The Decapping Project

--->

Click for X100 image (~860k)

With the successful 'decap dumping' of the MCU from Bubble Bobble, it got us (MAMEDev) thinking if we could do this with a few more chips. Thus the 'Decapping Project' was born. The Problem: The development of some games in MAME is sometimes not accurate or has come to a halt because of missing code from protection devices. Emulation problems exist because custom chips on PCBs contain special code that is usually protected and therefore undumpable and the game will not work correctly without that code. Trying to fake that chip by simulating it with guessed code is not always the best way and sometimes isn't even possible at all. The Solution: One method used to defeat this kind of protection is to decap the chip and extract the 'bits' using manual extraction methods. This means the top of the chip is removed using fuming nitric acid (>98% pure nitric acid) then rinsed with acetone (and repeated many times) until the chip die is exposed. Then the chip is placed under a microscope and magnified pics are taken of the chip die (usually X100 or greater magnification) and the resulting images are processed manually to obtain the contents of the ROM. Unfortunately this method is time consuming, requires expensive equipment and is extremely hazardous to health (and we value our vital body parts like fingers and eyes dearly). So we are using the services of a professional decapping laboratory to help us with the decapping and magnification tasks. The total cost for each chip is approximately US$330. This includes decapping and enough X100 pics to give us the image of the ROM. Compared to buying the equipment ourselves (possibly around US$50000+) and dealing with the dangers involved, that cost is quite reasonable :-) The Rules: One of the main issues with decapping is that this method of data extraction can only be done with chips that contain MASKROM, it doesn't work for EPROM. In layman terms, MASKROM is kind of like an image of 0's and 1's that is 'moulded' into the chip die when it is manufactured. Those 0's and 1's are easy to see when magnified and given some time and experience can be decoded to produce binary code and/or data. This usually only works with older chips as many newer microcontrollers have added layers of protection and stealth that can defeat decapping methods and require much more effort and expense. The Myths: Regardless of whether we're successful with a particular chip or not, decapping is a fool-proof method that gives us a 100% solution of gained knowledge. There is no other way to know for sure about the contents of any custom chip except to decap the chip and find out what's inside. Some people say it's possible to probe chips, figure out what type they are, then wire them up and dump them or blackbox them using an army of logic analysers. Many of those people have not actually produced any evidence of this and are not living in the real world. The only way to obtain the truth is 'The Right Way(tm)' The Participants: The chips we're mostly concerned about are Micro-Controller Units aka MCU's or custom chips from mid 80's to late 90's arcade games containing MASKROM who's code is undumpable using normal methods. We're mostly guessing that many of these listed below contain MASKROM, but some may not. After some discussion, below is a list of chips that have been determined as possible candidates for decapping with additional info showing the games that used those chips and the status of the decapping effort. Please note the following..... If you would like to donate towards buying a PCB that contains one of the wanted chips so that we can attempt to decap and dump it, or you have one of the wanted chips and would like to donate it to us, contact me.

Decapping Status

Wanted

Might be Wanted Later

Got it. Decapping on the To-Do List

Decapping/Processing In Progress

FAILED! :-(

SUCCESS! :-D

Chip Name / Part Number	Package	Chip Pic	Found on....
6801U4 MCU	DIP40		Bubble Bobble
6801U4 MCU	DIP40		Kiki KaiKai. Same type of chip as Bubble Bobble, but instead of the Bubble Bobble dino there is a pic of the Kiki KaiKai knight
C-Chip	SDIP64		Bonze Adventure
Other C-Chips	SDIP64		Rainbow Islands, Operation Wolf, Superman, Volfied, Mega Blast
Namco Custom 50xx	DIP28		Bosconian, Xevious
Namco Custom 51xx	DIP42		Bosconian, Dig Dug, Galaga, Pole Position 1 & 2, Xevious
Namco Custom 52xx	DIP42		Bosconian, Pole Position 1 & 2
Namco Custom 53xx	DIP42		Dig Dug, Pole Position 1 & 2
Namco Custom 54xx	DIP28		Bosconian, Galaga, Pole Position 1 & 2, Xevious
Namco Custom 56xx	DIP42		Dig Dug II, Gaplus, Grobda, Libble Rabble, Motos, Pac & Pal, Pacman & Chomp Chomp, Phozon, Super Pacman, Tower Of Druaga, Toy Pop
Namco Custom 58xx	DIP42		Dig Dug II, Gaplus, Grobda, Libble Rabble, Mappy, Phozon, Super Pacman, Tower Of Druaga, Toy Pop
Namco Custom 59xx	DIP42		Pac & Pal, Pacman & Chomp Chomp
Namco Custom 62xx	DIP28		Gaplus
Kaneko Beast	DIP40		DJ Boy
Kaneko Mermaid	DIP40		Heavy Unit
Namco C67	PLCC68		All Namco System 21 games
Namco C76	QFP80		All Namco System 11 games
Kaneko MCUs	QFP74		Jackie Chan, Shogun Warriors, BRap Boys, Blood Warrior, Gals Panic etc
Toaplan MCUs	QFP94		Fix Eight, Dogyuun, Knuckle Bash, Grindstorm, VFive, Batsugun
NMK MCU (NMK004)	QFP64		Macross, Gun Nail, Acrobat Mission, Vandyke, Thunder Dragon + more?
Toshiba T5182 MCU	NDIP50		Panic Road, Lost Castle in Dark Mist. Note: Decapping isn't required. The chip has a metal cover that is easily removed by de-soldering it, revealing everything as shown in the pic.
BSMT2000 (TMS32015 with mask ROM)	DIP40		Used on Battle Toads, Police Trainer, Sharpshooter, Tattoo Assassins, Double Cheese, Fred Flintstones' Memory Match and Lotto Fun 2. Also used on Data East pinball machines.
CPS2 QSound sound chip (DSP16A with mask ROM)	PLCC84		Used on Capcom CPS1/2 and some ZN1/2 based Capcom games (Gallop Racer/SFEX/EX2 etc)
Fujitsu MB86233 'TGP' DSP	QFP160		Used on Sega Model 1, 2 & 2A

Updates will follow as I find out more......


Want to see more games in MAME? Please consider donating.