any tricks to retrieve a NEC 23256 ROM data ?

R

robb

Guest
this is a read-only maskable 32K words x 8bit ROM (compatible
with 27cxxx ROMs)

This ROM chip was subjected to momentary 32 V DC on the Vcc pin.

Now (no surprise) it behaves as rather continuously and
permanently dead.

Are there any tricks anyone knows or used to enable a read of
the data off seemingly dead ROM chips ?


thanks for any advice,
robb
 
robb wrote:
this is a read-only maskable 32K words x 8bit ROM (compatible
with 27cxxx ROMs)

This ROM chip was subjected to momentary 32 V DC on the Vcc pin.

Now (no surprise) it behaves as rather continuously and
permanently dead.

Are there any tricks anyone knows or used to enable a read of
the data off seemingly dead ROM chips ?


thanks for any advice,
robb


Don't think so..
Click to expand...
Sorry.. Not only that, I think you may have even exceeded the
programming voltage! :(


--
"I'd rather have a bottle in front of me than a frontal lobotomy"
http://webpages.charter.net/jamie_5
 
Are there any tricks anyone knows or used to enable a read of
the data off seemingly dead ROM chips ?
Click to expand...
It might be possible, but it would probably be very expensive.

How much is the data worth?

http://www.cl.cam.ac.uk/~mgk25/sc99-tamper-slides.pdf
http://www.cl.cam.ac.uk/~mgk25/sc99-tamper.pdf


--
These are my opinions, not necessarily my employer's. I hate spam.
 
"Hal Murray" <hal-usenet@ip-64-139-1-69.sjc.megapath.net> wrote
in message news:Y7udnQwOXqHBBv3anZ2dnUVZ_s7inZ2d@megapath.net...
Are there any tricks anyone knows or used to enable a read
of
the data off seemingly dead ROM chips ?

It might be possible, but it would probably be very expensive.

How much is the data worth?

http://www.cl.cam.ac.uk/~mgk25/sc99-tamper-slides.pdf
http://www.cl.cam.ac.uk/~mgk25/sc99-tamper.pdf
Click to expand...
wow, very interesting.
I would need a pretty good %99.999 off coupon to use that service

robb
 
robb wrote:

this is a read-only maskable 32K words x 8bit ROM (compatible
with 27cxxx ROMs)

This ROM chip was subjected to momentary 32 V DC on the Vcc pin.

Now (no surprise) it behaves as rather continuously and
permanently dead.

Are there any tricks anyone knows or used to enable a read of
the data off seemingly dead ROM chips ?
Click to expand...
I think you're finally out of luck.

Is the manufacturer of that board / equipment still around ?

Graham
 
robb wrote:
Are there any tricks anyone knows or used to enable a read of
the data off seemingly dead ROM chips ?
Click to expand...
Yes. For masked ROMs you can decap the part and read it optically.

Decap is easy for ceramic; you can just break it open. For plastic
packaged parts, it involves fumic nitric or sulfuric acid, so you'd
be best advised to send it to a lab.

Once you can see the die, under a microscope you can distinguish
the one bits from the zero bits. Generally that is the presence or
absence of a metal contact. Whether the presence represents a one
or a zero depends on the specific part number, and might vary
within the array (i.e., it might be presence=1 for the left half
of the array and absence=1 for the right half).

You also will need to determine the layout of the bits. The address
lines are divided into those that address rows and columns. Study
of the decoder circuitry on the perimeter of the array can help
determine this.

If you can take a sufficiently high-resolution photomicrograph of
the die, once you've determined the mapping you may be able to
write software to extract the bits, so that you don't have to do
it by hand.

None of this is easy, but there is an existence proof that it is
possible. Peter Monta optically dumped three ROMs from the HP-35
calculator. These stored 2560 bits each, and were made in 1972 using
ten micron process geometry, The 23256 is a much newer part in
a smaller geometry, which means you'll need better resolution for
the photomicrograph, but it still should be quite possible.

http://www.pmonta.com/calculators/hp-35/

Or you can just buy another unit of the model the 23256 came from.

Eric
 
Jamie wrote:
Don't think so..
Sorry.. Not only that, I think you may have even exceeded the
programming voltage! :(
Click to expand...

WHAT programming voltage? It's a mask programmed ROM


"I'd rather have a bottle in front of me than a frontal lobotomy"
Click to expand...

Too late now, so you'll just have to live with the lobotomy. :(


--
Service to my country? Been there, Done that, and I've got my DD214 to
prove it.
Member of DAV #85.

Michael A. Terrell
Central Florida
 
Michael A. Terrell wrote:

Jamie wrote:


Don't think so..
Sorry.. Not only that, I think you may have even exceeded the
programming voltage! :(



WHAT programming voltage? It's a mask programmed ROM



"I'd rather have a bottle in front of me than a frontal lobotomy"



Too late now, so you'll just have to live with the lobotomy. :(


Oh sorry Mr. Terrell your holiness, I obviously over looked that part, I
Click to expand...
just assume it was a prom or even UV-prom..

I'll try not blunder so badly next time. I wouldn't want to be the
cause of any health issues on your end.



--
"I'd rather have a bottle in front of me than a frontal lobotomy"

"Daily Thought:

SOME PEOPLE ARE LIKE SLINKIES. NOT REALLY GOOD FOR ANYTHING BUT
THEY BRING A SMILE TO YOUR FACE WHEN PUSHED DOWN THE STAIRS.
http://webpages.charter.net/jamie_5"
 
On Dec 12, 6:37 am, "robb" <s...@where.on.net> wrote:
this is a read-only maskable 32K words x 8bit ROM (compatible
with 27cxxx ROMs)

This ROM chip was subjected to momentary 32 V DC on the Vcc pin.
Click to expand...
IF you drive the logic inputs from CMOS, it's possible that internal
protection diodes will sufficiently power the chip from the input
logic.
As long as at least one address or select bit is HIGH, there's a
chance the outputs will go to the right voltage level for readout.

This will work best if (1) the chip is cold, (2) the outputs are
very lightly loaded, or disconnected completely, (3) the only fault
that resulted from overvoltage was a burnt-out power wire, (4)
the readout is done slowly (a millisecond delay for each readout
should suffice).
 
"whit3rd" <whit3rd@gmail.com> wrote in message
news:aae8638d-1777-46da-ab7e-a985b06b3d3e@w40g2000hsb.googlegroups.com...
On Dec 12, 6:37 am, "robb" <s...@where.on.net> wrote:
this is a read-only maskable 32K words x 8bit ROM
(compatible
with 27cxxx ROMs)

This ROM chip was subjected to momentary 32 V DC on the Vcc
pin.

IF you drive the logic inputs from CMOS, it's possible that
internal
protection diodes will sufficiently power the chip from the
input
logic.
As long as at least one address or select bit is HIGH, there's
a
chance the outputs will go to the right voltage level for
readout.

This will work best if (1) the chip is cold, (2) the outputs
are
very lightly loaded, or disconnected completely, (3) the only
fault
that resulted from overvoltage was a burnt-out power wire, (4)
the readout is done slowly (a millisecond delay for each
readout
should suffice).
Click to expand...
thanks for idea,
are there ROM programmer/readers that allow you to specify
reading to that degree ?

are there pin electrical reading/ checks that need to be
performed to verify that this is possble ?

thanks for help and ideas,
robb
 
"Eric Smith" <eric@brouhaha.com> wrote in message
news:m3d4ta9dg6.fsf@donnybrook.brouhaha.com...
robb wrote:
Are there any tricks anyone knows or used to enable a read
of
the data off seemingly dead ROM chips ?

Yes. For masked ROMs you can decap the part and read it
optically.

Decap is easy for ceramic; you can just break it open. For
plastic
packaged parts, it involves fumic nitric or sulfuric acid, so
you'd
be best advised to send it to a lab.

Once you can see the die, under a microscope you can
distinguish
the one bits from the zero bits. Generally that is the
presence or
absence of a metal contact. Whether the presence represents a
one
or a zero depends on the specific part number, and might vary
within the array (i.e., it might be presence=1 for the left
half
of the array and absence=1 for the right half).

You also will need to determine the layout of the bits. The
address
lines are divided into those that address rows and columns.
Study
of the decoder circuitry on the perimeter of the array can help
determine this.

If you can take a sufficiently high-resolution photomicrograph
of
the die, once you've determined the mapping you may be able to
write software to extract the bits, so that you don't have to
do
it by hand.

None of this is easy, but there is an existence proof that it
is
possible. Peter Monta optically dumped three ROMs from the
HP-35
calculator. These stored 2560 bits each, and were made in 1972
using
ten micron process geometry, The 23256 is a much newer part in
a smaller geometry, which means you'll need better resolution
for
the photomicrograph, but it still should be quite possible.

http://www.pmonta.com/calculators/hp-35/

Or you can just buy another unit of the model the 23256 came
from.

Eric
Click to expand...
thanks eric,
i think your last idea is more possible/probable and thrifty :)

thanks again for help,
robb
 
whit3rd wrote:
(3) the only fault
that resulted from overvoltage was a burnt-out power wire,
Click to expand...
Not bloodly likely. The chip will be damaged much more quickly
than the supply (or ground) bond wires will open.
 
You must log in or register to reply here.

Welcome to EDABoard.com

Sponsor

Back
Top