Disabling the NES "Lockout Chip" (rev. 0.4 22-Sep-97) ================================ Introduction ------------ This document details a simple modification that you can perform on your Nintendo Entertainment System video game console in order to remove the "lockout chip" protection system. Why might you want to do this? Well, I can think of a couple of reasons: · You own unlicensed games which can't be played on your model of NES; · You own foreign games, and currently have to use a clumsy adapter system. For example, after performing the modification you can use most PAL games on a U.S. console, and use most U.S. games on a PAL console console. This document is copyright © 1997 by Mark . The latest version should be available at: http://www.netcomuk.co.uk/~markk/index.html You are explicitly permitted to include the unmodified document on web sites, ftp sites and the like. The procedure given here should work for ANY old design NES (i.e., any front- loading model). The new design NES doesn't have a lockout chip anyway. With the modification, you can play *ALL* PAL games (European, Hong Kong or U.K.) on *ANY* PAL console. However, you can't play all PAL games on a U.S. console, or play all U.S. games on a PAL console. Some games are incompatible with the different display standards. Examples of this are High Speed, Pin Bot (both hang the console), Time Lord, Digger T. Rock, and various other games developed by Rare Ltd. However, the majority of games do work fine. NOTE: IF YOU KNOW HOW TO CONVERT A PAL NES TO GIVE A 60Hz DISPLAY, PLEASE CONTACT ME! IF THIS IS POSSIBLE, IT WILL ENABLE *ANY* NES GAME TO BE PLAYED ON *ANY* NES, AT THE CORRECT SPEED. Modifications similar to this are easily done on SNES, Master System and Mega Drive/Genesis consoles, but I suspect that the NES would need a new PPU chip. If you perform this procedure on your console, PLEASE LET ME KNOW WHETHER IT WORKS! I want to update this document so that it's applicable to as many consoles as possible. Please tell me which PCB revision your console has (e.g. NES-CPU-11), the serial number and also the lockout chip number (e.g. "3197A"). I have successfully carried out this procedure on a U.K. model NES, which has PCB revision NES-CPU-11. All unlicensed games that I own, and U.S. and European licensed games work fine. (The unlicensed games which I tried are Action 52, Crystal Mines, Firehawk and Super Adventure Quests.) This procedure has been reported to work on a U.S. model NES, revision NES-CPU-11. If you are interested in the operation of the lockout chip and the NES' history in general, you might like to read David Sheff's excellent book "Game Over", and consult U.S. patents 4,799,635 and/or 5,070,479. Indeed, I obtained the information necessary to carry out this modification from one of these patents. Background ---------- Before the NES was first released in the U.S.A., Nintendo developed a system for preventing the use of unauthorised software with it. Much counterfeit software had apparently been produced for their Famicom (Family Computer) game system, and Nintendo wanted to avoid this happening for the NES. Another benefit (to Nintendo, at least) of the system was that legal third- party development was severely hindered. Only Nintendo licensees could buy the lockout chips, one of which was fitted inside every game cartridge. Licensees were apparently charged around US$9 for each chip. Some companies managed to get around the lockout system and produce their own unlicensed games. Examples of this are Active Enterprises, Codemasters/ Camerica, Color Dreams and Tengen (though Tengen's system was ruled to infringe Nintendo's copyright on the "10NES" program, the program inside the lockout chip). Macronix Inc. filed U.S. patent 5,004,232, which details a method for getting around the lockout. However, during the life of the NES Nintendo periodically modified the console, meaning that some unlicensed games no longer worked. For example, "Action 52" and "Crystal Mines" do not work on my U.S. NES. If your NES has board revision NES-CPU-11, it will be unable to play these games. Disabling the lockout chip solves this problem. Nintendo also used the lockout system to provide a "territorial protection". This means that you can't use a U.K. or European game in a U.S. console, for example. At least four different types of lockout chip are used in U.K., European, Hong Kong and U.S. machines. A cartridge with one type of lockout chip is incompatible with a console containing any other type. How the Lockout System Works ---------------------------- This is a very brief description. Consult Nintendo's patent for detailed information. Identical chips are fitted to the console and inside every game cartridge. Depending on whether a certain pin (pin 4) of the chip is grounded or at +5V, the chip functions as either a lock or as a key. Inside the console, pin 4 of the lockout chip is at +5V (lock), and inside the game cartridge pin 4 is at 0V (key). When you switch on the NES, the CPU and PPU are held in a reset state. The two lockout chips talk to each other. Since the chips are identical, they should be saying exactly the same thing at exactly the same time. Each chip compares its output with that of its counterpart. If they match, the lock chip releases the reset state of the console, and the game can start. The two chips still talk to each other, and if the outputs of the two chips ever differ, the lock chip causes the console to repeatedly reset, and the key chip inside the game cartridge may use the chip select lines of the cartridge ROM chips to disable them (though this disabling of the ROMs was probably never done). The lockout chip is in fact a 4-bit microprocessor with its own internal ROM and RAM. The program in the ROM is called "10NES". How the Modification Works -------------------------- This depends on changing the lock device to think that it's actually a key. If both devices are configured to be the same type (i.e., both keys), to quote Nintendo's patent "an unstable state takes place and no operations are performed at all." This means that the two chips will do nothing. So the console will not be reset, and the key device will not disable the cartridge ROM chips. To carry out the modification you need to disconnect pin 4 of the lockout chip, and connect this pin to ground (0V) instead. If you do something wrong and the entire pin 4 breaks off, don't worry. This is what happened to me, but the console still works fine. It may not be absolutely necessary to connect pin 4 to 0V; leaving it unconnected may be okay. When I was thinking about what might be done to defeat the protection system, I came up with three answers. The first is the simplest and is that presented here. The second is more complicated and works in a different manner. I have not tried this method, so I can't say whether it actually works. Basically, it involves connecting the output of each chip to that chip's input. So each chip would 'talk to itself'. Since the input will always be the same as the output, the chip will think that its counterpart is of the right type, and will not reset the machine. The third method involves disconnecting the 4MHz clock from the lockout chip in the console and the line that leads to the lockout chip clock pin in the cartridge. This may well work - if there is no clock, both devices should be halted, and thus will not be able to do anything. Performing the Modification --------------------------- You will need the following: · A crosshead screwdriver suitable for opening the NES case and removing the screws inside; · A very sharp, very small knife, pair of scissors or similar to cut the IC pin - a two-sided implement (e.g. scissors) is preferable to a knife; · A soldering iron and solder, and optionally some desoldering braid; · A short length of thin insulated wire, with the ends stripped of insulation - 2cm is enough. When removing screws, make sure you remember which type goes in which hole! Here are step-by-step instructions: 1. Remove the six screws from the base of your NES and lift off the upper part of the case. 2. Remove the seven screws which attach the upper metal shielding to the PCB, and remove this shielding. 3. Remove the two screws from around the modulator. One is to the left of the RF jack, the other in front of the A/V jacks. 4. Remove the six screws which attach the cartridge tray to the PCB, case and black plastic connector. Note that the "middle" pair are different to the others - they are longer, and a silver colour. 5. Now gently lift the PCB (and cartridge tray and lower shielding) up out of the case. Remove the leads from the controller ports and power/reset switch PCB, and remove the lower metal shielding. 6. Slide the cartridge tray forwards, lifting it away from the PCB and connector. You can leave the connector attached to the PCB. 7. Turn over the PCB, with the component side up and the black cartridge connector towards you. 8. Note the PCB revision. It's printed in white ink near the centre of the PCB. For example: "NES-CPU-11". There is a white sticker on the PCB which tells you which type of console you have. For example, my U.K. model says "PAL-MTL" (MTL is short for Mattel). An American console says "NTSC", and a Hong Kong console says "PAL-ASI" (ASI probably short for Asia). Let me know if yours is different! 9. Find the lockout chip. "U10 CIC" will be printed above it on the PCB. (The U number is not relevant; "CIC" is.) The lockout chip on my console has the following text printed on it: 3197A © 1986 Nintendo 9213 A This is for a U.K. model console. Other known numbers are 3193A (American), 3195A (European), and 3196A (Hong Kong). The chip has 16 pins. 10. Locate pin 4 of the lockout chip. This is on the row nearest to you, the fourth from the left. 11. You need to cut this pin, and bend it up and away from the PCB. You may need to bend a couple of capacitors on the PCB away from the lockout chip in order to get to it. If something goes wrong and the entire pin breaks off, don't worry - see the "How the Modification Works" section. It may help to desolder the pin first; you can use some desoldering braid for this. Try and cut as close as possible to the PCB, so that a decent length is left attached to the chip. A neater way of doing this would be so desolder the entire chip, bend out pin 4, and resolder the chip, leaving pin 4 sticking out. However, this is quite difficult if you don't have a special IC desoldering tool. 12. This step is optional. Things seem to work fine with pin 4 left unconnected. But you can connect it to ground if you like. Solder the length of wire from pin 4 to ground. Suitable places to connect to are pins 11, 12, 13, 14 or 15 of the lockout chip, since these are all grounded. Pin 15 is on the row furthest away from you, second from left. 13. That's it! You may want to test your NES before fitting it back together. Put the PCB back in the case and connect the power and controller connectors. Slide the cartridge tray into position, making sure the lip is below the PCB. Put a game cartridge in and switch on. Hopefully everything will work! To check whether the lockout chip has really been bypassed, switch on with no cartridge inserted. There should just be a blank screen, with no 'flashing' effect. 14. Now reassemble your console. Enjoy your new 'universal' NES! ---