ACID chip inside

[fano]

Does this mean it would be possible to put in onto a disk?

About CPR files, i was speaking about ROM dumps.You can put a 128K rom dump on a CPC disk but that will not be very usefull.

What is the 'fee cost' and how much is it?

Sorry , i meant postage fee or delivery cost    i saw Ntronics uses UPS and the minimal cost to send something is about 100Euros.

[redbox]

Sorry , i meant postage fee or delivery cost    i saw Ntronics uses UPS and the minimal cost to send something is about 100Euros.

UPS Standard to deliver a 1kg package from Germany (Treuchtlingen, N-Tronics) to the UK is 30 Euros.

They also let you use Fedex, DHL, TNT etc which may be even cheaper and say if you prefer an other company, please email us your accountnumber, and the service you wish to use.

[fano]

 

That's weird , i made a simulation for France (150 kms from Paris) and i got 100Euros !
I am going to look at this more.

[MacDeath]

Are there any news about the ACID deciphering project ?

[nocash]

> Spanish Amstraders are actually trying to analyse it properly.
> French are talking about it, mostly trying to decipher the spanish talks....
> Are there any news about the ACID deciphering project ?

Oh-oh, and english speaking people discuss about eventually buying a real ACID chip ;-) aren't that chips mass-produced and included in all game and system cartridges anyways?

If somebody should happen to want to donate a cartridge, and maybe even a gx4000, I am sure I could figure out how it works in 2-3 days - you can make jokes on me for the rest of my life if I can't :-)

[fano]

lol nice analyse 

Why not ? where do you live ?

ACID is a question , LKs configuration is another.

I would like to know how LK0-6 alter memory addressing but i do not own needed stuff actually to do that (mainly eprom burner/eraser).So i have hypothesis about LKs but i can not check it for now.

[MacDeath]

Haha, nice try "nocash"...

But We all know that GX4000 are gettting high priced on Ebay thx to those stupid retro-game collectionners.
So are Plus cartridges...

You just don't want to pay the 50-75€uros to get those to complete your collection.

[nocash]

> Why not ? where do you live ?
Germany/Hamburg. Is that okay?

> I would like to know how LK0-6 alter memory addressing
That's more or less described / shown on photos, here:
  http://cpcwiki.eu/index.php/GX4000_cartridge
the only info that is missing there is a table or schematic that shows which signals connect to which jumpers, no big problem. Most or all of them don't seem to alter addressing at all, just deal with slightly different pin-outs.

For example, LK3 apparently connects 5V supply to Pin28 of 64K chips (with 28pins), on bigger chips (with 32pins), supply is on Pin32, and the above pin is instead used as address line (and must be connected with one of the other LK's).

And the ACID, meanwhile, I've began wondering how complex it could be. Is there already something more known than listed here,
  http://cpcwiki.eu/index.php/ACID
judging from that info, it could be everything... some simple shift/xor logic... but it might also contain kilobytes of encryption data... or even serially transfer program code :-) anyways, it'd be nice to have a look at it, and I won't give up after 3 days if it turns out to be more difficult.

[nocash]

> For example, LK3 apparently connects 5V supply to Pin28
Correcting myself. LK4 or LK6 seems to be closer to the supply pin. No idea why the table lists LK3 to be shortened for 28pin 64K chips... seems to be a bug in the description (?) especially as it says that LK3 is to be shortened for 32pin 256K chips, too. Which doesn't make too much sense.

[fano]

That's more or less described / shown on photos, here:
  http://cpcwiki.eu/index.php/GX4000_cartridge

This is a bit short and i am not sure this information is correct.AFAIK there were only 128K commercial productions, some dumps are more than 128K because of the LKs.

it'd be nice to have a look at it, and I won't give up after 3 days if it turns out to be more difficult.

I can send you the awfull noexit but i own the pcb without plastic part.Send me a PM with your address.

PS:i found the ultimate book to hack spanish

[nocash]

> the awfull noexit but i own the pcb without plastic part.
Perfect. I am living here,
  Martin Korth
  Ernst-August-Deich 59
  21107 Hamburg
  Germany

[MacDeath]

You're a Hamburger ?

Big Mac ?

(keep on trolling...)

[arnoldemu]

Are there any news about the ACID deciphering project ?

Steve Gane doesn't answer my e-mails.

[fano]

This is a very bad news 
We were expecting a lot of him 

[TFM]

Up to now I didn't get an answer from the company which sells the ACID chips.

Has anybody here ordered or is willing to order.

I would take a bigger amount, should shrink the price.

cu. TFM / FutureSoft

[dragon]

IF they not respond to email,maybe you found they in the  chat (you need skype)


skype:ntronics.semiconductor?chat

View the web page,I think  when the icon of chat is in  green colour they are connected.

http://www.n-tronics.com/english/contact/testimonials.php

[fano]

Interesting.
Give us some news if you success TFM/FS 

[OCT]

If all else fails, see http://www.heise.de/kiosk/archiv/ct/2008/8/80_kiosk (not free but affordable even if you don't have the paper copy on shelf) and http://sar.informatik.hu-berlin.de/research/publications/SAR-PR-2008-21/SAR-PR-2008-21_.pdf pages 47-48 for an explanation how as a last resort planing and acid could also be used on an ACID (there are also a number of YouTube videos demonstrating the approach).

But we're not even dealing with a present-day crypto processor that would require that level of scrutiny, rather a custom IC that "celebrates" its 20th anniversary while most likely having no idea of time (e.g. for delaying replies to slow down access attempts) - at worst, it should shut down until reset when accessed improperly, but probably not even that.

Clock speeds have increased by 1000 approx. (and memory even more) since the era it was designed in, while the cost and complexity of analyzers (once the domain of advanced electronics manufacturers) has come down from the equivalent of a car in both respects, to rather simple USB dongles no more expensive than the computers they plug into.
Given the hardware developped by people on this forum alone, I'd be surprised if nobody had that kind of equipment available, or worked at places that do.
As a matter of fact, it is already happening, albeit in Spanish (which I can barely decipher let alone translate):
http://amstradcpc.mforos.com/305097/7723493-que-hace-exactamente-el-chip-acid-de-los-cartuchos/?pag=5#80103417
http://amstradcpc.mforos.com/305097/7723493-que-hace-exactamente-el-chip-acid-de-los-cartuchos/?pag=6#80195374
There is speculation in that thread (partly in English) about the ACID being a pseudo random number generator (presumably comes down to some kind of hardware hash), but at any rate this being done by in-house engineers experienced with PALs and GALs of the era (and knowing the 8-bit world's fate, i.e. having to withstand attacks only for limited times), one wouldn't expect something utterly innovative and completely different from what they used in the rest of their designs.
They even called it the Cartridge Gate Array (suggesting a logic chip) in their own Service Manual, for crying out loud:
http://amstradcpc.mforos.com/305097/7723493-que-hace-exactamente-el-chip-acid-de-los-cartuchos/?pag=6#80246125

[nocash]

Yeah, photos of the ACID chips interiors in (microscopic) super-hi-resolution could be useful. I am a bit surprised that nobody with access to labs has taken such pictures yet, some people do such things for popular console hardware, like NES or gameboy, but probably the ACID is too rare.

I can't translate the spanish forum, too. All I can see, is that they have some nice pictures, at first glance that is. At second glance, the pics look totally off-topic :-) seeing the pretty RAS and CAS waveforms - which have absolutely nothing to do with the ACID chip - I wonder if that guys have at least -begun- to do any ACID rev-engineering.

Send me, send me, somebody a cpc+/gx4000 cartridge! And I'd love to examine how the acid chip works! Btw. Fano, did you found your out-sorted cartridge somewhere?

[robcfg]

Hi guys,

as far as I remember, the ACID chip (or its absence) prevents acces to RAM or something like that.

I can translate the pages for you, send me a pm with the lin k to the page and I'll try to do it as soon as possible.

[redbox]

Send me, send me, somebody a cpc+/gx4000 cartridge! And I'd love to examine how the acid chip works!

This website has some for £7.99 each.

If you're really desperate, then I can buy one and send it to you if it means you can have a go at cracking the ACID 

[Bryce]

Hi nocash,
        a photo of the chips silicon??? What would you do with it??? You don't seriously believe you could read this? For a start, I doubt any 8-Bit hobby hardware person has the equipment to do this and even if they did, do you know how difficult it is to "read" silicon??? I do this stuff for a living and believe me, even with expensive microscopes, multi-angle cameras and fancy template recognition algorythms (assuming you know the structure used in this particular chip) it's still a complete hit and miss exercise and you'd have to destroy quite a few real ACID chips to get any meaningful result.

Bryce.

[fano]

Btw. Fano, did you found your out-sorted cartridge somewhere?

Yes, normaly it will be sent this afternoon 

[arnoldemu]

I can't translate the spanish forum, too.

http://groups.google.com/group/comp.sys.amstrad.8bit/browse_thread/thread/00621273fbd0f8f4#

[dragon]

I think the gate array of acid chip contains a maximum of 700 to 1000
logic gates.

Based on the datasheets of gate arrays from the 1990  in different manufacturers.

But the technology that had at that time in the manufacture of gate arrays.It implies that normally could not use 100% of gates.So manufacturers of that time, bought gate arrays with more capacity than they needed.


On the other side.Maybe someone with an oscilloscope could try a Simple power analysis (SPA).That is completely safe for the acid.

http://en.wikipedia.org/wiki/Power_analysis

Maybe not worth much, but to try something different.