output with that of its counterpart. If they match, the lock chip
releases the reset state of the console, and the game can start. The two chips
still talk to each other, and if their outputs ever differ, the lock chip
causes the console to reset, and the key chip (inside the game cartridge) may
use the chip select lines of the cartridge ROM chips to disable the ROMs.
The lockout chip is in fact a 4-bit microprocessor with its own internal ROM
and RAM. The program it runs was called "10NES" for the NES version of the
chip.
How the Modification Works
--------------------------
This depends on changing the lock device to think that it's actually a key. If
both devices are configured to be the same type (i.e., both keys), to quote
Nintendo's patent "an unstable state takes place and no operations are
performed at all." This means that the two chips will do nothing. So the
console will not be reset, and the key device will not disable the cartridge
ROM chips.
To carry out the modification you need to disconnect pin 4 of the lockout chip,
and connect this pin to ground (0V) instead. (In fact, it seems that you only
need to disconnect the pin.)
Whilst coming up with this method, I considered two other possible ways of
achieving the result. I have not tried either of these, and I would be
interested to hear if they work. If you feel like doing one of these, contact
me for pinout information. The first involves connecting the lockout chip's
input to its own output. Thus it may always think that its counterpart chip is
present. The second involves simply disconnecting the chip's clock input.
Performing the Modification
---------------------------
Whilst the modification is very simple, if you have not used a soldering iron
before I suggest that you ask someone who has some experience with soldering
and electronics in general to help you. Maybe your local TV repair person will
be willing to do it for you, if you provide a copy of this document and a
screwdriver for opening the Super NES case.
Game consoles, in common with most modern electronic devices are VERY SENSITIVE
TO STATIC ELECTRICITY. Ideally, wear a grounding strap and work on a conductive
surface when modifying your console. Avoid wearing clothes containing man-made
fibres, which are prone to static (e.g. nylon). As far as possible, avoid
touching component leads or PCB tracks. Handle the board by its edges.
Print out and read this document several times before opening your console.
You will need the following:
· A screwdriver suitable for opening the Super NES case. The screws are special
tamperproof screws, referred to as "System Zero" or "Line Head System". A
suitable screwdriver can be obtained from a company called MCM Electronics in
the USA (http://www.mcmelectronics.com/) or from RS Components in the UK.
· A crosshead screwdriver suitable for removing some screws inside the Super
NES (a "No. 1" bit will be suitable).
· A low power grounded soldering iron with a fine bit and some desoldering
braid.
· A thin needle or similar implement.
· A pair of sharp scissors.
When removing screws, make sure you remember which type goes in which hole!
Here are step-by-step instructions:
1. Turn off the console and remove all leads attached to it (AC adapter,
controller, A/V lead, etc.). After doing this, turn the power switch on for
a couple of seconds and then off again. This dissipates any stored charge
inside; you may see the power LED light for a moment as you do this. IT IS
*VERY IMPORTANT* THAT YOU DO THIS! YOU RISK DAMAGING YOUR CONSOLE IF YOU
DO NOT!
2. Turn the console upside-down, and remove the six screws from the base. Turn
it back over, and lift off the upper part of the case. Position the console
so that it is facing you.
3. Remove the eject lever. Pull up the right-hand side of the metal rod and
slide it out, then remove the lever and spring.
4. Remove the two screws which secure the power switch to the casing. Lift up
the switch so that you can get at the screw below.
5. Gently remove the ribbon cable which leads to the controller socket PCB
from the connector at the front of the PCB.
You do not need to do this if you have a late revision console. You can
identify this by the fact that there are only two screws holding down the
shielding, and you can see that the ribbon cable does not interfere with
removal of the shielding.
6. Now unscrew the metal shielding from in front of the cartridge slot. The
exact details of this step depend on which revision PCB your console has. I
will give specifics for the three variants that are known to me.
· For early consoles, which can be identified by the separate plug-in sound
module "SHVC-SOUND", there are six screws to remove from the shielding,
including the two which are on either side of the cartridge slot. (After
removing the shielding, you may see "SHVC-CPU-01" printed on the PCB if
you have a U.S. or Japanese console.)
· For later consoles, which have no separate sound module, there are four
screws to remove. (You may see "SNSP-CPU-02" printed on the PCB after
removing the shielding for a PAL console.)
· For still later consoles, there are two screws to remove. For this type
of console, there is no need to remove the controller ribbon cable. (You
may see "SNS-CPU-GPM-01" printed on the PCB after removing the shielding
for a U.S. model console.)
7. Carefully lift up the metal shielding. The edges may be quite sharp. You
will see various chips. There is more than one type of SNES PCB. Earlier
models can be distinguished because the sound hardware is contained in a
separate plug-in module labelled "SHVC-SOUND" (towards the rear right of
the console). Later revisions integrated this onto the main PCB.
The position of the lockout chip depends on which kind of PCB your console
has. For a U.S. model console with separate sound module, PCB revision
"SHVC-CPU-01", the lockout chip is labelled U8 on the PCB, and says:
F411
© 1990
Nintendo
It is located just behind the reset switch.
For a later revision PAL console with integrated sound, PCB revision
"SNSP-CPU-02", the lockout chip is labelled U8 on the PCB, and says:
F413A
© 1992
Nintendo
It is located towards the front left of the PCB, near the power switch.
For a still later revision U.S. console, PCB revision "SNS-CPU-GPM-01", the
lockout chip is labelled U8 on the PCB, and says:
F411A
© 1990
Nintendo
It is located behind and to the left of the reset switch.
8. Locate pin 4 of the lockout chip. The pins at each corner are numbered on
the PCB. Just count along from pin 1 to find pin 4.
9. Use the desoldering braid and soldering iron to remove some of the solder
from pin 4. It may help to cut the end of the braid into a "V" shape, so
that you don't inadvertently desolder any adjacent pins. Position the end
of the braid over where pin 4 meets the PCB, and briefly press down on this
with the soldering iron bit. You should see that some solder has been
"sucked into" the braid.
Using the needle, apply a gentle levering action to the pin as you
momentarily touch the soldering iron to it. The pin should come away from
the PCB. Carefully pull it up using the tip of the needle as a lever, so
that the end is a couple of millimetres away from the PCB.
10. That's it! You can optionally solder a short length of wire between pin 4
and 0V. Pin 9 of the lockout chip is at 0V, so you could connect these two
pins. Alternatively, you may wish to add a switch; see the "Possible
Incompatibilities" section below.
11. It is a good idea to test the console before putting it back together. Rest
the power switch on its mounting and connect the AC adapter, controller,
video lead and a game pak. Switch the console on. If all has gone well, the
display should appear as usual. Turn the console off, and insert a foreign
game pak (i.e., a U.S. or Japanese game pak if you have a PAL console; PAL
game pak if you have a U.S. or Japanese console). Turn the console off and
remove all attachments (AC adapter, etc.). Turn the power switch on and
then off.
12. Put the console back together. The procedure is the reverse of steps 2 to 7
above. You may find fitting the eject lever tricky. If so, put the metal
rod through the lever, and put the spring on the left end of this, so that
the outwards-pointing end of the spring is downwards. The outwards-pointing
end should be the longer of the two. Ease the spring and lever into
position, ensuring that the end of the spring goes into the recess in the
casing. Now carefully move the other end of the spring back until it is in
the recess in the lever.
Possible Incompatibilities
--------------------------
A few very recent titles may be incompatible with this modification. One
example is PAL "Street Fighter Alpha 2", used with a PAL SNES whose lockout
chip has been disabled. The graphics were reported to be corrupted in some way.
There is also reported to be more than one version of "Super Mario RPG", one of
which may be incompatible.
I know why this is. One explanation might be that Nintendo changed the lockout-
related circuitry inside the cartridges, to detect the "deadlock" situation
caused by disabling the console's lockout chip, and interfere with normal use
of the game in this case.
To solve this problem, and allow at least all domestic titles to be played, you
can fit a DPST switch to pin 4 of the lockout chip. Connect the middle switch
terminal to pin 4, and the other two terminals to +5V and ground respectively.
Then, with the switch in one position the lockout chip will be disabled, and in
the other it will operate as normal. Contact me if you are unsure of how to do
this.
At Your Own Risk!
-----------------
There are some interesting things which can be done now that the lockout chip
is disabled. If you try the following, it is at your own risk. Be aware that
removing a game pak while the console is on may damage your console or your
game pak.
If your SNES has an "eject prevention lever", you will have to try this before
fitting the case back on. (To see whether your console has one, open the game
pak shutter, and move the power switch. If you see a piece of plastic move out
when the switch is in the "on" position, that is the eject prevention lever.
Nintendo removed this from later U.S. models of the SNES, at least.)
Plug in a game pak; "Street Fighter II" is a suitable one. Turn on the console,
and wait until some music starts playing. Now carefully remove the game pak,
without turning off the console first. You should find that the display blanks,
but the music keeps playing until the end of the tune! This is because the
sound processor has its own RAM, and the music code is loaded into this. So
music continues to play even after removing the game pak.
---
Version original en texte brut : snes-lockout.txt