Jon V. wrote:

> As an example, back in '89-91 I worked for a company which reverse
> engineered the Nintendo Entertainment system (NES, the first really
> *biig* console (home) game machine Nintendo did.) to develop games.
> This
> is significant because Nintendo held several U.S. patents which were
> designed specifically to keep competitors from developing games for
> the
> machine.
>
> Patent 1) A "keychip" (small microcontroller, not PIC) was located on
> each game cartridge, and talked to a controller in the game machine.
> If
> the two didn't speak the same language (so to speak), the game
> wouldn't
> play.

Interesting.  Back in that same time frame, I worked for a company where
it was my task to create a clone of the HP printer memory expansion
cards.  The HP2P came out with a new form factor card than earlier
models, and that card also had a "keychip" microcontroller.  I wonder if
they were violating a Nintendo patent?  However the controller was also
doing a minor configuration task [nothing that couldn't have been done
with a GAL], so maybe that got around it.  But its main task was
obviously to make it difficult to copy the card.  HP viewed the memory
cards as a significant profit center.  It allowed them to cut the list
price of the printer, by selling it without enough memory to do a full
page of graphics; and then make up the profit on a memory expansion card
that sold for about 4X the prevailing price of memory.

We knew from previous experience that HP employed 'traps' to make it
difficult to make a totally compatible card [secret addresses in the
address decode GALs], so we knew that it was absolutely necessary to
decode the micro completely to look for secret commands.  We suspected
that there might be commands that were only called once every 1000 hours
of operation or somesuch.

We decoded it by acid burning off the top of the package and reading the
masked ROM with a microscope.  Not the most fun job, but not as hard as
you might expect.

The 'trap' that we found was a command that, when executed, would cause
the microcontroller to repeat back the HP copyright notice, and the
first 256 bytes of the ROM.  Nobody could duplicate that command without
including the notice and the HP code within their own code.  I don't
know that HP ever implemented that command; IBM et al, were being hit
with 'restraint of trade' suits at about that time, so they may have
backed off.  I know that other clone card makers did not include that
command.  [I also know that at least one other clone card maker {a
*very* big memory card name} copied the HP code byte-for-byte, just
rearranged a bit to hide their dirty work.]

We did our copy 'clean' with a spec written from the original
disassembled code, a separate coding team, and a different
microcontroller.  We did include the copyright/code command, by encoding
it within our ROM.  It didn't become the HP copyright/code until it was
decoded when the command executed ['your honor, its just a bit stream
required by the command... we don't know its significance...'].

GC